European regulators found ChatGPT's training basis still unsettled

Start here

When several national regulators investigate the same product at once, coordinating their views takes time, and the interim record they publish along the way is genuinely useful even though it is not a verdict. The European Data Protection Board's ChatGPT taskforce report is exactly that: a shared, preliminary reading by multiple data protection authorities, published while their individual investigations were still open.

What the documents say

The EDPB's report, dated 23 May 2024, states its own limits clearly: the positions presented 'do not prejudge the analysis that will have to be made by the Supervisory Authorities in each investigation respectively.' Within that caveat, the taskforce sets out preliminary views. On lawful basis, it records that OpenAI relies on Article 6(1)(f) legitimate interest for both web-scraped training data and for using conversation content to train models, a basis OpenAI's own help page also describes; the report stresses that safeguards such as filtering special-category data could help meet the balancing test the law requires, with the burden of proof resting on OpenAI. On data accuracy, the report makes a distinction worth naming precisely: 'the purpose of the data processing is to train ChatGPT and not necessarily to provide factually accurate information,' and outputs 'are likely to be taken as factually accurate by end users... regardless of their actual accuracy,' while the accuracy principle under data protection law still applies regardless of that design purpose. On individual rights, the report records that OpenAI 'suggests users to shift from rectification to erasure when rectification is not feasible due to the technical complexity of ChatGPT,' meaning a person who cannot get a false statement corrected may only be offered deletion instead.

Check this

A reader can apply the report's own accuracy distinction to any AI product: ask separately whether the system was built to be truthful about you specifically, or built to produce plausible, fluent text in general, since the report treats those as different design goals with different legal consequences. Also worth checking, for any AI service, whether its stated way of handling a rectification request is actual correction, or only deletion dressed up as a substitute.

What holds and what fails

What holds is the report's own framing: this is a coordination document recording shared preliminary views, not a finding of infringement, and the investigations it describes remained open at publication. What it does not establish is a resolved answer to whether OpenAI's legitimate-interest basis is lawful; the report describes the test and OpenAI's position, without declaring a result. Readers should treat this as documenting an open legal question, not a closed case either way.

• Ask whether an AI product distinguishes truthfulness about you from general fluency.
• If you ask a provider to correct a false statement about yourself, note whether deletion is offered instead.
• Remember a joint regulator report can state shared preliminary views without resolving a case.

A regulator's interim report rarely makes headlines the way a fine does, but it often states the actual legal questions more precisely than the company's marketing or the news coverage that follows a later decision.