Italian Garante’s 2023 Ban and 2024 Fine Against OpenAI: A Landmark in AI Regulation
The Italian Data Protection Authority (Garante) became the first regulatory body in Europe to impose a temporary ban on a generative AI service and the first to issue a fine under the General Data Protection Regulation (GDPR) against OpenAI for its ChatGPT platform. These decisions established a precedent for lawful data processing, transparency obligations, and age-verification requirements in AI systems across the European Union.
The Garante’s actions followed an investigation initiated in March 2023, prompted by concerns over data handling practices, transparency failures, and the absence of age-verification mechanisms. The investigation was conducted in alignment with the European Data Protection Board’s (EDPB) guidance on AI-driven data processing, which aimed to standardize approaches to compliance in this emerging field.
The Garante’s findings highlighted three critical violations: OpenAI failed to notify the Authority of a data breach in March 2023, processed user data without a valid legal basis for training ChatGPT, and neglected to implement transparency measures or age-verification systems.
The 2023 Temporary Ban: Key Violations and Immediate Actions
The Garante emphasized that OpenAI’s reliance on user data for training its AI model lacked a clear legal basis, particularly under the GDPR’s consent and legitimate interest frameworks.
The investigation revealed that OpenAI collected personal data from both users and non-users—including conversations, queries, and metadata—to train ChatGPT’s language model.
A significant oversight was the absence of age-verification measures. The Garante observed that minors under 13 could access ChatGPT without restrictions, exposing them to responses that might exceed their cognitive or emotional understanding.
The 2024 Fine and Corrective Measures: Transparency Campaign and Financial Penalty
In November 2024, the Garante finalized its investigation with a corrective and sanctioning decision (Provvedimento n. 755), imposing a EUR 15 million fine on OpenAI. The penalty was calculated based on the severity of the violations, the scale of data processing involved, and OpenAI’s cooperative attitude during the proceedings. The fine marked the first time the Garante applied the enhanced powers under Article 166(7) of Italy’s Privacy Code, which allows for mandatory public communication campaigns to address systemic compliance failures.
As part of the corrective measures, OpenAI was ordered to conduct a six-month institutional communication campaign across radio, television, newspapers, and the internet. The campaign’s content, to be agreed upon with the Garante, was designed to educate the public—both users and non-users—about ChatGPT’s data collection practices, the rights of data subjects under the GDPR, and how to exercise those rights, including opposition, rectification, and deletion requests. This requirement underscored the Garante’s emphasis on restoring transparency and empowering individuals to control their personal data in AI interactions.
During the investigation, OpenAI established its European headquarters in Ireland, triggering the GDPR’s ‘one-stop-shop’ mechanism. Under this rule, the Irish Data Protection Commission (DPC) became the lead supervisory authority for ongoing violations. The Garante transmitted the case file to the DPC to ensure continuity in addressing any persistent non-compliance, particularly regarding data processing activities that predated OpenAI’s European establishment.
Legal and Regulatory Implications for AI Developers and Supervisory Authorities
The Garante’s decisions against OpenAI introduced several binding requirements for AI developers operating within the EU.
Second, the age-verification mandate set a precedent for child protection in AI systems. The Garante’s insistence on age-gating mechanisms reflected broader regulatory trends, including the EU’s proposed AI Act, which imposes stricter rules on AI applications interacting with minors. This requirement may extend to other generative AI services, compelling developers to integrate age-verification tools by default.
Third, the transparency obligations imposed on OpenAI—including the mandatory public communication campaign—highlighted the Garante’s proactive approach to ensuring accountability. Unlike traditional fines, this measure aimed to correct systemic opacity in AI operations, setting a template for how supervisory authorities can enforce GDPR principles through public awareness initiatives.
By deferring ongoing investigations to the Irish DPC under the one-stop-shop mechanism, the case demonstrated how GDPR’s territorial scope and jurisdictional rules apply to global AI providers.
The case remains a critical reference for how GDPR and emerging AI regulations intersect in practice.
Required actions
- Identify a valid legal basis before training on personal data; provide transparency to users and non-users whose data is used - Implement age verification for minors; notify data breaches; run the ordered public information campaign