Italian DPA bans ChatGPT and opens investigation

The Italian DPA (the "Garante") has announced that it is investigating OpenAI, the creators of AI-driven chatbot ChatGPT, and is banning the product with immediate effect during the investigation.

One of the main concerns appears to be use of the chatbot by children, who can then be exposed to "absolutely unsuitable answers compared to their degree of development and awareness", due to the lack of age verification on the app. 

The Garante has a history of banning chatbots; last month it also banned "Replika", another AI-powered "virtual friend" which uses text and video interfaces. Again, the main concern given was that the app "served replies [to children] which are absolutely inappropriate to their age". 

Age assurance is a particularly hot topic at the moment, as the line between meeting the data minimisation principle and collecting sufficient data to identify child users remains unclear. The ICO's new draft guidance on "Services likely to be accessed by Children", touches on this issue but provides no further clarity for organisations (for more on this guidance see here). 

More broadly, the ban highlights the overlap of data protection regulation and AI-related regulation. Whilst both the UK and EU continue to grapple with this challenge, organisations using AI in the UK/EU would be wise to take a close look at the application of the GDPR to their business model. In the end, only time will tell whether the EU's horizontal approach to AI regulation or the UK's sector-specific mosaic approach is more effective.