Italy becomes the first Western country to ban ChatGPT on Thursday, when the country’s data protection authority, Garante, orders OpenAI to immediately stop processing the personal data of Italian users. The emergency measure, issued March 30, cites multiple violations of the EU’s General Data Protection Regulation (GDPR), including a lack of legal basis for collecting and using personal data to train the chatbot’s algorithms, failure to provide a privacy notice, and the absence of any age verification system despite OpenAI’s terms requiring users to be at least 13 years old.

The regulator points to a data breach that occurred on March 20, which allowed users to view the titles of conversations from other users. Garante also notes that ChatGPT frequently generates inaccurate information about individuals, violating the GDPR’s accuracy principle. OpenAI risks a fine of up to €20 million or 4% of its global annual revenue if it does not comply within 20 days.

France and Ireland’s privacy authorities have contacted their Italian counterparts to learn more about the findings, while Germany’s data protection commissioner says a similar procedure is possible in principle. The move comes as the European Union’s proposed AI Act remains part of the bloc’s broader AI policy effort. The company now faces a test of its willingness to adapt its products to European privacy standards.