The Italian Data Protection Authority (GPDP) watchdog began an investigation in March 2023 when it temporarily blocked ChatGPT in Italy over privacy concerns, becoming the first Western country to take action against the popular AI chatbot.
Announcing the conclusion of its probe on Friday, the GPDP said it had "imposed a fine of 15 million euros ($15.6 million) on OpenAI, which was also calculated taking into account the company's cooperative attitude".
It said OpenAI "did not notify the authority of the data breach it underwent in March 2023, it has processed users' personal data to train ChatGPT without first identifying an appropriate legal basis and has violated the principle of transparency and the related information obligations toward users".
In addition, OpenAI "has not provided for mechanisms for age verification, which could lead to the risk of exposing children under 13 to inappropriate responses", it added.
As well as the fine, the authority said it had ordered OpenAI to carry out a six-month broadcast, print and Internet campaign to promote public understanding of ChatGPT.
In its own statement, OpenAI said the decision was "disproportionate" and said it would appeal.
It noted how it had worked with the Italian authority after ChatGPT was suspended to secure its reinstatement after a month.
"They've since recognised our industry-leading approach to protecting privacy in AI, yet this fine is nearly twenty times the revenue we made in Italy during the relevant period," it said.
"We believe the Garante's (GDPD) approach undermines Italy's AI ambitions, but we remain committed to working with privacy authorities worldwide to offer beneficial AI that respects privacy rights."
