Italy's ChatGPT ban attracts EU privacy regulators | Hacker News Reader

Italy's ChatGPT ban attracts EU privacy regulators

reuters.com

102 pointsfirstSpeaker233 comments

Here's my hypothesis of what is going on:

1. Europe can't do computers. This is bad for them, because foreign companies, who can do computers, make money in Europe and beat out the local competition.

2. But the EU has discovered that it can extract money by threatening to ban the foreign companies for reasons of privacy, data protection etc.

3. Since the EU is a valuable market, the companies accept the fines as a price of doing business.

4. Italy is getting in early by firing a shot across the bows of OpenAI, which is not yet a huge moneymaker, but may be in future.

> Since the EU is a valuable market

For how long? A market is large because it has highly productive economies. If Europe can't hack computers, as you say, their growth potential will be curtailed.

> Europe can't hack computers, as you say, their growth potential will be curtailed

European industry is alive and well, and it can buy the tools it needs from American companies. To the degree "Europe can't hack computers" is less of a ridiculous oversimplification, it's with pertinence to the consumer market.

Is it really alive and well or is it mostly booking profits for activities conducted elsewhere in the world? How much R&D, manufacturing, or distribution do the ABBs and Siemens of the world actually depend physically on the EU for?

> How much R&D, manufacturing, or distribution do the ABBs and Siemens of the world actually depend physically on the EU for

European heavy industry expertise is deep [1]. It also undergirds a lot of America production; Rheinmetall, for instance, designs and builds the M1 Abrams’ gun. In light industry, ASML is the product of a distributed precision manufacturing culture.

[1] https://en.m.wikipedia.org/wiki/List_of_largest_European_man...

They could make other things and trade them with the people who do computers?

The EU has a higher GDP than the US (albeit they're very close). A lot of strong engineering comes out of Europe, for example Arm or the self-driving work by Mercedes.

(I did not downvote the parent comment.)

> The EU has a higher GDP than the US (albeit they're very close).

In case anyone was curious, the IMF currently believes that the US's GDP is 50% higher than the EU's = 40% higher per capita.

https://www.imf.org/external/datamapper/profile/EU https://www.imf.org/external/datamapper/profile/USA

You're right per capita, but as a total market the EU is larger.

It's literally not though. EU has a higher population and lower total GDP.

You’re right, I was looking at 2015 data

US GDP per capita: $75K (PPP), $75K (nominal)

EU GDP per capita: $54K (PPP), $37K (nominal)

It's not even close.

Waymo is years ahead of anything coming out of Mercedes.

Which cars can you buy with Level 3 self-driving in the US? What states allow Waymo Level 3+ driving? Yes I can get around the SF Finance District if I sign up to be a beta tester with Waymo, and they do run in Pheonix, but Mercedes has full Level 3 signed off in Nevada. In fact Mercedes have said they will take ownership of self-driving accidents while Tesla for example points it to the individual driving.

We're talking about the engineering capability, not how the product is monetized. If a company had flawless L5 but it was exclusive to millionaires driving cross-continent, it would be impressive engineering albeit a niche business.

>Mercedes has full Level 3 signed off in Nevada

I wonder why they're testing in Nevada and not the EU. Could it be that the EU stifles innovation with its strict laws?

Or maybe it was actually started to roll out in Summer last year in the EU?

Mercedes Level 3 cars expected to be priced at $50k, competitive with Tesla.

https://etsc.eu/europes-first-cars-with-level-3-automated-dr...

Or 5. American companies have shown a complete disrespect of (privacy) laws and thus get hit by the appropriate regulators.

I can't see it this way. The recent leak was entirely due to the redis-py bug. Any other company that used redis-py together with asyncio would have had the same leak (and this is fixed already), but, for some reason, only ChatGPT is being punished. Also, short of running all third-party source code through expensive auditors and insurance companies, there was no way to prevent or mitigate this.

If they continue to enforce this without also making all liability-limitation clauses in software licenses invalid (and thus killing non-commercial software, including OSS), I would treat this as something very hypocritical.

Is your view specifically applicable to EU bans on US related tech, or would you extend it to the US bans on Chinese related tech? If there's a "but" in there then maybe your hypothesis isn't too solid.

China bans US tech, US bans China tech, tit for tat. The difference between US and Europe is that US actually creates things.

Your generalization of an entire continent is quite offensive (more towards yourself, really). But going past that, sometimes creating things comes with a cost, like privacy. And now you see this dissonance where on one hand we lament the status of today's privacy, while at the same time calling any attempt to limit the damage a sign of incompetence.

As for your "tit for tat" explanation, it would hold a lot more water if the bans didn't target (almost?) exclusively the areas where China is pulling ahead.

It's not a generalization, it is a verifiable observation: Europe creates significantly less. If that's offensive to you then it's time to reflect on what caused you to be in this position.

> The difference between US and Europe is that US actually creates things.

