Rome court overturns OpenAI's 15 million euro fine: what it means
An Italian court overturned in March a 15 million euro fine that the domestic data protection agency had imposed on OpenAI over how it trained ChatGPT.
Does your right to privacy mean anything if a court overturns fines before they are even collected? The question is relevant for every ChatGPT user in Europe after the Rome court’s ruling on March 18. Italy’s data protection agency Garante had imposed a 15 million euro fine on OpenAI in November 2024 over how it trained the ChatGPT model. The court overturned that fine.
This is significant news for two reasons. First, it had been the largest concrete GDPR fine in Europe tied to generative AI tools. Second, with its collapse the main European precedent that other regulators could have leveraged falls away. The legal battle is not over, but the direction is clearly in OpenAI’s favour for now.
What the Italian agency had actually argued
The Garante in November 2024 found four violations. OpenAI had processed personal data for ChatGPT training without an adequate legal basis. It had not met the transparency and user-information obligations. It had not promptly notified the agencies of the March 2023 data breach. And it had no mechanisms to verify the ages of minors using the service.
Alongside the fine, the Garante had ordered OpenAI to run a six-month public information campaign about how AI processes personal data, on radio, television, in print and online.
What the Rome court said
The court provisionally suspended the fine and the campaign order back in March 2025. It issued its final ruling on March 18, 2026. The exact judicial reasoning has not been made fully public, but media reports suggest the court found that the Garante had not adequately justified a fine of that magnitude, and that there were questions about the Italian agency’s jurisdiction over global model training.
The Garante can appeal the decision and probably will. A final outcome, if it goes to Italy’s Court of Cassation, could take another year or two.
What it means for a user in Europe
Practically, nothing changes in the short term. ChatGPT keeps working, collects data under the same terms, and processes requests in the US. The only thing that has shifted is the perspective: OpenAI got a legal win that will encourage other AI providers to push back against similar fines.
On the other side, in May 2026 the EU adopted AI Act amendments that specifically tighten oversight of large AI models. The Commission gains real powers from August 2 of this year, which can open a fresh round of legal disputes.
What it means for investors in OpenAI’s competitors
Anthropic, Mistral and other AI providers operating in the EU are watching the case closely. Mistral is French, so it has lower risk of friction with a local regulator, but it also faces pressure over transparency of training data.
A practical signal to companies building AI products: it is still worth consulting a lawyer about personal-data processing, because GDPR applies across Europe and similar protections apply in many non-EU European jurisdictions through harmonised data-protection laws.
Privacy and the ‘opt-out’ most people don’t use
Every ChatGPT user has the right to request deletion of their conversations and to refuse to have their chats used to train future versions of the model. Under account settings, the “Improve the model for everyone” option can be turned off.
In practice, fewer than five percent of users use this option, according to research published over the past year. If privacy matters to you, it is worth opening settings and flipping that toggle. The process takes less than a minute.
How to request data deletion
Users across Europe are subject to the same terms. The 20-dollar-a-month subscription can be paid by most local payment cards. Data deletion requests can be filed through privacy@openai.com, with a copy of ID for verification.
The next pivotal moment in European AI regulation is August 2 of this year, when the European Commission gains full supervisory power over large models including GPT-5.5 and Claude 4.6.
