Incident Overview
On December 20, 2024, the Italian Data Protection Authority (Garante per la protezione dei dati personali) concluded its investigation into OpenAI’s ChatGPT service with a €15 million fine. This marks the first major GDPR penalty imposed on a generative AI provider. The Garante’s decision was issued under Provvedimento n. 755 of November 2, 2024, though this was later temporarily removed from the Authority’s website following a judicial appeal by OpenAI. The Court of Rome’s judgment (No. 4153/2026, published March 18, 2026) upheld OpenAI’s opposition, effectively overturning the fine’s enforcement but not the underlying findings of non-compliance.
The Garante’s ruling stems from a broader inquiry initiated in March 2023, aligned with the European Data Protection Board’s (EDPB) guidance on AI-driven data processing. The investigation identified systemic failures in OpenAI’s compliance with GDPR requirements, particularly in the handling of personal data for training purposes and the absence of age-verification mechanisms for minors.
The fine was accompanied by a mandatory six-month public awareness campaign, ordered under Article 166(7) of Italy’s Privacy Code. OpenAI was required to design and execute a multi-channel communication strategy—spanning radio, television, print media, and the internet—to educate users and non-users about ChatGPT’s data collection practices, the rights of data subjects (including opposition, rectification, and deletion), and how to exercise these rights.
The investigation also revealed that OpenAI failed to notify the Garante of a data breach affecting user information in March 2023. Additionally, the Authority determined that OpenAI processed personal data for training ChatGPT without a valid legal basis and neglected to implement age-verification systems. This omission posed risks to minors under 13, who could be exposed to responses inappropriate for their developmental stage or self-awareness.
Under the GDPR’s ‘one-stop-shop’ mechanism, the Authority forwarded the case files to the Irish Data Protection Commission (DPC), which became the lead supervisory body for any ongoing violations post-Ireland’s designation as OpenAI’s primary EU hub.
The €15 million penalty was calculated considering OpenAI’s cooperative stance during the proceedings. However, the fine’s enforcement was suspended pending the judicial review, which ultimately sided with OpenAI’s appeal. Despite this, the Garante’s findings remain a precedent for EU enforcement actions against AI providers, particularly regarding data transparency, legal basis for processing, and child protection.
Possible Root Cause
- Lack of a Valid Legal Basis for Data Processing: OpenAI trained ChatGPT using personal data without establishing a lawful foundation under GDPR, such as explicit user consent or a legitimate interest assessment.
- Failure to Notify a Data Breach: In March 2023, OpenAI experienced a data breach affecting user information but did not notify the Garante within the 72-hour deadline required by GDPR (Article 33). This omission violated transparency obligations and hindered the Authority’s ability to assess and mitigate the breach’s impact promptly.
- Absence of Age-Verification Mechanisms: OpenAI did not implement systems to verify users’ ages, exposing minors under 13 to content or interactions unsuitable for their age group. The Garante highlighted that this deficiency conflicted with GDPR’s child protection provisions (Article 8) and Italy’s Privacy Code, which mandate heightened safeguards for minors’ personal data.
The investigation also noted that OpenAI’s reliance on broad data collection for training purposes—without clear user awareness or opt-out mechanisms—contributed to the violations.
Additionally, the timing of OpenAI’s establishment of a European headquarters in Ireland during the investigation introduced procedural complexities. While the Garante adhered to the GDPR’s ‘one-stop-shop’ rule by referring the case to the Irish DPC, the shift in jurisdiction complicated the enforcement of corrective measures, particularly those requiring direct user communication (e.g., the mandatory awareness campaign).
Takeaways
- Transparency and Legal Basis for Data Processing: The ruling underscores the necessity for AI developers to justify data collection for training purposes with a valid legal basis. The Garante’s findings suggest that vague reliance on ‘legitimate interest’ or broad user agreements may not suffice; explicit consent or alternative lawful grounds must be clearly documented and communicated to users.
- Obligations for Minors’ Data Protection: The absence of age-verification systems in ChatGPT highlighted the risks of exposing minors to AI-generated content without developmental appropriateness safeguards.
- Data Breach Notification Compliance: OpenAI’s failure to notify the Garante of the March 2023 breach within the 72-hour window sets a clear expectation for AI providers: GDPR’s notification requirements are non-negotiable, even in complex technical environments. Delays or omissions in breach reporting can exacerbate regulatory scrutiny and financial penalties.
- Cross-Border Enforcement Challenges: The case illustrates the procedural hurdles arising from AI providers’ dynamic operational structures, such as relocating European headquarters mid-investigation. While the GDPR’s ‘one-stop-shop’ mechanism aims to streamline enforcement, the Garante’s referral to the Irish DPC demonstrates that jurisdictional shifts can delay or complicate corrective actions, particularly those involving direct user obligations (e.g., awareness campaigns).
- Public Awareness Campaigns as Remedial Measures: For the first time, the Garante invoked Article 166(7) of Italy’s Privacy Code to mandate a six-month public awareness campaign. OpenAI’s obligation to design and execute this campaign—under the Garante’s supervision—serves as a model for how AI providers might be held accountable for informing users about data practices.
- The appeal process highlights that AI providers can challenge regulatory decisions, though the underlying violations—such as inadequate legal bases or child protection measures—remain actionable under GDPR.
- Alignment with EDPB Guidelines: The Garante’s investigation was conducted in parallel with the EDPB’s 2023 opinion on AI and data processing. Providers ignoring these guidelines risk facing coordinated enforcement actions across EU member states, as demonstrated by the Garante’s proactive stance.
For AI developers, the incident serves as a cautionary example of the regulatory risks associated with opaque data practices, insufficient child safeguards, and procedural oversights. The case also signals that GDPR enforcement in the AI sector will increasingly focus on proactive measures—such as mandatory awareness campaigns—to ensure user understanding of data rights and system limitations.