On 18 March 2026 the Court of Rome annulled in full the Italian data protection authority's decision against OpenAI: a €15 million fine and an order requiring a six-month public information campaign about how ChatGPT is trained on personal data. The court did not find that OpenAI had complied with the GDPR; it found that the Garante was no longer the authority entitled to decide, on jurisdiction grounds that became clear only when full grounds were published on 28 May 2026. The Irish Data Protection Commission had recognised OpenAI Ireland Ltd as the company's single establishment in the European Economic Area on 15 February 2024, eight and a half months before the Garante's final decision, and under the GDPR's one-stop-shop mechanism the file should by then have been in Dublin. Reuters reported the ruling on 19 March 2026 and noted the court released no explanation at the time; the Garante declined to comment. The annulled decision was the Garante's provvedimento n. 755 of 2 November 2024, published on 20 December 2024, which found OpenAI had failed to notify a personal data breach suffered in March 2023, processed users' personal data to train ChatGPT without first identifying an adequate legal basis, breached transparency and information obligations, and put no age-verification mechanism in place. The €15 million figure was calculated "also taking into account the company's cooperative attitude." Using article 166(7) of the Italian