gdpr privacy data-protection personal-information data-protection-act
Is OpenAI/ChatGPT compliant with GDPR, if they don&#39;t allow changing or removing the Phone Number and Email Address?
<p>Italy has recently banned ChatGPT, and <a href="https://techcrunch.com/2023/04/28/chatgpt-resumes-in-italy/" rel="nofollow noreferrer">is now allowing it again in the country</a>, after they implemented a few privacy controls.</p>
<p>The fact that it's now allowed again makes me wonder if Italy (and the rest of EU) is &quot;finally happy&quot; with ChatGPT, GDPR-wise.</p>
<p>Since day 1 of me using ChatGPT, what worries me the most is that:</p>
<ol>
<li><p>I cannot change my email address associated with my account</p>
</li>
<li><p>I cannot view or change my phone number associated with my account</p>
</li>
<li><p>If I delete my account, the phone number (at least) stays saved in their database permanently, as we can no longer create a new account with the same phone number associated</p>
</li>
<li><p>Despite my numerous attempts, a human NEVER replies to my questions in the support chat (even though the Bot eventually says that they will reply within 1 week), and when I attempted to ask in the forum, my post was not approved. My questions to them were about changing/deleting the phone number and email address.</p>
</li>
</ol>
<p>These are basic rules of GDPR (&quot;right to erasure&quot; (Article 17) and &quot;right to rectification&quot; (Article 19)), and I'm surprised that at this point, EU countries are still allowing OpenAI/ChatGPT to do this, and that Italy hasn't required them to make changes around these personal elements.</p>
<p>Am I wrong here? <strong>Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?</strong></p>

<p>GDPR allows companies to process data for various reasons, including user consent or to fulfill contractual or legal obligations. Using an email or phone number as the unique user ID is legal, and so is retaining the unique user ID of a deleted account to prevent abuse or fraud (or for tax purposes, if it is a paid service).</p>
<p>GDPR requires companies to publish contact details, but there is no requirement to have a chatbot to be this &quot;official contact point.&quot; Somewhere in their legal boilerplate you should find a physical address where you can send a printed and signed letter. In this letter, you can request either information on your account or the correction of factually wrong data, but then your phone number is not &quot;wrong&quot; in this sense ...</p>
<p>PS -- I did not downvote, but it seems to me that your question seems to view GDPR as an universal &quot;magic wand&quot; when it is a quite specific set of regulations. About two minutes of googling got me the <a href="https://openai.com/policies/privacy-policy" rel="nofollow noreferrer">contact details</a> in the EU/EEA and UK.</p>