If you want to generalise like that you can even remove the US and swap it for "California" or even "the 100km surrounding mountain view"

That sounds directly correct. I don't see a problem with intelligent regulation, especially around what kinds of decisions or interactions involve the technology.

But it seems like the people who want to "pause" or stop it span the spectrum from jealousy to inferiority to straight up lack of capability. If they'd got there first, they wouldn't be trying to shut it down.

All that said, it would be good to see some intelligent regulation, the development of which involves real businesses that have uses and not the usual suspects.

I question whether or not regulators and policy can keep up with the pace of AI. Where we are going (and fast) seems to be a place where the tools themselves can write policy and tooling better than we can. That has to shake the upper ranks of government around the globe, their job is policy and laws that the laymen can’t really interpret or understand, yet provides some sort of societal service.

Regulation on facts and how AI can know the truth, and be ethical - we already have those rules for humans, we should just build these regulatory instruments as extensions of that or begin the work of discussing AI rights, and use all our hard work on those laws and save some time and heartache. Obviously it’s not sentient, but we are getting close to the point that it could happen at any moment.

  we are getting close to the point that it could happen at any moment

No.

Do you think companies should be allowed to scan your face and deny you entry if your Linkedin profile ties you to a law firm?

Meh, Hanlon's Razor.

I don't know about Italy, but so far, I don't expect legislative action regarding ChatGPT in Germany. It would be an insanely unpopular decision and contribute nothing to SPD/FDP's voters. It doesn't add up, and the article is full of nothing.

The state of privacy in Germany can be summed up nicely by quoting the data privacy officer of Hamburg from a couple of weeks ago: "Principles for avoiding and minimizing the processing of personal information, which are enshrined in the General Data Protection Regulation (GDPR), among other things, "will be unable to be upheld."

Pet peeve but I think Hanlon’s Razor is fundamentally wrong. Any ecosystem where it’s believed is an ecosystem which evolutionarily favors malice, which implies that it’s not true.

Thus, you should follow Hanlon’s razor only if others don’t.

I'm not sure I follow? You don't think the current ecosystem favors malice? Even if I don't have actively malicious intentions, I think it's fair to say that if the actions I take to advance myself over others have negative externalities (at various scales obviously), I've engendered "malice" in the ecosystem.

It took a couple reads, but I believe what they meant was:

Any ecosystem where incompetence is assumed over malice creates material incentives for malice, because plausible deniability is fundamental to its environment. Therefore, malice is encouraged and becomes more likely, invalidating the theory.

As for your reply, I'm not actually sure what to make of it or how it relates to the previous comment, so I can't comment.

Indeed, and let this be a lesson to myself in writing clearly!

> 1. Europe can't do computers. This is bad for them, because > foreign companies, who can do computers, make money in Europe > and beat out the local competition.

As a huge Microsoft fan and Linux hater I totally agree. Europe can't do computing.

;-)

[EDIT: can't believe I have to state this.. but this is a joke. That's why I'm winking. Poking fun at the idea that "Europe is bad at computers" when the dominant server OS is literally European with the field being established by the late Alan Turing who was.. British. Who also made the first programmable digital computer].

It's not that there isn't some truth to what you've said, but to assert that this is the fundamental underlying motivation for political perspectives throughout Europe is an indefensible conspiracy theory.

I agree it's complicated and European politics particularly so. It seems more like they don't have any economic interest in letting it spread quickly so slowing it down and taxing it "just in case" is a perfectly rational political action.

It’s always been my opinion that GDPR and some of the other European regulations are simply trade tariffs draped in a more publicly appealing disguise, given the only tangible outcome they’ve achieved is extracting money from foreign companies. This isn’t an opinion that’s ever been welcomed on HN though.

They apply equally to EU companies as US companies. They're very much not a trade tariff.

Actually US companies have an advantage as it's much easier for them to just ignore the laws / they have certain ways of getting around the laws that do not apply to EU companies.

Go look at the enforcement statistics and tell me again how equally they apply. Even if you presume there is no enforcement bias whatsoever, it’s still going to act as a trade tariff due to the enormous trade deficit the EU has in regards to digital services.

OK I have experience here: US companies are far more likely to break the law. It's extremely hard to get US based CTOs in particular to understand the GDPR, they literally ignore it. Then stuff happens and they get in trouble.

What makes it worse: the GDPR itself is a great example of cultural differences: Americans are happy to eat bleached chicken and for all of their lives and personal data be there to make big companies lots of money. Europeans very much do not think like that. Which is good, different strokes for different folks.

Which is to be expected: GDPR basically is a harmonisation of the various privacy laws that existed in various member states before.

Why is the EU a valuable market? Canada, Mexico, Brazil, middle east, South Korea, Philippines...? Big markets are out there.

For tech, mobile games and advertising, it is 15% of global market.

