- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
OpenAI OpCo LLC – €15,000,000 Fine (Italy, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
OpenAI was fined EUR 15 million by Italy's data protection authority for multiple GDPR violations related to its ChatGPT service. This ruling is significant as it underscores the need for companies to handle user data responsibly.
What happened
The Italian data protection authority fined OpenAI for failing to notify about a data breach and for using personal data without a valid legal basis.
Who was affected
Users of OpenAI's ChatGPT service were affected by the company's mishandling of personal data.
What the authority found
The authority found that OpenAI violated several GDPR provisions, including transparency and age verification requirements.
Why this matters
This case serves as a warning to tech companies about the importance of compliance with data protection laws and the potential financial consequences of violations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Source retrieval not recorded.
Check has limited source evidence — 4 March 2026.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has imposed a fine of EUR 15 million on OpenAI in connection with the operation of the generative AI chatbot “ChatGPT”. The DPA found that OpenAI had violated provisions of the GDPR, inter alia, by failing to notify the DPA of a data breach that occurred in 2023, by using users' personal data to train ChatGPT without providing a valid legal basis for such processing, and by violating the principle of transparency. Additionally, OpenAI did not implement age verification, potentially risking exposure of children under 13 to inappropriate content. Furthermore the DPA ordered OpenAI to carry out a six-month public information campaign to educate users on how ChatGPT processes data and how they can exercise their GDPR rights.
Related Enforcement Actions (0)
No other enforcement actions found for OpenAI OpCo LLC in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
2 November 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€15,000,000
Enforcement Tracker ID
ETid-2497
About this data
Cite as: Cookie Fines. OpenAI OpCo LLC - Italy (2024). Retrieved from cookiefines.eu
Last updated: