Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
Dates and status re-checked against primary sources on . How we verify
The EU's foundational data privacy law, governing how organizations collect, process, and store personal data of EU residents. Article 22 restricts solely automated decision-making that significantly affects individuals, with direct implications for AI-driven decisions.
If you process any personal data of EU residents — including via AI tools that analyze customer emails, user behavior, or employee data — GDPR applies. You need a lawful basis for processing, a signed Data Processing Agreement with every AI vendor that processes personal data on your behalf, and a process for responding to data subject access requests. AI tools that make significant automated decisions about individuals require additional safeguards.
Up to €20M or 4% of total worldwide annual turnover, whichever is higher, for infringements such as the basic processing principles and data subject rights; up to €10M or 2% for others, including processor obligations (Article 83)
Italy's data protection authority temporarily banned ChatGPT from processing Italian users' data, citing GDPR violations: no lawful basis for mass collection of training data, no age verification to prevent minors from accessing the service, and failure to provide adequate transparency about data collection. OpenAI had 20 days to report the measures it took, or face a fine of up to EUR 20 million or 4% of global annual turnover.
Outcome: ChatGPT was unavailable in Italy until April 28, 2023, when OpenAI reopened it after publishing a privacy notice on training data, adding a form to object to the use of personal data for training, and asking users to confirm their age, with a date of birth at sign-up. The Garante fined OpenAI in December 2024; a Rome court annulled that fine in March 2026 (see the December 2024 entry).
The UK ICO found that Clearview scraped images of UK residents from the web and social media into a global online database used for facial recognition, and that this processing was subject to UK data protection law.
Outcome: £7.5M fine and an enforcement notice (May 2022). Clearview appealed and the First-tier Tribunal ruled for Clearview on jurisdiction; in October 2025 the Upper Tribunal upheld three of the ICO's four grounds and sent the case back to the First-tier Tribunal to decide the substantive appeal. On December 19, 2025 the Upper Tribunal gave Clearview permission to appeal to the Court of Appeal. The fine is not final.
Amazon retained children's voice recordings collected by Alexa indefinitely, even after parents requested deletion, in violation of the Children's Online Privacy Protection Act (COPPA). The FTC said COPPA does not allow companies to keep children's data to train their algorithms.
Outcome: $25 million civil penalty. The court entered the stipulated order on July 19, 2023. It requires Amazon to delete inactive child accounts and certain voice recordings and geolocation data, and prohibits it from using such data to train its algorithms.