ChatGPT and Cookies: The Right to Opt-Out in the Age of AI

In 2024, the Italian Data Protection Authority issued a landmark ruling against OpenAI, sanctioning it for using European users' data to train ChatGPT without a valid legal basis. The issue of cookies and consent proved to be the catalyst for a broader debate: how far can technology companies go in using our data to build artificial intelligence models? The GDPR's answer is clear: consent must be free, specific, informed, and revocable at any time.

The OpenAI Case: What Happened

OpenAI began collecting data from ChatGPT users through cookies, tracking, and online behaviors, using this information to improve its models. The problem is that this often happens without adequate transparency. Users were not clearly informed that their personal data — including private conversations, browsing habits, and preferences — would be used for AI training.

The Italian Data Protection Authority found that OpenAI had no valid legal basis for processing this data under Article 6 of the GDPR. Consent had not been collected in compliance with the required standards: neither clear nor explicit, nor easily revocable. The consequence? A fine of 15 million euros and the obligation to stop processing European users' data.

Why Cookie Consent Is Crucial for AI

Cookies and tracking technologies are often the first point of personal data collection. When a user accepts cookies on a website, they are giving consent for that specific site, not for the training of third-party AI models. This distinction is crucial and too often overlooked by major technology platforms.

The purpose limitation principle, enshrined in Article 5 of the GDPR, establishes that data collected for a specific purpose cannot be reused for different purposes without new consent. When OpenAI uses user data to train ChatGPT, it is effectively violating this fundamental principle, turning an accepted marketing cookie for specific purposes into an indiscriminate permission for industrial data use.

How to Exercise Your Right to Opt-Out

The good news is that the GDPR provides concrete tools for self-protection. Here's what you can do to exercise your right to opt-out of data processing for AI training purposes:

• Use browsers and extensions that automatically block tracking cookies, such as Privacy Badger or uBlock Origin.
• Exercise your right to object under Article 21 of the GDPR by sending a formal request to the data controller.
• Check privacy settings on ChatGPT and disable the "Contribute to product improvement" option.
• Report any violations to the Italian Data Protection Authority through its dedicated portal.
• Use email and browsing services that do not collect data for training purposes.

The Future of Digital Consent

The OpenAI case represents only the beginning of a broader shift in the digital privacy landscape. With the rise of generative AI, tech companies are seeking to expand the scope of personal data use, often exploiting regulatory gray areas. The GDPR, however, proves to be an effective tool when applied rigorously.

It is important to remember that consent is not a one-time, definitive act. You can revoke it at any time, free of charge and without difficulty. Companies are required to facilitate this process, making it as simple as granting consent. If a service makes dissent complicated or impossible, it is violating the principle of freely given consent, which requires that withdrawal be equally easy as consent.