This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Italian Data Protection Authority (Garante) issued a temporary ban on ChatGPT in March 2023 due to concerns over privacy violations, including the lack of a legal basis for processing personal data for model training, insufficient age verification, and a reported data breach. OpenAI subsequently implemented changes to its privacy policy, age verification, and data opt-out mechanisms to comply with GDPR requirements, leading to the lifting of the ban in late April 2023.
The Italian Data Protection Authority alleged OpenAI lacked a justifiable legal basis for personal data collection and processing which facilitate training of ChatGPT, and lacked age-verification mechanism preventing exposure of the chatbot's inappropriate answers to children, prompting its ban.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The regulator noted that the lack of age verification exposed minors to answers unsuitable for their development.
The system suffered a data breach exposing user data and was noted to generate inaccurate personal information.
The incident primarily involves allegations of unauthorized mass collection of personal data for training and a data breach exposing user conversations and payment details.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risks and subsequent regulatory ban were caused by OpenAI s intentional decisions regarding data collection and deployment practices after the model was trained.
Added categories peak at 2: Minor (Epistemic Harm, Inferred)
The temporary ban of ChatGPT in Italy by the Garante highlights growing regulatory scrutiny over AI data privacy and GDPR compliance. The incident represents a minor national security concern focused on consumer privacy rights and regulatory governance rather than a threat to critical infrastructure or state sovereignty.
ChatGPT acts as an assistant by generating text and answering queries under human oversight, without taking independent actions.
Limited Risk: The system is a chatbot, which falls under the Limited Risk category requiring specific transparency obligations.
The system is a conversational AI designed to interact with users and answer questions.
The reports provide consistent and detailed information regarding the regulatory actions, the specific privacy concerns, and the technical remedies implemented by OpenAI.
None. The incident is clearly a regulatory compliance and privacy issue.
Technology
Algorithmic Data Leakage
A security vulnerability exposed user conversations and payment information.
Generation of False Info
The model generated factually inaccurate personal information about individuals.
Lack of Age Verification Tool
The system failed to verify user ages, exposing minors to unsuitable content.
Data Inputs
Massive Unconsented Data Collection
Personal data was harvested from the internet without explicit user consent.
Inaccurate Training Data
Training on raw web data led to the generation of false personal details.
Lack of Initial Opt-Out Tools
Users lacked tools to object to their data being used for model training.
Human Factors
Lack of Parental Consent
Minors aged 13 to 18 accessed the service without parental supervision.
User Privacy Overreliance
Users shared sensitive personal and payment details during conversations.
Process and Methods
No Default Privacy Mode
Chat history and training were enabled by default without an incognito option.
Inadequate Age Verification Flow
The signup process did not verify if users were under 13 or lacked consent.
Complex Data Objection Process
Exercising the right to object required a highly detailed, complex form.
Management
Prioritizing Growth Over Privacy
Rapid service rollout occurred before establishing robust privacy safeguards.
Inadequate Risk Assessment
Management failed to align the model's data collection with EU privacy laws.
Delayed Privacy Features
User privacy controls like incognito mode were introduced only after scrutiny.
Regulatory Environment
GDPR Non-Compliance
The system lacked a valid legal basis under GDPR for mass data processing.
Increased Regulatory Scrutiny
European regulators launched investigations into generative AI privacy risks.
Lack of EU Representative Presence
OpenAI lacked a proactive local EU presence to handle compliance issues.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
