evidoria

← Back to browse

Good practice

Italy's Garante — the ChatGPT data-protection intervention

Italy · Rome · See the Italy profile

In 2023 Italy's data-protection authority temporarily blocked ChatGPT over GDPR and the lack of age verification for minors — forcing OpenAI to add privacy notices, opt-outs and age checks, and triggering EU-wide scrutiny.

Details

Promoter
Garante per la protezione dei dati personali
Keywords
GDPR, Governance, ethics & data protection, data protection, enforcement, minors

Description

On 30 March 2023 Italy's Garante ordered OpenAI to stop processing Italians' personal data in ChatGPT, citing no adequate legal basis for training data, GDPR transparency failures, an unreported breach, and — central to education — no age-verification mechanism, exposing minors to unsuitable content.

The block was lifted within a month after OpenAI introduced a privacy notice, a training-data opt-out and an age-verification system; within weeks Germany, France, Ireland and Spain opened their own investigations.

Included as a landmark governance/data-protection action directly relevant to minors and AI — scored for its strong rights-protection, low on teaching/learning since it is enforcement, not pedagogy.

Read the full analysis: https://www.dataprotectionreport.com/2023/04/italian-garante-bans-chat-gpt-from-processing-personal-data-of-italian-data-subjects/

Implementation

Implementation detail (cost, timeline, staffing, conditions for success) is not yet available for this practice.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful