Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesItaly’s €15 million fine against OpenAI is no longer an operative penalty. The Italian Data Protection Authority, known as the Garante, announced the fine on December 20, 2024, after concluding that ChatGPT’s handling of personal data breached GDPR requirements. On March 18, 2026, however, the Rome Tribunal accepted OpenAI’s challenge and annulled the sanction. The Garante’s current notice records that outcome, and Italian reporting confirmed it on March 20, 2026.
The case still matters because it raised separate questions about data-breach notification, the legal basis for training generative-AI systems, transparency, and which European regulator should oversee OpenAI.
As an Amazon Associate I earn from qualifying purchases.
The short answer
The Garante imposed a €15 million administrative fine on OpenAI under a decision adopted on November 2, 2024 and announced on December 20, 2024. It also ordered a six-month public-information campaign explaining ChatGPT’s data processing and people’s right to object to the use of their personal data to train generative-AI systems.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →OpenAI challenged the decision. The Garante now says the Rome Tribunal’s judgment No. 4153/2026, published on March 18, 2026, accepted that challenge. Italian reporting subsequently described the €15 million sanction as annulled.
#1 Best Overall
That means it is inaccurate to say, without qualification, that OpenAI currently owes Italy €15 million. It is accurate to say that Italy imposed the fine in 2024 and that a Rome court later annulled it.
What Italy’s regulator accused OpenAI of doing
The 2024 enforcement action involved several distinct GDPR questions. They should not be collapsed into the claim that ChatGPT simply “used everyone’s chats illegally.” The Garante’s theories, as reported in its notices and contemporaneous coverage, included:
- Data-breach notification: The authority said OpenAI failed to notify it about a March 2023 security incident involving ChatGPT.
- Legal basis for training: The Garante concluded that OpenAI processed personal data to train ChatGPT without first identifying what it considered an adequate legal basis.
- Transparency: The authority said OpenAI did not adequately inform users and other affected people about how personal data was processed.
Those descriptions concern the Garante’s investigation and 2024 decision. Because the Rome Tribunal later annulled the sanction, the regulator’s conclusions should not be presented as an irreversible final judicial determination that OpenAI violated the GDPR.
What happened in the March 2023 incident?
OpenAI disclosed a March 2023 security incident that exposed some users’ chat-title histories and, for a limited number of users, certain payment-related information. The incident did not mean that the complete contents of every ChatGPT conversation were exposed.
The security incident and the regulator’s other concerns were separate issues:
- The first concerned the handling and notification of a security event.
- The second concerned whether personal data could be used to improve or train ChatGPT, and on what legal basis.
- The third concerned whether users received sufficient information and could effectively exercise their rights.
Keeping those issues separate is important. A data breach does not by itself answer whether an AI company had a lawful basis for model training, and a dispute over training practices does not establish that every user’s conversation was disclosed.
Why Italy temporarily restricted ChatGPT
On March 30, 2023, the Garante temporarily restricted OpenAI’s processing of data belonging to people in Italy. The action was widely described as a ChatGPT ban, but it was a temporary regulatory restriction rather than a permanent prohibition.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OpenAI introduced changes addressing transparency, user-rights information, age-related protections and other demands. ChatGPT returned to Italy in April 2023 after the Garante accepted that the requested changes had been implemented. The authority’s original restriction is documented here, and its restoration notice is here.
Rank #3
How the €15 million decision developed
- March 30, 2023: The Garante temporarily restricted OpenAI’s processing of Italian users’ data.
- April 2023: ChatGPT became available again after OpenAI made changes requested by the authority.
- January 29, 2024: The Garante notified OpenAI that it believed ChatGPT had breached European data-protection rules, allowing the investigation to move toward a formal decision. The notice is available from the authority.
- November 2, 2024: The Garante adopted Decision No. 755.
- December 20, 2024: The authority publicly announced the €15 million fine and the six-month information campaign.
- March 18, 2026: The Rome Tribunal published judgment No. 4153/2026 accepting OpenAI’s opposition.
- March 20, 2026: Italian reporting stated that the €15 million sanction had been annulled.
What OpenAI argued
OpenAI opposed the fine and described it as disproportionate. It said it had cooperated with the Italian authority and indicated that it would appeal. Contemporaneous Reuters reporting, reproduced by ThePrint, reported OpenAI’s argument that the fine was nearly 20 times its revenue in Italy during the relevant period.
Those are OpenAI’s arguments, not an independent finding that the fine was disproportionate. The subsequent court outcome was an annulment, but the public materials available for this account do not establish enough detail to safely summarize every legal reason for the Tribunal’s decision.
What the Rome Tribunal ruling means
The confirmed result is narrow and important: the Rome Tribunal accepted OpenAI’s opposition, and the €15 million administrative sanction was annulled. The Garante temporarily removed Decision No. 755 from its website after the judgment.
It would go too far to describe this as a blanket declaration that ChatGPT’s data practices comply with the GDPR. The available materials do not establish that the court:
- approved every aspect of OpenAI’s model-training practices;
- found that the March 2023 security incident did not occur;
- eliminated users’ GDPR rights;
- ended all European regulatory scrutiny; or
- prevented future enforcement by another competent authority.
A court’s annulment of one administrative sanction is not automatically a ruling that every related practice is lawful everywhere in Europe.
Why Ireland matters
OpenAI established its European headquarters in Ireland during the investigation. Under the GDPR’s one-stop-shop system, the Irish Data Protection Commission became relevant as the lead supervisory authority for continuing infringements that had not ended before the European establishment was opened.
That creates an important jurisdictional distinction. Italy handled the conduct within the scope of its investigation and issued the 2024 measure. Ireland became relevant to continuing processing questions after OpenAI’s European establishment there. The Italian proceeding therefore did not automatically resolve every GDPR issue involving ChatGPT across the European Union.
Free tools Windows power users keep installed
One-click scans. No signup required.
What ChatGPT users should take from the case
For individuals, the case is a reminder to treat prompts as potentially sensitive information. Product settings, account types and OpenAI’s current policies can affect how conversations are retained or used for service improvement. Consumer, business and enterprise products may not have identical controls.
Depending on the product and applicable law, users may have rights to request access, correction, deletion or restriction of processing, and may be able to object to particular processing. The exact process and outcome depend on the account, the data involved and the applicable policy. Deleting a visible chat should not automatically be understood as erasing every retained record or derived representation.
Users should consult the current privacy controls and official OpenAI privacy documentation for their specific product rather than relying on generalized instructions. The Italian case does not guarantee that every deletion or objection request will produce the same result.
Why the case matters to AI companies
The dispute highlights the compliance questions that companies face when deploying or building AI systems:
- Lawful basis: Companies need a defensible explanation for processing personal data, including data used in training or improving models.
- Notice: Privacy information must explain relevant processing clearly enough for affected people to understand it.
- Data-subject rights: Systems need workable processes for access, correction, deletion and objection requests where those rights apply.
- Security response: A company must assess whether an incident is reportable to a supervisory authority and act within applicable deadlines.
- Governance: Organizations need to distinguish consumer use from business deployments, define controller and processor responsibilities, and document decisions.
- Jurisdiction: A company’s European establishment can affect which supervisory authority leads future cross-border matters.
- Litigation risk: A regulator’s decision may be appealed, and the final legal position can differ from the initial enforcement announcement.
Fine versus current status
| Question | Answer |
|---|---|
| Who imposed the original fine? | Italy’s Garante per la protezione dei dati personali. |
| How much was it? | €15 million. |
| When was it announced? | December 20, 2024. |
| What additional remedy was ordered? | A six-month public-information campaign. |
| Was it ultimately left in force? | No. The Rome Tribunal annulled the sanction in March 2026, according to the Garante’s notice and Italian reporting. |
| Was this an EU-wide fine? | No. It was an Italian enforcement action under the GDPR. |
Bottom line
Italy did fine OpenAI €15 million over the Garante’s 2024 findings about ChatGPT’s data practices. But the present legal status is different: the Rome Tribunal later annulled that sanction. The decision remains significant as an example of the regulatory questions surrounding AI training, transparency and breach reporting, but it should not be described as an active fine or as a final answer to all GDPR disputes involving ChatGPT.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
