European privacy group noyb filed a complaint against OpenAI over ChatGPT’s repeated production of an incorrect birth date for a public figure and the company’s inability to correct or erase the information. The group argued that this conflicts with the General Data Protection Regulation, which requires personal data to be accurate and gives individuals rights of access and rectification. The case places a technical property of language models—generating probabilistic answers—against legal obligations designed for organisations that process information about identifiable people.
A False Answer Became a Data Rights Dispute
The complainant asked OpenAI to correct an inaccurate date of birth generated by ChatGPT. According to noyb, the company said it could not change the model to produce the correct date. It could filter prompts involving the person’s name, but that approach might block all information about the individual rather than rectifying the specific error. The group viewed this as an inadequate response to a clear request.
The example appears simple, yet it exposes a fundamental mismatch. Conventional databases store a record that can be edited. A language model learns distributed statistical relationships and constructs an answer at the time of a request. There may be no single field containing the false date. GDPR, however, focuses on the effect of processing personal data, not whether a company’s preferred architecture makes correction convenient.
Accuracy Obligations Challenge Probabilistic Models
OpenAI acknowledged that factual accuracy in large language models remained an area of active research. Chatbots can generate unsupported details even when prompted about ordinary facts. When the subject is a person, an invented statement can affect reputation, employment or safety. A disclaimer that models make mistakes may not satisfy legal requirements if the service is knowingly used to produce personal information.
Providers have several possible responses, including retrieval from verified sources, targeted output filters and restricting queries where accuracy cannot be supported. Each option has limitations. Filters can suppress legitimate information, while retrieval depends on correct source selection. The complaint asks regulators to determine whether a system should be offered for this use at all when the company cannot reliably honour correction rights.
Access and Source Transparency Matter Too
GDPR gives individuals a right to understand which personal data an organisation processes and, in many circumstances, where it came from. Noyb alleged that OpenAI did not adequately answer an access request or identify the sources behind the generated information. Model developers often train on large datasets assembled from many origins, making it difficult to connect a specific output to a specific document.
That difficulty strengthens the case for better data records. Companies need inventories of training sources, lawful bases and mechanisms for handling requests, even if they cannot trace every generated token. Retrieval-based systems can provide more direct citations, while model cards and dataset documentation can explain broader provenance. Technical complexity may shape how rights are implemented, but it does not remove the obligation to provide a meaningful response.
Regulators Could Shape Product Architecture
Noyb asked Austria’s data protection authority to investigate, order compliance and impose a fine. European regulators had already examined ChatGPT, including a temporary Italian restriction in 2023 and the creation of a European Data Protection Board task force. A decision could influence not only OpenAI but every provider offering general-purpose chatbots to European users.
The outcome may encourage systems that separate creative generation from verified personal information. A chatbot could refuse unsupported biographical questions, retrieve facts from maintained sources or label answers according to their evidential basis. Product teams may need correction layers that override model behaviour without retraining the entire system. Such controls would make data rights part of architecture rather than a customer-service process added later.
The complaint does not require a language model to become infallible. It asks who bears responsibility when a commercial service generates false personal data and cannot correct it. OpenAI can argue that outputs are created dynamically and should not be treated like stored records, while noyb can point to the practical reality that the service processes a person’s identity and presents a factual answer.
This tension will persist as chatbots become integrated into search, work and public services. People need a realistic way to contest information that affects them, regardless of whether it originated in a row of a database or the weights of a model. The most sustainable response is likely to combine technical limits, verified retrieval and enforceable procedures. If a provider cannot support accuracy, access and correction for personal data, it may need to narrow the situations in which its model is allowed to answer.
An effective correction system should also prevent the burden from falling entirely on individuals. Providers can monitor recurring categories of personal-data errors and test whether safeguards work across languages and paraphrased prompts. Appeals need timelines, human review and an explanation of what changed. Blocking a person’s name may reduce one output while making lawful information inaccessible, so remediation must be proportionate. These requirements are demanding, but they reflect the power of a service that can produce statements about millions of people instantly. Scaling generation without scaling redress would leave those people with rights that exist on paper but not in practice.
