It’s happening again—after EU privacy authorities brought the European rollout of Meta AI to a screeching halt and forced X to stop training its Grok chatbot on European users’ data, they’re now also investigating Google over its AI practices.
The Irish Data Protection Commission (the lead EU privacy regulator for most Big Tech firms, due to its establishment in the country) said today that it was formally probing Google’s behavior around its PaLM 2 large language model—the predecessor to the Gemini LLMs that are now powering Google’s AI offerings.
Specifically, the DPC wants to check if Google conducted a data protection impact assessment before deploying PaLM 2 last year. These assessments are demanded by EU privacy law and, in the DPC’s words, are “of crucial importance in ensuring that the fundamental rights and freedoms of individuals are adequately considered and protected when processing of personal data is likely to result in a high risk.”
This is, on the face of it, a relatively beige action by the Irish watchdog—it involves an AI model that’s already out of date, and it’s not clear what (if anything) Google might have to stop doing.
Meta was ordered to stop training Meta AI on the personal data of Facebook and Instagram users without their consent, so it pressed pause on the entire venture in the EU and U.K., claiming that not being able to use European data for training made it pointless to roll out AI in that region. Elon Musk’s X also had to stop feeding European user data into its AI, though it continues to provide Grok there.
Nonetheless, the same law—the EU’s General Data Protection Regulation—is at play in all these cases. This makes sense, as there’s no AI without data, and the GDPR was always designed to be technologically neutral. If personal data is involved, then the GDPR applies. Violations of the law can in theory lead to fines of up to 4% of global annual revenues.
“We take seriously our obligations under the GDPR and will work constructively with the DPC to answer their questions,” said a Google spokesperson.
Considering Meta, X, and Google’s GDPR issues—plus the antitrust concerns that have prompted Apple to delay the EU rollout of Apple Intelligence—it's by now very clear that European regulation is already an active concern for the AI sector.
And it’s still going to be a couple years before the EU’s actual AI Act will fully come into force, bringing in a host of non-privacy-related rules, so buckle up!
* * *
On a separate note, this is last of my essays for Data Sheet, which will adopt an exciting new format as of Monday. (My colleague Allie Garfinkle will be penning the final Data Sheet essay tomorrow.)
The new Data Sheet will be more bite-sized, summarizing a range of the day’s most important tech stories to help you quickly understand their importance. Our aim is to make Data Sheet the only tech newsletter you’ll need to read in the morning, and we hope you’ll enjoy it!
As for me, I’ll still be around, spending a lot more time delving into the subject of AI along with our existing experts on the subject, Jeremy Kahn and Sharon Goldman. And don’t worry: If you share my longstanding interest in issues around tech regulation, I’ll still be covering the most important developments in my Fortune writing.
More news below.
David Meyer
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
