Italy's privacy regulator made OpenAI change ChatGPT to return

The setup

On 30 March 2023, Italy's data protection authority, the Garante, used its emergency GDPR power to order OpenAI to stop processing Italian residents' data through ChatGPT, effective immediately. The order is not a ruling on the merits; it is a provisional measure a data authority can issue under GDPR Article 58 when it judges ongoing processing poses a likely risk of serious harm, ahead of any final decision.

What the documents show

The order lists specific findings, not a general finding that OpenAI broke the law: no information notice for users or for people whose data had been collected to build the model; no adequate legal basis for using personal data to train the algorithms; no mechanism to verify a user's age despite terms restricting access to people 13 and older; and outputs that could misstate facts about real people. A follow-up order dated 11 April 2023 suspended the limitation only conditionally, tying the suspension to nine prescribed measures due by set deadlines — a published notice on the processing logic, a shift in the stated legal basis for training from contract to consent or legitimate interest, and two opt-out routes, one for accountholders and one for people whose data reached the system without their ever using it.

The friction

The orders disclose their own friction. An age gate at first access is a lesser thing than the full age-verification system the Garante also demanded, for which it set a separate, later timeline: a plan due 31 May 2023, implementation due 30 September 2023. The 11 April order treats consent and legitimate interest as alternative legal bases without settling which governs which processing, leaving that for further inquiry. Building a consent-based legal ground for training a general-purpose model on a regulator's deadline is a design change with real engineering and legal cost, not a settings toggle.

What changed in the work

The Garante's own 28 April 2023 press release records ChatGPT made accessible again to people in Italy, describing what it found on review: an expanded privacy notice available before signup, opt-out forms for accountholders and non-users, an 18-plus or 13-plus-with-parental-consent gate, and a welcome page for Italian users explaining the changes. That is the regulator's account of the fix, not OpenAI's own statement in its own words. The visible fix took under a month; the verification system the authority actually wanted was given until autumn.

• Does your vendor publish a notice describing the logic behind its automated processing, not only that data is processed?
• If a regulator ordered a temporary halt tomorrow, could you name the legal basis your vendor uses for training on your data?
• Is there a working, separate opt-out path for people whose data reached the system without their ever having used it?

None of this proves ChatGPT safe or unsafe elsewhere; the finding was specific to what the Garante saw in March 2023 under Italian and EU law. The record establishes a concrete sequence — finding, conditional suspension, confirmed change — worth checking against a vendor's current notices rather than assuming a past fix traveled everywhere else.