Italy's Garante fines OpenAI 15 million euros over ChatGPT data use

Italy's data protection authority, the Garante, fined OpenAI 15 million euros after completing a probe into how ChatGPT collects and uses personal data.

The authority announced the decision on 20 December 2024, closing its preliminary investigation into the chatbot.

OpenAI called the decision disproportionate and said it would appeal.

A company spokesperson said the penalty equaled nearly 20 times the revenue OpenAI made in Italy that year.

What it is

The fine followed a Garante inquiry into whether OpenAI had a lawful basis for using personal data to train ChatGPT and whether it met its GDPR information duties.

The decision is one of the largest EU data-protection enforcement actions against a generative AI provider to date.

What it requires

The Garante found that OpenAI processed personal data to train ChatGPT without having an adequate legal basis and violated the principle of transparency and the related information obligations towards users.

Investigators also said OpenAI did not provide an adequate age verification system to prevent users under 13 years old from being exposed to inappropriate AI-generated content.

The 15 million euro total was broken into three components: 9,000,000 euros for violations related to processing personal data unlawfully.

320,000 euros for the failure to report a personal data breach to the Garante.

And 5,680,000.00 euros for the failure to comply with corrective measures imposed by the Garante in 2023.

Beyond the financial penalty, OpenAI was ordered to run an information campaign for a six month period across Italian media platforms.

What security leaders should do

Security and privacy teams building or deploying generative AI should document, before training begins, the specific legal basis relied on for any personal data used, since the Garante treated the absence of that documentation as the core violation. Breach-notification processes need to cover every EU member state where affected data subjects reside, not just a company's home regulator, given that a failure to notify was penalized as a separate, itemized component of the fine. Programs should also budget for age-assurance controls on consumer-facing AI products and track whether prior regulator-ordered corrective measures have actually been completed, since non-compliance with earlier orders carried its own financial penalty in this case.