What Happened
On March 31, 2023, Italy’s Garante per la Protezione dei Dati Personali (GPDP) issued an emergency order banning ChatGPT from processing Italian users’ data. The Garante cited four primary violations: no legal basis for the mass collection of personal data used to train the model; no age verification system despite a minimum age requirement of 13; inability for users to correct inaccurate information generated about them; and failure to adequately inform users about data processing practices.
OpenAI geo-blocked Italian IP addresses the same day rather than risk fines of up to 20 million euros or 4% of global revenue under GDPR. Italy became the first Western country to ban a major AI product, triggering a domino effect of regulatory scrutiny across Europe.
Why It Matters
Italy’s ban was the first concrete regulatory action against a generative AI product by a Western democracy. It demonstrated that existing privacy frameworks like GDPR could be applied to AI products without new legislation. The ban forced the global AI industry to confront privacy compliance as a launch requirement rather than an afterthought. It emboldened other European data protection authorities in France, Germany, Spain, and Ireland to open their own investigations into ChatGPT and similar products. The incident established that AI companies cannot claim “innovation” as an exemption from data protection law.
Lessons Learned
AI companies must proactively address data protection requirements before launching in regulated markets. GDPR’s broad scope covers AI training data collection, not just traditional data processing. Age verification is a non-negotiable requirement for consumer-facing AI products in the EU. The right to correction and deletion extends to AI-generated content about individuals. Companies that build compliance in from the start avoid costly service disruptions and reputational damage.
Current Status
OpenAI restored ChatGPT access to Italy on April 28, 2023 after implementing age verification, a privacy policy update, an opt-out mechanism for training data, and a form for EU residents to exercise data rights. However, the Garante continued its investigation and in January 2024 notified OpenAI of further GDPR violations. The case remains a precedent for AI regulation and influenced the EU AI Act’s approach to general-purpose AI systems.