OpenAI geographically blocks ChatGPT in Italy

No, it’s not an April Fool’s joke: OpenAI has started geoblocking access to its generative AI chatbot, ChatGPT, in Italy.

The move follows an order from the local data protection authority on Friday that it must stop processing Italians’ data for the ChatGPT service.

In a statement that appears online to users with an Italian IP address who attempt to access ChatGPT, OpenAI writes that it “regrets” informing users that it has disabled access to users in Italy – à la “request” from the Data Protection Authority – which it known as Guarantee.

It also says it will refund all users in Italy who purchased the ChatGPT Plus subscription service last month – and also notes that subscription renewals are “temporarily suspended” so users won’t be charged during the suspension of service.

OpenAI seems to apply simple geo-blocking at this point, which means that using a VPN to switch to a non-Italian IP provides a simple workaround for the blocking. However, if a ChatGPT account was originally registered in Italy, it may no longer be accessible and users wishing to bypass the block may need to create a new account using a non-Italian IP address.

On Friday the Guarantee announced an investigation into ChatGPT for alleged violation of the European Union’s General Data Protection Regulation (GDPR), saying it fears OpenAI may have unlawfully processed Italians’ data.

OpenAI does not appear to have informed anyone whose online data was found and used to train the technology, for example by scraping information from Internet forums. It also hasn’t been entirely open about the data it processes – certainly not for the latest iteration of its model, GPT-4. And while the training data he used may have been public (in the sense of being published online), the GDPR still contains principles of transparency, suggesting both the users and the people he has retrieved the data should have been informed.

In his statement yesterday, the Guarantee also pointed to the lack of any system to prevent minors from accessing the technology, raising a child safety flag – noting that there is no age verification feature to prevent access inappropriate, for example.

Additionally, the regulator has expressed concerns about the accuracy of the information provided by the chatbot.

ChatGPT and other generative AI chatbots have been known to sometimes produce misinformation about named individuals – a flaw that AI makers call “mind-blowing”. This seems problematic in the EU since the GDPR provides individuals with a range of rights over their information, including a right to rectification of inaccurate information. And, currently, it’s unclear whether OpenAI has a system for users to ask the chatbot to stop lying about them.

The San Francisco-based company still hasn’t responded to our request for comment on the Warranty investigation. But in his public statement to geo-blocked users in Italy, he says, “We are committed to protecting people’s privacy and believe that we offer ChatGPT in accordance with GDPR and other privacy laws.”

“We are going to talk to Guarantee with the aim of restoring your access as soon as possible,” he also wrote, adding, “Many of you have told us that you find ChatGPT useful for day-to-day tasks, and we look forward to making it available again soon.

Despite an optimistic note towards the end of the statement, it is unclear how OpenAI can address the compliance issues raised by the Guarantee – given the wide range of GDPR concerns, it is presented as it launches further investigation.

The pan-European regulation calls for data protection by design and by default, meaning that privacy-centric processes and principles are meant to be built into a system that handles people’s data from the outset. Aka, the opposite approach to entering data and asking for forgiveness later.

Penalties for confirmed GDPR violations, meanwhile, can be up to 4% of a data processor’s annual worldwide turnover (or €20 million, whichever is greater).

Additionally, since OpenAI does not have a primary establishment in the EU, all data protection authorities in the bloc have the power to regulate ChatGPT – which means that all authorities in other member countries of the EU could choose to step in and investigate – and impose fines for any violations. (in a relatively short time, because each would only act in its own patch). It therefore faces the highest level of GDPR exposure, unprepared to play the forum shopping game that other tech giants have used to delay privacy enforcement in Europe.