OpenAI’s ChatGPT is facing a steep €15 million fine from Italy’s data protection authority. The penalty involves alleged data breach and misuse of personal information.

According to a statement by the regulator, the investigation began in March 2023 after a data breach involving ChatGPT raised concerns. The Italian Data Protection Authority (IDPA), also known as the Garante, uncovered several violations, including OpenAI’s failure to notify the breach and its use of personal data to train its AI model without an adequate legal basis.

Age Verification Mechanism

These actions, the IDPA said, violated principles of transparency under the General Data Protection Regulation (GDPR). Further concerns arose about the lack of effective age verification mechanisms, leaving minors under 13 exposed to potentially inappropriate responses from the chatbot.

“OpenAI has not provided mechanisms for age verification, with the consequent risk of exposing minors under 13 to responses that are unsuitable for their level of development and self-awareness,” the regulator wrote.