Italy fines OpenAI €15M over ChatGPT data handling

Italy’s data protection authority, the Garante, fined OpenAI €15M this week over ChatGPT’s handling of Italian users’ personal data — the largest GDPR fine against an AI company to date.

The fine stems from a 2023 investigation into ChatGPT’s training data practices. The Garante found that OpenAI violated GDPR in three ways:

  1. Lawful basis. OpenAI relied on “legitimate interest” as the legal basis for processing Italian users’ data for training, but failed to conduct a proper balancing test.

  2. Transparency. OpenAI’s privacy notice didn’t adequately disclose how user data was used for training.

  3. Data subject rights. OpenAI didn’t provide a clear mechanism for Italian users to opt out of training data processing.

The €15M figure is the maximum under GDPR for the violations found. The Garante could have fined up to 4% of OpenAI’s global revenue, but the actual fine reflects the specific violations and OpenAI’s cooperation.

Why this matters:

The Italian fine is precedent-setting. It’s the first major GDPR enforcement action against a frontier AI provider, and the reasoning will be cited by other EU data protection authorities.

The Garante’s reasoning on “lawful basis” is particularly important. Most AI providers rely on legitimate interest for training data processing. The Garante has now said this requires a documented balancing test — a higher bar than “we said it was legitimate interest in our privacy policy.”

The OpenAI response:

OpenAI has 30 days to appeal or pay. The company has historically appealed GDPR fines. Expect a multi-year legal battle.

In the meantime, OpenAI is rolling out an opt-out mechanism for EU users. The mechanism requires users to verify their identity through a one-time code sent to their phone or email. The opt-out removes the user’s data from future training but doesn’t delete it from already-trained models.

The wider EU pattern:

Italy’s Garante has been the most active EU data protection authority on AI. Earlier actions include:

  • The 2023 temporary ban on ChatGPT (lifted after OpenAI added age verification).
  • The 2024 investigation into Google’s AI training practices.
  • The 2025 fine against a smaller AI startup over training data transparency.

Other EU DPAs (Germany’s BfDI, France’s CNIL) have been more measured but are watching the Italian cases closely. If the Italian fine survives appeal, expect copycat enforcement across the EU.

The €15M fine is a warning shot. OpenAI’s revenue is in the billions. The fine is symbolic. But the legal precedent is real. AI providers operating in the EU need to take GDPR compliance seriously, or face escalating fines.