DECISION SUMMARY
What happened
On 2 November 2024 the Italian Garante per la Protezione dei Dati Personali adopted decision no. 755, imposing a €15 million administrative fine on OpenAI over its ChatGPT service; the authority announced the sanction publicly in December 2024. Alongside the fine, the Garante ordered OpenAI to run a six-month information campaign across Italian radio, television, newspapers and the internet, explaining how the company collects and uses personal data to train its models. OpenAI described the decision as disproportionate and lodged an appeal.
The fine concluded an investigation that had begun with the Garante's emergency action of 30 March 2023, when the authority ordered OpenAI to suspend processing of Italian users' personal data on ChatGPT. Service was restored on 28 April 2023 after OpenAI added an age-declaration step, expanded its privacy notice and provided a mechanism for data-subject requests, but the formal inquiry continued through 2023 and 2024 and produced the €15 million sanction.
What the Garante found
The decision rested on four grounds. First, a lawful-basis failure: OpenAI had processed personal data to train ChatGPT without an adequate Article 6 basis, the same core objection the Garante had raised in 2023. Second, a transparency failure: users and the individuals whose data appeared in the training corpus were not given the information the GDPR requires under Articles 5(1)(a), 12, 13 and 14. Third, an age-verification failure: ChatGPT lacked an effective mechanism to keep children under 13 off the service, exposing minors to content unsuitable for their age. Fourth, a breach-notification failure under Article 33: OpenAI had not notified the Garante of a March 2023 incident in which a bug briefly exposed payment-related information for a small percentage of ChatGPT Plus subscribers.
The €15 million figure sat well below the GDPR's upper-tier ceiling (the greater of €20 million or 4% of worldwide annual turnover). The Garante's reasoning emphasised the corrective element, particularly the unusual public-awareness campaign, over the headline monetary penalty.
The Court of Rome annulment (March 2026)
On 18 March 2026 the Court of Rome (Tribunale Ordinario di Roma, Sezione Diritti della Persona e Immigrazione, case R.G. 4785/2025) annulled both the €15 million fine and the media-campaign order. The court decided the case on jurisdiction rather than substance. Because OpenAI had established OpenAI Ireland Limited in February 2024, the GDPR's one-stop-shop mechanism made the Irish Data Protection Commission the lead supervisory authority for OpenAI's cross-border processing. On that reading, the Garante could no longer impose a stand-alone national sanction of this kind, and the decision fell away.
Crucially, the judgment did not rule on whether OpenAI had in fact breached the GDPR. The substantive questions about training on scraped personal data, transparency and age verification were left open. Following the ruling, the Garante removed the original decision from its website. The Garante retains the option of pursuing the matter through other channels, and the underlying questions could be revisited by the Irish DPC as lead authority; but the €15 million penalty itself is no longer a collectible fine.
Why this case matters
The OpenAI decision was, for a time, the most significant GDPR enforcement action against a generative-AI provider anywhere in Europe. Its annulment is just as significant, because the ground was structural rather than factual. The Court of Rome's reasoning shows how a provider that opens an EU establishment mid-investigation can shift the lead-authority question under the one-stop-shop, complicating enforcement by the national DPA that started the case. For the wider debate about AI and data protection, the episode leaves the hard substantive questions unresolved while illustrating that jurisdiction, not just the merits, decides who may fine whom.
For readers tracking the numbers, this is why the register treats the €15 million figure as a fine that was imposed and then set aside, rather than as a standing penalty. The Garante's largest fine that still stands is the €20 million Clearview AI decision of 2022.