In a statement issued on Friday, Italian regulator Garante Privacy said ChatGPT’s US operator OpenAI was not transparent about its collection of data and had provided no legal basis for the mass collection and storage of personal data for the purpose of training its algorithm.

It also said ChatGPT’s unreliable responses amounted to an inaccurate processing of personal data, and that OpenAI had failed to implement an age filter preventing under-13s from accessing and using the platform.

OpenAI now has 20 days to respond to Garante and explain what measures it has taken in response to its findings, or it could face a file of up to €20 million or up to four per cent of its annual global turnover under the GDPR.

Garante previously banned another AI chatbot called Replika — marketed as a virtual friend, rather than a productivity tool — over child safety concerns.

Commenting on the regulator’s decision on ChatGPT, Lilian Edwards, an expert in data protection and Internet law at Newcastle University, told TechCrunch: “What’s fascinating is that it more or less copy-pasted Replika in the emphasis on access by children to inappropriate content.

“But the real time-bomb is denial of lawful basis, which should apply to ALL or at least many machine learning systems, not just generative AI.”

A spokesperson for OpenAI told the BBC that it is “committed to protecting people’s privacy and we believe we comply with GDPR and other privacy laws”.

“We also believe that AI regulation is necessary — so we look forward to working closely with the Garante and educating them on how our systems are built and used,” the spokesperson added.