The €15 million ChatGPT fine that didn't survive: Italy's Garante fined OpenAI, the Court of Rome annulled it

The problem

In March 2023, Italy’s data protection authority became the first Western regulator to act against ChatGPT, temporarily blocking it in Italy; the investigation it opened that month closed twenty months later with provvedimento n. 755 of 2 November 2024, announced on 20 December 2024, a €15 million fine on the operator of ChatGPT (source).

This is a verified negative with a full arc: the regulator priced the alleged violations, and then a court erased the price, not because the conduct was found lawful, but because the wrong authority had judged it. Both acts are documented from the regulator’s own artifacts and the court record; no vendor narrative supports any critical claim.

Act 1: the fine

The decision ordered OpenAI OpCo LLC to pay “la somma complessiva di euro 15.000.000,00 a titolo di sanzione amministrativa pecuniaria”, stated in the decision as “circa all’1,58% del fatturato mondiale totale annuo dell’esercizio” (source). The €15,000,000 reconciles internally to the cent: €9,000,000 + €320,000 for failure to notify the March 2023 data breach + €5,680,000 for the Art. 83(5)(e) violation, “calcolato in misura pari a euro 5.680.000,00” (source). In its own English summary the Garante states OpenAI “did not notify the Authority of the data breach it underwent in March 2023, it has processed users’ personal data to train ChatGPT without first identifying an appropriate legal basis and has violated the principle of transparency” (source).

On top of the fine came an accessory sanction, the first use of Art. 166(7) of the Italian Privacy Code, ordering OpenAI “to carry out a 6-month institutional communication campaign” across “radio, televisione, giornali e Internet” explaining how ChatGPT collects data for generative-AI training and how to exercise GDPR rights (source). An independent day-of report by Euronews recorded the same order, noting the authority “is asking OpenAI to launch a six-month campaign in local media to raise awareness on how the company collects personal data” (source). In a detail that decided everything that followed, the same decision, “in compliance with the so-called one stop shop mechanism”, forwarded the file to the Irish Data Protection Commission, “which became lead supervisory authority” (source).

Act 2: the annulment

On 18 March 2026, judgment n. 4153/2026 of the Court of Rome upheld OpenAI’s appeal and annulled the decision, fine and campaign order together. The proof is on the regulator’s own website: both the press-release page and the now-emptied decision page carry a bilingual notice that “Decision No. 755 of 2 November 2024 has been temporarily removed from the website of the Italian Data Protection Authority following judgment No. 4153/2026 of the Court of Rome”, which “upheld the appeal lodged against the Authority’s decision” (source). The Italian page carries the mirror text, “Il provvedimento n. 755 del 2 novembre 2024 è stato temporaneamente rimosso dal sito web del Garante” (source). Reuters reported the cancellation the next day: “A Rome court has cancelled a 15-million-euro ($17 million) fine that Italy’s data protection authority imposed on ChatGPT maker OpenAI”, and the Garante declined to comment (source).

Per legal-press accounts of the reasoning, “the annulment rests entirely on a finding that the Italian Garante lacked jurisdiction”: once the Irish DPC formally recognised OpenAI Ireland Ltd. as the EEA establishment on 15 February 2024, the one-stop-shop mechanism made Dublin the lead supervisory authority, and the Garante, which issued its decision nine months later, no longer had the power to decide (source). The same account records the forum and docket: “The Tribunale Ordinario di Roma, Sezione Diritti della Persona e Immigrazione, issued its judgment in case R.G. 4785/2025 on March 18, 2026. Judge Damiana Colla” ruled in OpenAI’s favour (source). Whether ChatGPT’s training actually violated the GDPR was never examined.

Weakest load-bearing source, named: the grounds of the annulment, the one-stop-shop jurisdiction rationale, the judge and the docket number, come from PPC Land, an independent trade-press account of the reasoning (Tier 2), not from the judgment text itself, which was not openly published and could not be retrieved this session. The existence, date and effect of the annulment do not depend on that account: they are carried firsthand by the regulator’s own bilingual removal notice (Tier 1) and by the Reuters wire (Tier 2).

What this is not

• Not a finding that OpenAI complied with the GDPR. The merits were never adjudicated; the annulment is purely jurisdictional (source).
• Not a collected fine. “In March 2025 the Rome court had temporarily suspended the fine, pending a ruling on the merits of the case”, and it was annulled before ever being paid (source).
• Not final. The regulator styles the removal of its decision “temporarily removed”, and the judgment is first-instance, a first-instance ruling on the record, not res judicata, with a Cassazione appeal still possible and none found filed as of 23 July 2026 (source).

Why this matters for AI accountability

A €15 million fine, the flagship EU enforcement action against generative AI, fell without any court ever deciding whether the underlying conduct was lawful (source). The one-stop-shop mechanism that the Garante itself invoked to forward the file to Dublin proved to be the same rule that stripped it of the power to fine (source). For anyone tracking whether AI-accountability outcomes survive scrutiny, this is the canonical example of an enforcement number that did not: every figure here is real, sourced, archived, and annulled.

Verification record

How this was verified: method + date (settled 23 July 2026). The full decision text survives only in Wayback (the regulator removed it): the announcement-day capture (2024-12-20) is byte-tied to the CDX digest HIWN77R6L5OENE23ICA2C7VXZUNPQPMB, verified this session, and the live page no longer carries it, which is itself part of the story. The removal notice is live on garanteprivacy.it in Italian and English, plus archived captures from April 2026. Independent relay: Reuters, 19 March 2026, day-of archive; the campaign order independently carried firsthand by Euronews (with AP, 20 December 2024) and by PPC Land (28 May 2026). The judgment text is not openly published; its number, publication date and effect are cited from the regulator’s own notice, and its reasoning from the legal press, marked as such. Quotes verified mechanically against the stored captures: 20/20.

Sources

1. Garante per la protezione dei dati personali · “Intelligenza artificiale: il Garante privacy sanziona OpenAI per la gestione dei dati personali degli utenti / ChatGPT: provvedimento n. 755 (full decision text)” · 2 November 2024 (announced 20 December 2024) · Tier 1 · https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085455
2. Garante per la protezione dei dati personali · “Artificial intelligence: the Garante sanctions OpenAI, press release (now carrying the bilingual judgment-4153/2026 removal notice)” · 20 December 2024 (notice added after 18 March 2026) · Tier 1 · https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432
3. Reuters (via Yahoo Finance) · “Italian court scraps 15-million-euro fine against ChatGPT maker OpenAI” · 19 March 2026 · Tier 2 · https://finance.yahoo.com/sectors/technology/articles/italian-court-scraps-15-million-125926950.html
4. PPC Land · “Italian court kills OpenAI’s €15M fine and it wasn’t even close” · 28 May 2026 · Tier 2 · https://ppc.land/italian-court-kills-openais-eur15m-fine-and-it-wasnt-even-close/
5. Euronews (with AP) · “Italy’s privacy watchdog fines OpenAI €15 million after probe into ChatGPT data collection” · 20 December 2024 · Tier 2 · https://www.euronews.com/next/2024/12/20/italys-privacy-watchdog-fines-openai-15-million-after-probe-into-chatgpt-data-collection

Related case files

• The Dutch DPA’s €30.5M Clearview AI fine: another EU data-protection authority pricing an AI company’s GDPR violations, an enforcement that stood where this one fell
• The FTC’s five-year facial-recognition ban on Rite Aid: a regulator’s AI enforcement made durable by a court order, the mirror image of a fine a court erased
• SEC AI-washing penalties on Delphia and Global Predictions: another regulator putting a price on AI-related claims, this time collected