Developing a large language model such as ChatGPT requires gathering vast bodies of text through a process called web scraping. These datasets ingest details from open online sources such as social media profiles. If data is pulled from publicly available sources, it is in the scope of privacy laws. AI is now regulated by standard privacy laws, like the General Data Protection Regulation (GDPR) and similar law regimes.

GDPR places various stringent obligations on any organization storing, transmitting, or performing analytics on personal data. The most fundamental issue under GDPR is identifying a legal basis for scraping the personal data of millions of people without their knowledge or consent. This matter has been subject to heavy regulatory and judicial scrutiny across Europe, and there’s no simple solution in sight.

It is still unknown how GDPR will apply to generative AI, but some decisions have been made. ChatGPT was temporarily banned by the Italian Data Protection Authority over incorrect results and a lack of lawful grounds for the processing, as well as the mismanagement of children’s data. Google then had to postpone the EU launch of its competitor Bard over similar privacy challenges.

You may also like:

Data privacy laws in the United States and how they affect your business

11 new privacy laws around the world and how they’ll affect your analytics

Data privacy breach


  • 25 years of digital analytics with Brian Clifton: Being data-informed, not just data-driven

    As organizations increasingly rely on data in their business decisions, the challenges of ensuring data accuracy, consistency, and ethical collection are becoming more and more important. Along with understanding the audience’s needs, supporting collaboration between teams, and securing privacy compliance, these challenges have evolved into data collection and analytics priorities.  Let’s dive into the third…

    Read more

  • Piwik PRO is HIPAA certified

    Piwik PRO is officially HIPAA certified!

    At Piwik PRO, ensuring the highest level of security and data protection has always been our top priority. Developing privacy-friendly analytics is just one aspect of our commitment. We validate our approach by obtaining external certifications from independent organizations. As such, we are pleased to announce that a HIPAA (Health Insurance Portability and Accountability Act)…

    Read more