On March 31, 2023, Italy’s data protection authority, the Garante per la protezione dei dati personali, imposed “an immediate temporary limitation on the processing of Italian users’ data by OpenAI,” the company behind ChatGPT, and opened an inquiry. It was the first time a Western regulator had moved to block the service, which had launched only four months earlier. The action followed a data breach on March 20 that the authority said had exposed “users’ conversations and information on payments by subscribers.”
The Garante’s order raised two further concerns beyond the breach. It found no adequate legal basis for the mass collection and processing of personal data used to train the model, and it flagged the lack of age controls: “the lack of whatever age verification mechanism exposes children to receiving responses that are absolutely inappropriate to their age and awareness.” It also noted that “the information made available by ChatGPT does not always match factual circumstances, so that inaccurate personal data are processed.” OpenAI was given 20 days to report the measures it would take, on pain of “a fine of up to EUR 20 million or 4% of the total worldwide annual turnover.”
OpenAI took ChatGPT offline in Italy in response. After the company added a privacy notice, an age-gate and a way for users to object to data processing, the Garante allowed the service to resume at the end of April 2023. The authority later closed its investigation and, in December 2024, fined OpenAI 15 million euros and ordered a six-month public information campaign.
Why business readers should care: the episode showed that existing data protection law, principally the EU’s GDPR, could be turned on a generative-AI product immediately, before any AI-specific statute was in force. The grounds the Garante used - legal basis for training data, accuracy of personal data, and protection of minors - became recurring themes in AI regulation and previewed the obligations later formalized in the 2024-eu-ai-act.