← Regulators
GDPR EU 2016/679 Italy

Who is the Garante: Italy's data protection authority that took on ChatGPT

The Garante per la protezione dei dati personali is Italy's GDPR supervisory authority – and the regulator that made global headlines by temporarily blocking ChatGPT. What it does, how its Collegio is structured, why Italy's big fines are about telemarketing, how much of its money comes from fines, and why the board has had three members since January 2026 – every fact sourced.

Editor: Erik Saar · Published May 17, 2026 · Updated October 1, 2026 · 15 min read · 25 sources cited

When the world’s regulators were still working out how to react to generative AI, one of them simply switched ChatGPT off in its country. That was Italy’s Garante – a regulator whose biggest fines, for all the AI headlines, are about telemarketing. This is a profile of what the Garante is, where it came from, how it is run, what it has fined, how it is funded, and why its board has been one member short since January 2026. Every fact is sourced.

Quick facts

  • Full name: Garante per la protezione dei dati personali (the Italian data protection authority) (EDPB members)
  • Role: Italy’s GDPR supervisory authority – the independent national body that enforces data-protection law in Italy and sits on the EDPB (EDPB members)
  • Founded: by Law no. 675 of 31 December 1996 (Garante – Law 675/1996); the first Collegio took office on 17 March 1997 (Garante – previous boards)
  • Governing law today: the GDPR and the Codice in materia di protezione dei dati personali (Italian Data Protection Code, Legislative Decree no. 196/2003, adapted to the GDPR by Legislative Decree no. 101/2018) (Garante – Compiti)
  • Structure: a collegiate body of four members elected by Parliament for a seven-year, non-renewable term (Garante – Collegio)
  • Current Collegio: elected on 14 July 2020, in office since 29 July 2020; President Pasquale Stanzione, Vice President Ginevra Cerrina Feroni, member Agostino Ghiglia; the fourth seat has been empty since Guido Scorza resigned on 17 January 2026 (Garante – Collegio, Garante)
  • Staff: 182 people in service at the end of 2025 against 200 authorised posts, plus 16 on contract (Relazione 2025)
  • Budget: €48.0 million in income in 2025, almost all of it from the state budget (Relazione 2025)
  • Headquarters: Piazza Venezia 11, 00187 Roma (Garante – Contatti)
  • Website: garanteprivacy.it

What the Garante is – and what it is not

The Garante is Italy’s data protection authority (DPA – the independent national regulator that supervises and enforces data-protection law) and Italy’s GDPR supervisory authority (EDPB members). Its tasks come from the GDPR and the Italian Data Protection Code: checking that processing complies, handling complaints, ordering limits or bans on processing, imposing fines, advising Parliament and the Government on draft laws, and reporting to Parliament every year (Garante – Compiti). It is one of the national authorities that make up the EDPB.

What it is not: it is not Italy’s AI Act authority. Italy’s AI law – Law no. 132 of 23 September 2025 – designates the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as the national authorities for artificial intelligence, with ACN as market surveillance authority and AgID as notifying authority; the Bank of Italy, CONSOB and IVASS keep the market surveillance role for AI in finance. The same article states that the Garante’s existing powers remain unaffected (Law 132/2025, Art. 20 – Gazzetta Ufficiale). So the Garante’s AI work is GDPR enforcement that happens to touch AI – which is why it sits on the GDPR pillar.

From Rodotà to today: a short history

The Garante was created by Article 30 of Law no. 675 of 31 December 1996, as a body working “in full autonomy and with independence of judgement”. Under that law, as amended in the following years, it already had four members, two elected by the Chamber of Deputies and two by the Senate, but with a four-year term renewable once (Law 675/1996, Art. 30). Today the term is seven years and cannot be renewed (Garante – Collegio).

The Garante’s own list of boards (Garante – previous boards):

CollegioTermPresident
First17 March 1997 – 16 March 2001Stefano Rodotà
Second19 March 2001 – 18 March 2005Stefano Rodotà
Third18 April 2005 – 18 June 2012Francesco Pizzetti
Fourth18 June 2012 – 28 July 2020Antonello Soro
Currentsince 29 July 2020Pasquale Stanzione

Since 2003 the national framework has been the Data Protection Code (Legislative Decree no. 196/2003), adapted to the GDPR by Legislative Decree no. 101/2018; it governs the Garante’s work alongside the Regulation (Garante – Compiti).

What the Garante actually does

Like every GDPR supervisory authority, the Garante applies one EU regulation – handling complaints, investigating, authorising or prohibiting processing, and imposing corrective measures and fines. Three features stand out:

  1. It acts by stopping processing, not only by fining. It can impose an immediate temporary limitation on processing – as it did with ChatGPT in 2023, DeepSeek in 2025 and the FaceBoarding facial-recognition system at Milan Linate airport in 2025 (below).
  2. It reaches non-EU operators. Its best-known actions target US and Chinese companies offering services to Italian users.
  3. Its decisions are tested in court. Challenges go to the ordinary courts – the court where the controller is based or the one where the complainant lives (Legislative Decree 150/2011, Art. 10). Several high-profile Garante decisions have been overturned by the Tribunale di Roma (the court of first instance in Rome) (see below).

It also has a criminal-law channel: in 2025 it sent 65 reports of possible offences to the judicial authorities, up from 16 in 2024 – 54 of them about non-consensual sharing of intimate images or videos (Garante – Relazione 2025, summary).

The Garante and AI

The Garante’s best-known cases involve generative AI:

  • ChatGPT, March 2023. On 30 March 2023 it ordered, with immediate effect, a temporary limitation on OpenAI’s processing of Italian users’ data, citing unlawful data collection and the lack of age checks for minors (Garante, 31 March 2023).
  • OpenAI – €15 million – overturned in court. Decision no. 755 of 2 November 2024, announced on 20 December 2024, fined OpenAI €15 million and ordered a six-month information campaign. The Tribunale di Roma upheld OpenAI’s challenge in judgment no. 4153/2026, published 18 March 2026, and the Garante has temporarily removed its decision from its website (Garante).
  • Luka / Replika – €5 million. Decision of 10 April 2025: the US operator of the Replika chatbot had no legal basis for its processing and no age verification; a separate inquiry into the training of the AI model behind it was opened. A challenge against the decision is pending (Garante).
  • DeepSeek, early 2025. At the start of 2025 the Garante limited the processing of Italian users’ data by the two Chinese companies behind the DeepSeek chatbot (Garante – Relazione 2025, summary).

The common thread is GDPR, not the AI Act: personal data used to build or run an AI service without a valid legal basis (the lawful ground Article 6 GDPR requires before any personal data is processed), poor transparency and no protection for children. Articles, corrective measures and court status are in the dedicated registry: Garante AI fines.

The Collegio – how the Garante is run

The Garante is not run by a single director but by a Collegio (a collegiate board) of four members, elected by Parliament for a seven-year, non-renewable mandate. The current Collegio was elected on 14 July 2020 and took office on 29 July 2020; two members were named by the Chamber of Deputies and two by the Senate (Garante – Collegio).

Why he resigned. In January 2026 the Rome public prosecutor’s office was investigating all four members of the Collegio, including President Stanzione, for alleged corruption and embezzlement; the Guardia di Finanza searched the Garante’s offices on 15 January 2026. The investigation followed a series of reports by the TV programme Report (ANSA, 15 January 2026). On 16 January the whole board – still four members – said it had “full confidence” in the judiciary, was sure it could show it had nothing to do with the facts alleged, and would continue its work (ANSA, 16 January 2026). Scorza resigned the next day, saying: “I bear no responsibility in relation to the allegations made against me”, but that the Authority needs credibility “not only actual, but also perceived” (ANSA, 17 January 2026). On 18 January the three remaining members said through their lawyers that they were convinced they had “always acted with full transparency and correctness”, called the investigative hypotheses “entirely embryonic” at this stage, and stayed in office (ANSA, 18 January 2026).

The case has widened since. In April 2026 Il Post reported that Stanzione, Ghiglia, Cerrina Feroni and former member Scorza remained under investigation, and that Fabio Lazzerini, chief executive of ITA Airways until 2023, had also been placed under investigation for corruption in the same inquiry (Il Post, 9 April 2026). Being under investigation is not a finding of guilt; this profile records the facts as reported and will be updated as the case develops.

Because it is collegiate, the Garante’s decisions are the board’s, not one official’s – a structural contrast with single-head regulators such as the EDPS.

Resources and 2025 in numbers

At the end of 2025 the Garante had 182 staff in service against 200 authorised posts, plus 16 people on contract; the authorised headcount had recently been enlarged by law, and many new staff were hired at the end of 2024 (Relazione 2025).

Money. In 2025 its income was €48.0 million and its spending commitments €47.9 million; the Ministry of Economy and Finance transferred €46.6 million. One detail sets Italy apart: under Article 166(7) of the Data Protection Code, 50% of the fines the Garante collects is reassigned to the authority for its work. In 2025 fines brought €37.7 million into the state budget, up from €24.4 million in 2024 – though only a small part was actually transferred on to the Garante (Relazione 2025). Compare Ireland, where the DPC does not benefit financially from the fines it imposes (DPC Annual Report 2025).

