evidoria

← Back to browse

Good practice Imported

Italy's Garante — the ChatGPT data-protection intervention

Italy · Rome · See the Italy profile · See the Rome profile

Evidence: Descriptive / self-reported Top 59% 47/100 · Ask Evidence Copilot about this practice

In 2023 Italy's data-protection authority temporarily blocked ChatGPT over GDPR and the lack of age verification for minors — forcing OpenAI to add privacy notices, opt-outs and age checks, and triggering EU-wide scrutiny.

1 month
Time to resolution of the block
4
Other countries prompted to investigate ChatGPT

Details

Maturity
Established
Promoter
Garante per la protezione dei dati personali
Keywords
GDPR, Governance, ethics & data protection, data protection, enforcement, minors

Context

On 30 March 2023, Italy's data-protection authority (Garante per la protezione dei dati personali) ordered OpenAI to stop processing Italian citizens' personal data in ChatGPT. The order cited multiple GDPR violations, including no adequate legal basis for training data, transparency failures, an unreported data breach, and — most relevant for education — the absence of an age-verification mechanism, which exposed minors to unsuitable content.

Objectives

The intervention sought to enforce GDPR compliance for ChatGPT in Italy, with particular emphasis on protecting minors through age verification and clearer data-processing transparency.

Activities

The Garante ordered an immediate halt to processing of Italian users' data. Within about a month, OpenAI implemented a privacy notice, a training-data opt-out, and an age-verification system, after which the block was lifted.

Results

The ChatGPT block was lifted roughly one month after it was imposed, once OpenAI's compliance measures were in place. The Italian action prompted follow-up investigations into ChatGPT's data practices in Germany, France, Ireland and Spain.

Conclusions

The case shows a national regulator acting as a de facto enforcer of AI child-safety features such as age verification, and it appears to have influenced scrutiny elsewhere in Europe; however, the source material does not evaluate the longer-term effectiveness or durability of the compliance measures.

Implementation
Indicative cost
Low (< €50k)
Time to results
Short (< 1 year)

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful