Why did Italy block ChatGPT?

On Friday, Italy's data protection authority, the Garante per la protezione dei dati personali, announced an immediate, temporary limit on how OpenAI processes the data of people in Italy. It also opened an investigation. By the weekend, OpenAI had disabled ChatGPT for Italian users. The BBC describes Italy as the first Western country to block the chatbot.

The decision is not about whether AI is good or bad. It is about privacy law. Italy, like the rest of the European Union, applies the General Data Protection Regulation (GDPR), which sets rules for how organizations collect, use and store personal data, meaning any information linked to an identifiable person. The Garante's question is whether ChatGPT follows those rules.

The four concerns in the order

The regulator's press release sets out its reasons. In plain terms:

1. No notice. People whose data OpenAI collects, including users, are not given the information the law requires about what is gathered and why.
2. No legal basis for training. This is the central point. The Garante says there appears to be no legal ground for collecting and storing personal data on a massive scale to "train" the models behind ChatGPT. Under the GDPR, every use of personal data needs a recognized justification.
3. Inaccurate data. The regulator notes that ChatGPT's answers do not always match the facts. When a model states something false about a real person, that is personal data processed inaccurately.
4. No age checks. OpenAI's terms say the service is meant for people over 13, yet nothing verifies a user's age, which the Garante says exposes children to unsuitable answers.

The release also mentions a data breach on March 20, in which some users' conversations and payment information for paying subscribers were exposed.

OpenAI does not have an office in the EU but has appointed someone to represent it within the European Economic Area. The company has 20 days to tell the Garante what it is doing to comply. If it does not, it faces a fine of up to 20 million euros or 4% of its worldwide annual turnover.

How OpenAI and others are responding

OpenAI told the BBC it believes it complies with the GDPR and other privacy laws, and that it works to reduce personal data in training because it wants its systems to learn about the world rather than about private individuals. It says it hopes to bring ChatGPT back to Italy soon.

Other regulators are paying attention. Ireland's privacy regulator says it has contacted the Garante to understand the decision and will coordinate with other EU authorities. The European consumer group BEUC has called for investigations into chatbots more broadly. Many observers expect other European regulators to ask similar questions in the coming weeks.

A worked example: what a chatbot "knows" about a person

The accuracy concern is easy to see for yourself. Ask a chatbot about someone who is not famous but has a small public footprint, such as a local business owner or a retired teacher with a few newspaper mentions. The model may produce a confident biography that mixes real details with invented ones. That is an error in any case. Under privacy law, it can also be inaccurate personal data about a living person, which is why the regulator raised it.

What does the decision mean for your personal data?

If you live in Italy, ChatGPT is unavailable for now, and the outcome will depend on what OpenAI tells the Garante within the 20-day window. If you live elsewhere, nothing changes in how the service works today, but the questions the Garante raises apply to you too.

The most practical lesson is about what you type. Anything you put into a chatbot is data you hand to a company. The March 20 breach is a reminder that conversations can be exposed by mistakes. A sensible habit is to keep identifying details out of your prompts: names of clients or students, health information, addresses, account numbers and anything you would not want read by a stranger. You can usually get the same help by describing a situation in general terms.

Here is a message from a customer (names removed):
"[paste the message with names, emails and order numbers replaced by placeholders]"
Draft a polite reply that apologizes for the delay and offers two options.

The second lesson is about training data. The Garante's key complaint concerns how personal information ends up in the material models learn from. That is a question for companies and regulators to settle, but it explains why you may see more privacy notices, settings and age checks from AI services in Europe. Reading those notices, rather than clicking past them, tells you what a service does with your conversations.

Finally, treat any personal facts a chatbot gives you, about yourself or others, as unverified. The regulator's point about inaccuracy is the same advice teachers give about any single source: check it before you repeat it.