Calls to pause the development of artificial intelligence (AI) chatbots and moves to ban their use due to data privacy concerns will likely slow down (but not stop) AI's growth, and they illustrate the regulatory challenges that governments will face as the industry progresses. AI research and deployment company OpenAI, which developed the AI chatbot ChatGPT that has remained viral since its release in November 2022, has come under intense scrutiny in recent days over how quickly it has rolled out new features without seriously considering security, regulatory or ethical concerns. On March 31, the Italian Data Protection Authority (DPA) ordered a temporary ban on ChatGPT and said it would open an investigation into OpenAI and block the company from processing data from Italian users. On March 30, the U.S.-based Center for AI and Digital Policy filed a complaint with the U.S. Federal Trade Commission (FTC) against GPT-4, the latest version of ChatGPT's underlying large language model (a deep learning algorithm for language), and asked the FTC to ban future releases of the model. On March 29, the Future of Life Institute, a nonprofit organization focusing on existential risks that humanity faces, published an open letter signed by more than 1,800 people calling for OpenAI and other companies to immediately pause all development of AI systems more advanced than GPT-4, warning that "human-competitive intelligence can pose profound risks to society and humanity." 

• The Italian DPA laid out a number of concerns with ChatGPT and OpenAI, including that OpenAI lacks a legal basis for its "mass collection and storage of personal data...to 'train' the algorithms," and that it does not verify users' ages or include any ways to restrict content for users 13 years old or younger. The order comes after the Italian DPA issued a similar order on the Replika AI chatbot that aims to be a companion AI to its users. 
• In its complaint, the Center for AI and Digital Policy called GPT-4 "biased, deceptive, and a risk to privacy and public safety." It also said OpenAI and ChatGPT had not fulfilled the FTC's demand for AI models to be "transparent, explainable, fair, and empirically sound while fostering accountability." The center called for the FTC to open an investigation into OpenAI and ChatGPT and to "find that the commercial release of GPT-4 violates Section 5 of the FTC Act," which prohibits unfair and deceptive acts affecting commerce. 
• SpaceX and Tesla founder Elon Musk, Apple co-founder Steve Wozniak and former U.S. presidential candidate Andrew Yang were among those to sign the open letter calling for a pause in the development of AI systems more advanced than GPT-4. 

The Italian DPA's ban on ChatGPT and its investigation into OpenAI illustrate the data privacy challenges that generative AI tools face under the European Union's General Data Protection Regulation (GDPR). The Italian DPA's investigation kicks off a 20-day deadline for OpenAI to communicate to the regulator how it will bring ChatGPT into compliance with GDPR. The investigation could result in a fine of up to 4% of OpenAI's global annual revenue, and any order for OpenAI to change the structure of ChatGPT would set a precedent for the rest of the European Union. ChatGPT and other generative AI models face a number of data privacy challenges that will not be easy to address under data privacy laws like GDPR, which was designed when current AI training models were in their infancy. Moreover, one of the fundamental characteristics of GDPR is its provision for a "right to be forgotten," which requires organizations to give individuals the ability to request that their personal data be deleted in a timely manner. From a technical standpoint, fulfilling this requirement will be extremely difficult for an AI model trained on open data sets, as there is no good technique currently to untrain a model if a user were to request that their personal data be removed, nor is there a way for OpenAI to identify which pieces of information in its training data set would need to be removed. The right to be forgotten is not universal, and there are constraints on it, but it remains unclear how European regulators will interpret it in the context of generative AI systems like ChatGPT. As the investigation progresses, it may become clear that the current GDPR is insufficient to address concerns in an even-handed way. 

• OpenAI trained its model on text data scraped from the internet and other forms of media, including likely copyrighted material that OpenAI did not receive permission to use. Other generative AI models that have used data sets scraped from the internet, such as the Clearview AI facial recognition tool, have also received enforcement notices from data regulators over the use of their information.
• In addition, ChatGPT has also had several bugs in recent weeks, including one where users saw other users' input prompts in their own prompt history. This bug violated GDPR and opened up questions about cybersecurity, particularly as a person's prompts can include various privacy concerns. Similar issues could arise if users' input controlled and regulated information. 

Potential U.S. regulatory moves against chatbots using large language models are not as advanced as the European Union's, but they will have a more significant impact on the development of AI technology. Most of the West's leading developers of generative AI technologies are U.S.-based, like Google, Meta, Microsoft and OpenAI, which gives U.S. regulators more direct jurisdiction over the companies' actions. But the impact of the request for the FTC to force OpenAI to pause future releases of GPT-4 and beyond is uncertain, as many complaints often do not result in FTC action. Nevertheless, public concern about AI could drive the FTC to open up an investigation, even if it does not order any pause on AI development. And on March 27, FTC Chair Lina Khan said the commission would make ensuring competition in AI a priority, which may suggest that the commission would be more willing to take up AI-related complaints on all issues. From a data privacy perspective, the regulatory market in the United States will be complicated for OpenAI and others to navigate since the United States lacks a federal data privacy law and appears unlikely to adopt one any time soon, as Republicans and Democrats largely disagree on its potential focus. While this partially limits the regulatory and legal challenges that OpenAI and other chatbot developers may face at the federal level in the United States, several states (including California, where companies like OpenAI and Meta are headquartered) have state data privacy laws that are modeled off of GDPR. It is highly unlikely that OpenAI will segment the services that it offers in the United States after state-level rulings, meaning California and other state determinations could have an impact across the United States even in the absence of a federal data privacy law. However, OpenAI and Microsoft, a leading investor in OpenAI, will push back legally and could claim that state data privacy regulations overstep states' rights.

• Like GDPR, the California Consumer Privacy Act includes a provision for the right to be forgotten. This means the challenges of untraining AI models that are trained on open data sets may become a material issue in the United States at the state level.

While European and U.S. regulatory decisions — and public skepticism toward AI — will slow some of the industry's development, generative AI will likely maintain its rapid growth. Given the potential widespread innovation that generative AI can bring, even if there are concerns about the impact on the job market, the rapid investment into chatbots that ChatGPT's release has kicked off is likely to continue. In fact, the rapid advancement and new innovations (such as the recent OpenAI plugin feature that enables ChatGPT to pull information from the internet) will only increase AI tools' utility for corporations. However, uncertainty around the future regulatory market means that early adopters of the technology could find their use of the technology quickly upended by future regulatory action, or find themselves in the middle of data privacy and other regulatory challenges if they integrate the technology without proper due diligence and protections. For example, while ChatGPT is not a technology that is learning through the inputs from its users, it appears that Google's Bard AI does, making potential applications using such technologies conduits for issues like the right to be forgotten. Nevertheless, the pace of innovation in AI is being driven by underlying technical capabilities, particularly the continued advancement of graphics processing units, central processing units and other hardware used to train large datasets. That underlying technology is continuing to improve alongside advancements in semiconductor technology, making larger data sets easier to train computationally, which means developers will continue to create more sophisticated AI models as long as investors remain interested. The West's initial regulatory push is unlikely to dampen that interest, absent an unlikely holistic banning of ChatGPT or other generative AI tools, so generative AI's rapid growth looks set to continue.