ChatGPT returns to Italy after OpenAI tweaks privacy disclosures, controls

ChatGPT is again available to users in Italy, after being temporarily banned by the country’s data privacy authority for possible violations of the EU’s General Data Protection Regulation (GDPR).

Italy’s Guarantor for the Protection of Personal Data announced the reinstatement of ChatGPT Friday, after Microsoft-backed OpenAI, the creator of the generative AI service, made changes requested by the government body.

At the end of March, the Guarantor ordered OpenAI to stop processing ChatGPT data in Italy, effectively causing the service to shut down in the country. On April 11, the data privacy agency notified OpenAI of specific changes it would have to make in order to offer ChatGPT in Italy.

Most of those changes have been met, and OpenAI now has conditional approval to offer ChatGPT in Italy, with the expectation that it will make further changes specified by the Guarantor, and continue to adhere to EU data privacy rules.

The changes OpenAI has implemented include:

• The publication on OpenAI’s website of a description of the personal data that is processed for its AI model training algorithms, and a reminder that everyone has the right to opt-out from such processing,
• The posting of a form designed to let European users opt-out from the processing of their personal data, and
• The addition of a button on a welcome back page for Italian users that asks for confirmation that they are 18 years old or are above the age of 13 and have obtained consent from their parents or guardians to use the service.

“The Italian SA acknowledges the steps forward made by OpenAI to reconcile technological advancements with respect for the rights of individuals and it hopes that the company will continue in its efforts to comply with European data protection legislation,” the Guarantor said in its announcement Friday.

In its March notification of the ChatGPT ban, the data privacy authority noted that a bug in an open-source library — disclosed by OpenAI in March but since fixed — allowed some ChatGPT users to see titles from another active user’s chat history. It also noted that “information made available by ChatGPT does not always match factual circumstances, so that inaccurate personal data are processed.”

While OpenAI’s changes have gone far enough for Italy’s Guarantor to allow it operate in Italy, it expects the company to comply with additional requests, including implementation of a stronger age-confirmation mechanism, and an information campaign about the rights of Italians to opt out of the processing of their personal data for the purpose of training AI algorithms.

The Italian ban and subsequent reinstatement of ChatGPT come as governments around the world consider regulations on AI. In the West, Europeans have been the first to take concrete steps to rein in AI. Last week, members of the European Parliament (MEPs) agreed on compromise amendments to the AI Act proposed by the European Commission. The act focuses on classifying AI systems into risk-based categories — banning those that are considered high risk from being used for certain purposes, such as government social-scoring systems and real-time biometric identification systems in public spaces.

Earlier in April, The European Data Protection Board (EDPB) said it planned to launch a dedicated task force to investigate ChatGPT after a number of European privacy watchdogs — including Italy — raised concerns about whether the technology is compliant with the GDPR.

In its announcement about the reinstatement of ChatGPT in Italy, the Guarantor said that it would “carry on its fact-finding activities regarding OpenAI also under the umbrella of the ad-hoc task force that was set up by the European Data Protection Board.”