What the Garante did in 2025 (Garante – Relazione 2025, summary):

  • 807 collegial decisions
  • answers to 4,288 complaints and 145,846 reports
  • 506 corrective and sanctioning measures
  • 2,415 data breach notifications – up 10% on 2024
  • 130 inspections
  • 65 opinions on regulatory and administrative acts
  • answers to more than 13,557 questions from the public

Enforcement: telemarketing first

Italy’s largest GDPR fines are not about AI. The record is €79,107,101 on Enel Energia (decision no. 81 of 8 February 2024), which the Garante called “the highest ever applied by the Authority”: Enel had taken on 978 contracts from four companies outside its sales network, and serious security gaps in its customer systems had, over time, affected the activation of at least 9,300 contracts. The Tribunale di Roma rejected Enel’s challenge and confirmed the decision in full in judgment no. 12783/2025, published 18 September 2025; a further appeal is pending (Garante).

That case is typical. Aggressive telemarketing, mostly using people’s data without consent, has been one of the Garante’s main battles for a decade, and in 2025 it again drew heavy fines, especially in the energy sector (Garante – Relazione 2025, summary). Biometrics are the other growth area: in 2025 the Garante suspended the FaceBoarding facial-recognition system at Milan Linate airport after finding that biometric data of more than 24,500 passengers were kept in a central archive (Garante – Relazione 2025, summary).

The courts push back too. Besides the OpenAI ruling, the Tribunale di Roma in January 2026 annulled a €150,000 fine the Garante had imposed on RAI on 23 October 2025 for broadcasting, in Report, an audio recording between former culture minister Gennaro Sangiuliano and his wife. The court found the broadcast a legitimate exercise of investigative journalism in the public interest and the sanction late under the Garante’s own deadlines; the Garante said it reserved the right to appeal to the Court of Cassation (ANSA, 26 January 2026).

The full case-by-case record – Enel, TIM, Wind Tre, Vodafone, Intesa Sanpaolo, the Foodinho and Deliveroo algorithm cases and more – is in the Garante fines registry.

How to contact the Garante

  • Complaint (reclamo) – a detailed, formal complaint about a breach of data-protection law under Article 77 GDPR and Articles 140-bis to 143 of the Code. It is followed by a preliminary inquiry and possibly a formal procedure ending in measures under Article 58 GDPR. Filing it is free (Garante).
  • Report (segnalazione) – a lighter way to flag a possible breach; also free (Garante).
  • Address: Piazza Venezia 11, 00187 Roma; switchboard (+39) 06.696771; email protocollo@gpdp.it; certified email (PEC only) protocollo@pec.gpdp.it (Garante – Contatti).

If the company you complain about has its EU base in another Member State, the Garante passes the case to that country’s lead authority through the GDPR one-stop-shop – see the EDPB profile.

What this means for you

  • If you train or run AI on personal data, and Italian users can reach it: the Garante has shown it will act by stopping the processing, not only by fining – as with ChatGPT, Replika and DeepSeek. Establish your Article 6 legal basis before launch, not after.
  • If you do outbound marketing into Italy: this is where the biggest Italian money is. Have provable consent for every call and message, and keep unauthorised agents out of your sales systems – the Enel record fine was about contracts from agents outside its network and weak security.
  • If your service can be used by minors: both Italian AI fines turned partly on the absence of real age verification. A terms-of-service exclusion is not a control.
  • If you receive a Garante sanction: it is not the last word – it can be challenged in court, and the OpenAI and RAI rulings in Rome show decisions can fall. Equally, a limitation or block bites immediately, long before any court rules.
  • If you are a journalist or researcher: “Italy’s privacy regulator” = the Garante per la protezione dei dati personali, created by Law 675/1996, a Collegio elected by Parliament for seven years – President Pasquale Stanzione, Vice President Ginevra Cerrina Feroni, member Agostino Ghiglia, fourth seat vacant since Guido Scorza resigned on 17 January 2026 – with 182 staff and €48.0 million in income in 2025, seated at Piazza Venezia 11, Rome. When citing the board, note the Rome prosecutors’ investigation reported in January 2026.

TL;DR

The Garante per la protezione dei dati personali is Italy’s GDPR supervisory authority, created by Law no. 675 of 31 December 1996, with its first Collegio in office from 17 March 1997 under Stefano Rodotà. It is a four-seat Collegio elected by Parliament for a seven-year non-renewable term; the current one (since 29 July 2020) is led by President Pasquale Stanzione, with Vice President Ginevra Cerrina Feroni and Agostino Ghiglia – the fourth seat has been vacant since Guido Scorza resigned on 17 January 2026, amid a Rome prosecutors’ investigation into the board reported by ANSA. In 2025 it had 182 staff, €48.0 million in income, 807 collegial decisions and 506 corrective and sanctioning measures; fines brought €37.7 million into the state budget, half of which the law reassigns to the Garante, though only a small part was actually transferred. It blocked ChatGPT in 2023 and fined OpenAI €15 million (overturned by the Tribunale di Roma, judgment no. 4153/2026) and Luka/Replika €5 million, but its record fine is telemarketing: €79.1 million on Enel Energia, upheld at first instance. It is not Italy’s AI Act authority – Law 132/2025 gives that role to AgID and ACN. Seat: Piazza Venezia 11, Rome.

Sources