Italy Garante orders ChatGPT GDPR enforcement — consent and data minimization failures
Date: 2025-03
Affected: OpenAI / ChatGPT — EUR 15M fine; all LLM providers operating in EU face precedent; structural remedies required
Attack vector: rce
Category: real-world
Severity: High

The Italian Data Protection Authority (Garante per la protezione dei dati personali) issued its final enforcement decision against OpenAI regarding ChatGPT's compliance with GDPR. Following the initial March 2023 suspension and subsequent investigation, the Garante found violations of Articles 5 (data minimization), 6 (lawfulness — insufficient legal basis for training data processing), 13 (transparency — inadequate privacy notice), and 25 (data protection by design). The decision imposed a EUR 15 million fine and required structural remedies including age verification, opt-out mechanisms for training data, and enhanced transparency about data processing. This is the first major GDPR enforcement action specifically targeting an LLM provider's training data practices.

Impact: First major GDPR enforcement targeting LLM training data; establishes precedent that AI training on personal data requires explicit legal basis; EUR 15M fine; structural remedies (age verification, opt-out, transparency) now expected industry-wide

Mitigations:
Age verification for AI services accessible to minors
Consent management system with granular opt-out for training data use
Consent-before-training: obtain explicit consent before incorporating personal data into training
Data protection impact assessment (DPIA) for all training data pipelines
Data provenance: track which personal data contributed to which model version
Legal basis assessment for all training data before collection
Machine unlearning research and implementation for production models
Offer verifiable opt-out from training data inclusion
Privacy notice specifically addressing AI/LLM data processing
Separate chat history retention from training data retention policies

Architectural layers (MAESTRO):
label: Security & Compliance
notes: Regulatory non-compliance — GDPR violations in data processing
role: origin
label: Foundation Models
notes: Training data practices found unlawful — affects foundation model legitimacy
role: impact
label: Data Operations
notes: Data collection and processing scope exceeded legal basis
role: impact