OpenAI fined 15 million euros for using personal data to train ChatGPT 

The Italian Data Protection Authority (Garante per la protezione dei dati personali, GPDP) has fined ChatGPT maker, OpenAI 15 million euros after closing an investigation into the use of personal data by the generative artificial intelligence application.

The Garante said it found OpenAI processed users’ personal data “to train ChatGPT without having an adequate legal basis and violated the principle of transparency and the related information obligations towards users”.

According to the Italian Data Protection Authority, the US company in 2023 processed users’ personal data to train ChatGPT without first identifying an appropriate legal basis and has violated the principle of transparency and the related information obligations toward users.

“Furthermore, OpenAI has not provided mechanisms for age verification, which could lead to the risk of exposing children under 13 to inappropriate responses with respect to their degree of development and self-awareness,” the Authority stated.

Aside from the 15 million euro fine, the Authority, with the aim of ensuring effective transparency in the processing of personal data, also ordered OpenAI to carry out a 6-month institutional communication campaign on radio, television, newspapers, and the Internet.

“The content, to be agreed with the Authority, should promote public understanding and awareness of the functioning of ChatGPT, in particular on the collection of user and non-user data for the training of generative artificial intelligence and the rights exercised by data subjects, including the rights to object, rectify and delete their data. 

“Through this communication campaign, users and non-users of ChatGPT will have to be made aware of how to oppose generative artificial intelligence being trained with their personal data and thus be effectively enabled to exercise their rights under the GDPR. 

“The Data Protection Authority imposed a fine of EUR 15 million on OpenAI, which was also calculated taking into account the company’s cooperative attitude,” it stated.

OpenAI’s fine came as the third major sanction on tech giants this week, with Meta, Facebook’s parent company, and Netflix also bearing the brunt of European regulators this week over data protection breaches.