Spain’s data protection authority has opened a preliminary investigation into OpenAI, the company behind ChatGPT, over possible non-compliance with the European Union’s General Data Protection Regulation (GDPR). The announcement adds a Spanish inquiry to the scrutiny already under way in Italy, while European authorities take steps to coordinate their response.
Spain’s inquiry is at an early stage
The Spanish Data Protection Agency, known as the AEPD, said it had started the proceedings on its own initiative. Its announcement did not identify specific concerns or say that OpenAI must stop processing data in Spain.
That distinction matters for users in Spain. At the time of the report, ChatGPT remained accessible through a Spanish IP address. Italy’s authority, by contrast, had ordered OpenAI to stop processing locals’ data, prompting the company to geoblock the service there.
The AEPD described its action as a preliminary investigation. The difference in steps taken by the two regulators may indicate that Spain’s inquiry is less advanced, though the announcement alone does not establish how either investigation will end.
Italian case raised a wider set of questions
Italy’s data protection authority had identified several areas of concern under the GDPR. These included whether OpenAI’s data processing was lawful, whether users received adequate transparency, and whether child protection and data access requirements were met.
Earlier in the week, the Italian authority published measures OpenAI would need to implement for the local suspension order to be lifted. Most changes were due by the end of the month. OpenAI had not publicly commented on those requested changes, and a company spokeswoman declined to comment on Spain’s investigation.
The Italian case shows the range of issues national regulators may examine when assessing a generative AI service under existing privacy rules. Spain’s announcement, however, did not say whether its investigators would focus on the same issues.
European authorities start sharing information
The AEPD had asked the European Data Protection Board (EDPB) to discuss ChatGPT at a plenary session. It said OpenAI’s global data processing operations could significantly affect individuals’ rights and might call for coordinated action at the European level.
Following the discussion, the EDPB decided to launch a task force. Its stated purpose is to support cooperation and the exchange of information about actions by data protection authorities.
The task force is intended to work alongside investigations by individual regulators. Sharing information could help authorities understand one another’s actions and support a more coordinated approach to GDPR enforcement across the bloc. It does not replace the national inquiries already in progress.
The timing could shape how coordination works in practice. Regulators such as Italy and Spain may complete investigations or take enforcement action before the EDPB task force has developed recommendations to harmonize approaches.
Innovation and privacy remain linked
The AEPD said it supports the development and implementation of innovative technologies, including artificial intelligence. It also stressed that this development must comply fully with the EU’s data protection framework and the rights and freedoms the GDPR gives individuals.
That position frames the issue as one of applying privacy obligations as AI services develop. Spain’s preliminary inquiry does not yet establish that OpenAI breached the rules, and the agency has not announced a suspension. The investigation and the EDPB task force mark early steps in how European regulators may examine the service and share information about their work.