- Company
- OpenAI
- Regulator or court
- Italian Data Protection Authority (Garante per la protezione dei dati personali)
- Law
- GDPR (lawful basis for training, transparency, age checks, breach notification)
- Status
- Annulled by the Court of Rome (March 2026)
What happened
The Garante fined OpenAI €15 million, finding it had trained ChatGPT on personal data without a proper legal basis, had not been open enough with users and lacked age checks. On 18 March 2026 the Court of Rome cancelled the fine because, once OpenAI had set up its EU base in Ireland, the Irish regulator was the one in charge under the GDPR's 'one-stop-shop' rule. The court did not rule on whether OpenAI had actually broken the law.
Sources
Garante press release (Italian)Cybersecurity360 on the annulment (Italian)Summary in our own words. General information, not legal advice.