Court Accepts OpenAI Challenge to Fine; ICO Pushes Age Checks

Rome court accepts OpenAI's challenge to Italian fine

What's New?

The Tribunal of Rome accepted OpenAI's challenge to the €15 million fine imposed by the Italian data protection authority (the Garante) in November 2024. The judgment, No. 4153/2026, was published on 18 March 2026. The Garante's page does not state the exact effect on the fine. The case goes back to March 2023, when the Garante temporarily limited ChatGPT, citing the lack of a legal basis for training on personal data. The service returned in April 2023.

Why It Matters

This is professional interpretation: the Garante's page does not describe the court's reasoning, so the judgment should not be read as settling whether legitimate interest, the basis OpenAI states for training, is sufficient. Treat that question as open and be ready to justify the data used at each stage.

Recommended Action

Map which language models your organization uses and what personal data they process, and record the legal basis for each use.

ICO fines Reddit £14.47 million over children's data

What's New?

On 24 February 2026 the UK Information Commissioner's Office (ICO) announced a £14.47 million fine against Reddit for failing to use children's personal information lawfully. The ICO found that Reddit had no robust age checks for users under 13 and did not complete a data protection impact assessment on risks to children until January 2025. Since July 2025 Reddit asks users to declare their age at sign-up, and the ICO told Reddit that self-declaration is easy to bypass.

Why It Matters

This is professional interpretation: the penalty shows the ICO backing its position on age checks with enforcement, not only with statements. Reddit is a social platform, not an AI service, but the same reasoning is likely to be applied to any service that children can reach.

ICO tells platforms to move beyond self-declared age

What's New?

On 12 March 2026 the ICO published an open letter to technology firms. It says platforms with a minimum age should move beyond relying on children to declare their own age, which they can easily bypass, and should use age assurance technology to keep underage children out and to identify which users are children. The letter sets out expectations; the ICO does not present it as formal guidance or a binding rule.

Why It Matters

This is professional interpretation: AI services that children can reach and that can produce sensitive content are likely to be measured against the same expectation. Content safeguards only work if the age signal behind them is reliable.

Recommended Action

If your AI service can be accessed by minors, review your age verification flow. Evaluate age assurance methods that confirm age without collecting more personal data than needed, for example zero-knowledge proofs.