The Italian data-protection authority expressed privacy concerns regarding the model developed by American start-up OpenAI and supported by Microsoft.
The regulator said it would ban and investigate OpenAI “with immediate effect”.
OpenAI told the BBC it complied with privacy laws.
Since its launch in November 2022, millions of people have employed ChatGPT, which can answer questions in a human-like fashion, as well as emulate other writing styles, with the 2021 internet serving as its database.
Microsoft has spent billions of dollars on it and it was added to Bing last month.
It has also said that it will embed a version of the technology in its Office apps, including Word, Excel, PowerPoint and Outlook.
There have been concerns over the potential risks of artificial intelligence (AI), including its threat to jobs and the spreading of misinformation and bias.
Earlier this week key figures in tech, including Elon Musk, called for these types of AI systems to be suspended amid fears the race to develop them was out of control.
The Italian watchdog said that not only would it block OpenAI’s chatbot but it would also investigate whether it complied with General Data Protection Regulation.
GDPR governs the way in which we can use, process and store personal data.
The watchdog said on 20 March that the app had experienced a data breach involving user conversations and payment information.
It said there was no legal basis to justify “the mass collection and storage of personal data for the purpose of ‘training’ the algorithms underlying the operation of the platform”.
It also said that since there was no way to verify the age of users, the app “exposes minors to absolutely unsuitable answers compared to their degree of development and awareness”.
Bard, Google’s rival artificial-intelligence chatbot, is now available, but only to specific users over the age of 18 – because of those same concerns.
The Italian data-protection authority said OpenAI had 20 days to say how it would address the watchdog’s concerns, under penalty of a fine of €20 million ($21.7m) or up to 4% of annual revenues.
Elsewhere, the Irish data protection commission told the BBC it is following up with the Italian regulator to understand the basis for their action and “will coordinate with all EU data protection authorities” in connection to the ban.
The Information Commissioner’s Office, the UK’s independent data regulator, told the BBC it would “support” developments in AI but that it was also ready to “challenge non-compliance” with data protection laws.
Dan Morgan, from cybersecurity ratings provider SecurityScorecard said the ban shows the importance of regulatory compliance for companies operating in Europe.
“Businesses must prioritise the protection of personal data and comply with the stringent data protection regulations set by the EU – compliance with regulations is not an optional extra.”
‘Not properly regulated’
Consumer advocacy group BEUC also called on EU and national authorities – including data-protection watchdogs – to investigate ChatGPT and similar chatbots, following the filing of a complaint in the US.
Although the EU is currently working on the world’s first legislation on AI, BEUC’s concern is that it would take years before the AI Act could take effect, leaving consumers at risk of harm from a technology that is not sufficiently regulated.
Ursula Pachl, deputy director general of BEUC, warned that society was “currently not protected enough from the harm” that AI can cause.
“There are serious concerns growing about how ChatGPT and similar chatbots might deceive and manipulate people. These AI systems need greater public scrutiny, and public authorities must reassert control over them,” she said.
ChatGPT is already blocked in a number of countries, including China, Iran, North Korea and Russia.
OpenAI told the BBC that it had disabled ChatGPT for users in Italy at the request of the Italian data protection regulator, called the Garante:
“We are committed to protecting people’s privacy and we believe we comply with GDPR and other privacy laws”, it wrote.
The organisation said it worked to reduce personal data in training AI systems like ChatGPT because it wanted its AI systems to “learn about the world, not about private individuals”.
“We also believe that AI regulation is necessary — so we look forward to working closely with the Garante and educating them on how our systems are built and used”, it added
OpenAI said it looked forward to making ChatGPT available in Italy again “soon”.
