All news
Regulation June 10, 2026 6 min

Rome Court annuls the Garante's EUR 15M fine against OpenAI: the one-stop-shop decides

Judgment 4153/2026 of 18 March 2026: the issue is not the merits but jurisdiction. For cross-border processing the lead authority applies

TL;DR for the DPO

18 March 2026: the Rome Court (judgment 4153/2026) annuls the Garante's 2024 decision fining OpenAI EUR 15M. The Court treats JURISDICTION as decisive: cross-border processing like ChatGPT's falls under the one-stop-shop, with the lead authority (in the EU, the Irish DPC). The substantive claims are not decided.

The facts

In 2024 the Garante alleged several violations (legal basis for training, notice, age verification, breach notification) and fined OpenAI EUR 15M plus a mandatory awareness campaign. OpenAI appealed; after a 2025 stay, the March 2026 judgment annulled the decision on jurisdiction grounds.

15MEUR
Fine annulled

Not a clean bill of health for ChatGPT

The ruling does not certify ChatGPT's GDPR compliance: it only decides who had power to sanction. Obligations for companies using ChatGPT are unchanged.

Official source:Rome Court, judgment 4153/2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
26the article nobody signs before broadcasting

Who answers for the live stream of the under-14 match? Sweden answers the question nobody asks

On 25 August the Swedish authority published guidance on streaming youth sport. Many clubs stream children's matches online, and the guidance sets out the factors that decide what is allowed. But the part worth reading is the other one: responsibility when the municipality owns the venue and the club wants to install cameras.

Aug 25, 2026New 5 min
Regulation
24months after which a past incident should not be used

The score they refuse your credit with can be requested, and it has to be explained

On 19 August the CNIL translated for the public its May 2026 recommendation on assessing creditworthiness. Inside are three numbers and one principle that concern anyone doing scoring: twenty-four months for past incidents, six months for the data of a refused application, and a right of access to the score that cannot be dismissed by invoking trade secrecy.

Aug 19, 2026New 6 min
Regulation
2EDPB criteria and the DPIA becomes mandatory

In schools, advertising trackers are prohibited — and consent has nothing to do with it

On 24 August the CNIL published its rules for the digital workspaces used in schools. The decisive point is not the protection of minors but a principle of administrative law: the neutrality of the public education service includes commercial neutrality, so trackers used for advertising or profiling are prohibited in principle. If the tool has them, the controller must switch them off.

Aug 24, 2026New 6 min