Cookies and AI: The ChatGPT Case and the Right to Opt-Out

In recent years, AI companies have started collecting massive amounts of data from the web to train their models. Among them, OpenAI, the company behind ChatGPT, found itself at the center of a heated debate after using data sourced from hundreds of millions of websites, often without end users being aware or having given any consent.

The issue arose when OpenAI began systematically rejecting opt-out requests from websites that did not wish to participate in the AI dataset. Despite formal compliance with robots.txt directives, the company continued to scan and use protected content, raising doubts about conformity with the General Data Protection Regulation (GDPR) in force in the European Union.

The Position of the Italian Data Protection Authority and the European Commission

The Italian Data Protection Authority has launched a formal investigation into OpenAI, inviting it to provide detailed information on its personal data processing methods. In parallel, the European Commission has initiated a review of the guidelines on cookie consent and data scraping, examining whether current practices comply with the GDPR.

European regulation requires that personal data processing be based on a valid legal basis. In the context of AI training, some argue that the legitimate interest of the data controller may prevail, while others believe that explicit user consent is indispensable, especially when dealing with sensitive data or minors.

Implications for Publishers and Users

For publishers and website owners, this issue represents a significant challenge. On one hand, many fear that unauthorized use of their content could compromise advertising revenue and the value of their creative work. On the other hand, there is concern that personal data of users published on their sites may be used without any protection.

• Loss of control over one's content and readers' data
• Lack of economic compensation for the use of content in AI training
• Risk of dissemination of sensitive personal information in training datasets
• Difficulty in practically exercising the right to object (opt-out)

Users, for their part, risk seeing their data used to train AI systems without having any ability to choose whether or not to participate in this process. This dynamic raises profound questions about the concept of informational autonomy and individual capacity to protect one's private sphere in the digital era.

Toward a New Regulatory Framework

European AI regulation, known as the AI Act, includes specific provisions that could interact with privacy laws. The goal is to create a balance between promoting technological innovation and protecting individuals' fundamental rights, ensuring that AI development proceeds in respect of human dignity and personal freedom.

Some proposals include requiring companies to be transparent about the origin of data used, creating public registers of training datasets, and simplified mechanisms to exercise the right to opt-out. These measures, if properly implemented, could represent a model for other jurisdictions worldwide.

Conclusion

The ChatGPT case represents a crucial moment for the future of online privacy and the ethical development of artificial intelligence. The international community is watching closely how Europe will balance these conflicting interests, with potential global repercussions.

Practical takeaway: If you manage a website, regularly verify your robots.txt settings and consider adopting transparent data collection policies. For users, inform your visitors about tracking practices and offer clear tools to exercise your rights to personal data protection.