OpenAI fined EUR 15 million and ordered to run a six-month public information campaign (the decision was set aside by the Court of Rome at first instance)
Subject: OpenAI (provider of the ChatGPT service)
What happened
The Italian Garante investigated the processing of personal data in the ChatGPT service, covering the March 2023 data breach, the legal basis for training the model on user data, transparency towards users, and the protection of minors.
How it was handled
The authority found that OpenAI had not notified it of the March 2023 data breach; had processed users’ personal data to train ChatGPT without first identifying an appropriate legal basis; had breached the transparency principle and the related information duties; and had no age-verification mechanism, creating a risk of exposing children under 13 to responses inappropriate to their stage of development. The authority used, for the first time, the new power in Art. 166(7) of the Italian Privacy Code.
Outcome
A EUR 15 million fine (the authority noted the amount took the company’s cooperative attitude into account), plus an order to run a six-month institutional communication campaign on radio, television, newspapers and the internet so that both users and non-users of ChatGPT learn how to object to their personal data being used to train generative AI and can therefore actually exercise their GDPR rights. In addition, because OpenAI established its European headquarters in Ireland during the inquiry, the authority applied the one-stop-shop rule and transferred the file to the Irish DPC, which became lead supervisory authority for any continuing infringements not exhausted before the European establishment opened. Subsequent development, which must be stated whenever this case is cited: the sanction (Decision No. 755, adopted 2 November 2024) was set aside by judgment No. 4153/2026 of the Court of Rome (published 18 March 2026), which upheld OpenAI’s appeal, and the authority has temporarily removed the decision text from its website. The case can therefore be cited only for the regulator’s enforcement focus and reasoning, not as authority that a EUR 15 million fine stands. Whether that judgment was appealed further, and with what result, was not established from an official source in this pass and is therefore not asserted.
What it means for Chinese exporters
- · The legal basis for training data must be settled before use, not after. The finding was not "you picked the wrong basis" but "you had not identified one before processing began" — put the legal-basis analysis, the legitimate-interests assessment and the decision record into the entry checklist for model training, and let data into the pipeline only after legal sign-off.
- · Breach notification is a standalone duty and is not excused by limited impact. An AI service operating in the EU should have a pre-agreed 72-hour notification process, naming who may notify before the controller/processor analysis is finalised.
- · Age verification is an enforcement trigger, not a UX question. A conversational product open to the public needs technically verifiable age gating at both registration and use, with test evidence of its effectiveness retained.
- · A regulator can order you to explain your own failure to the public at your own expense. Put the cost of remedial publicity into the risk model — the brand damage usually exceeds the fine.
- · An EU sanction can be overturned by the national courts, as this one was at first instance by the Court of Rome in March 2026. Two practical consequences: appeals are worth bringing, so file within the local procedural deadline instead of forfeiting the remedy as Clearview did; and do not cite a decision that has been set aside as if it were current law — check on the authority’s own site whether a decision still stands before relying on any EU enforcement precedent.
- · Where you put your European entity determines who regulates you. OpenAI established its European headquarters in Ireland during the inquiry and the file moved to the Irish DPC under the one-stop-shop rule. For a Chinese company planning an EU establishment, the choice of location is not only a tax and headcount question — it selects your future lead supervisory authority, and it does not retroactively cure infringements that predate the establishment.
Related regulations
Sources (1)
- Italian Garante fines OpenAI EUR 15 million and orders a six-month information campaignItalian Data Protection Authority (Garante per la protezione dei dati personali) · published 2024-12-20 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.