FTC questions OpenAI over ChatGPT data security practices

The agency, in a 20-page document linked to in a report Thursday by the Washington Post, said it sent its inquiries to the company seeking to determine whether it engaged in unfair or deceptive practices regarding privacy or data security and/or reputational harm to consumers.

Specific questions posed by the FTC require OpenAI to describe:

• What data it uses to train its product and who is responsible for said training;
• What steps it takes to exclude personal information from training;
• The policies and procedures it follows to assess risk and safety before releasing updates;
• Steps taken to assess the potential of the technology to generate false statements about real individuals; and
• Any cybersecurity incidents the company has dealt with where user personal information was potentially exposed and how it responded.

The FTC said its probe is designed to determine whether an enforcement action “would be in the public interest.”

OpenAI Chief Executive Sam Altman called the FTC’s request “disappointing” on Twitter.

“[T]hat said, it’s super important to us that out [sic] technology is safe and pro-consumer, and we are confident we follow the law. [O]f course we will work with the FTC,” he said.

FTC Chair Lina Khan testified before the House Judiciary Committee on Thursday, acknowledging the agency “heard reports where people’s sensitive information is showing up in response to an inquiry from somebody else” regarding ChatGPT.

Other representatives at the FTC have spoken recently of its scrutinizing AI tools for possible rule violations.

OpenAI has come under fire for potential privacy violations before. ChatGPT was banned in Italy for a month earlier this year over concerns it was violating the European Union’s General Data Protection Regulation. The platform returned to the country after OpenAI made changes to its privacy controls.