I'm saying for a company like OAI, is Europe really that valuable? There's a lot of market out there, I'm not sure the EU moves the needle in the long run for a technology like this. I'm not trying to pick a fight, just that for OAI, Europe might not matter.

I don't understand this thinking. The gdpr is law since years, this is SIMPLY a case of a company not respecting it and paying the price, there is literally nothing else going on

I think many people do not read the article, this is not about AI technology, there was data leak and OpenAI did not follow the law and disclose this to the affected people and follow all the steps. Not they are investigated and other illegal stuff was found.

At this moment there is no "EU wants to ban AI" attempt. So OpenAI competitors, make sure to follow the laws and you will have a market in EU.

We might not do computers, but we can do software just fine. With all the published research out there, and the base of the datasets being out there, and the fact that Europe has boatloads of money it's only a matter of time until there's a European GPTX alternative.

Maybe delaying ChatGPT by a little opens up the market for an EU competitor, China style. I don't think that's very realistic because the EU doesn't move fast enough but who knows.

EU is very different from China. Environment is not friendly towards software entrepreneurs.

I'm sorry, but this is lazy at best.

> But the EU has discovered that it can extract money by threatening to ban the foreign companies for reasons of privacy, data protection etc.

So your argument is that the EU, with trillions of dollars in GDP, decides to shoot itself in the foot by blocking one of the biggest inventions ever in order to "extract" a few millions of dollars here and there.

At least it would not be pure short-sightedness. They would be shooting themselves in the foot for something.

What do you mean Europe can't do computers? ASML is based in the Europe. America can't do much computer wise without ASML machines

>America can't do much computer wise without ASML machines

That's such a narrow minded view, and that's coming from an European. Can you do much in Europe, computer wise, without Office365, Android, iPhone, Gmail, Google, AWS, Intel, AMD, Apple, Quallcomm, Azure, Windows? Go ahead and try to buy a PC with European CPUs, GPUs, ruining European software. Or buy a European smartphone ruining an European SoC and modem with an European OS.

And ASML's golden goose, EUV tech, is an US invention licensed to ASML which can be revoked anytime if they sell EUV machines to China or any other US adversary, the restriction which is hurting ASML's bottom line as China is hungry for lithography machines and will pay top dollar for them.

ASML got to where it is precisely because of the US assistance: https://www.dpreview.com/forums/post/65642319

And Carl Zeiss is probably also using some US invention?

Your point?

Europe can't do computers. This is bad for them, because foreign companies, who can do computers, make money in Europe and beat out the local competition.

Not this again. Europe fails on producing unicorn that grow by exploiting people's addictions (Facebook), externalizing cost (Uber, AirBnB). However, Europe does fine in computing. The chips in you cell phone and computer are most likely made with an eUV machine from ASML, it probably has a bunch of NXP chips in it too. Europe has huge business software companies like SAP. Europe also has plenty of unicorns, like Klarna, Spotify, Revolut, Mollie, Just Eat/Takeaway etc. You may not know about all of them, because they operate primarily in Europe, like there are also plenty of US unicorns that barely have any footing in Europe.

Americans tend to assume every successful tech company is founded in America. Whenever Ubisoft is in gaming news, there are always Americans surprised to learn they're French.

Activision-Blizzard, Epic, Microsoft, Take-Two, Electronic Arts, and Sony (partially) are all American and have 10x the revenue. China and Japan are both ahead of EU as a whole.

>Ubisoft

As an European I currently wouldn't be proud with Ubisoft.

I'm not saying anyone should be. But they are a large successful tech company.

So Ubisoft is?

Activision-Blizzard, Epic, Microsoft, Take-Two, Electronic Arts, and Sony, as mentioned by the comment above you, aren't companies to be proud of, either.

The European Union has 100 million more people living in it than the United States alone. You named a single video game studio.

The European Union is far behind, it's both pitiful and unproductive to suggest otherwise. The reason American's are surprised to hear certain companies like Ubisoft are from the EU is because it's that uncommon, no one gets surprised when a company is Japanese.

I wasn't trying to create an exhaustive list. I was giving an example to support my point.

>plenty of unicorns, like Klarna, Spotify, Revolut, Mollie, Just Eat/Takeaway

Other than Spotify, most unicorns in Europe are copies of businesses first successfully pioneered in the US. PayPal first did digital payments in the 20th century.

Bad example - PayPal was the fruit of the (then) massively underdeveloped banking system in the US. Europe has SEPA and there was simply little to no need for something like PayPal. Whenever I hear that cheques are still in use in the US, I scratch my head, because outside of the UK I never used a cheque in my life.

PayPal is used a lot in europe[1]. Maybe the Wirecard scandal could have been avoided if only someone had explained that SEPA makes any kind of fintech obsolete.

[1]: https://sifted.eu/articles/paypal-tops-european-downloads/

Nobody really uses it tough... it just gets downloaded for those one in a life time transfers that go outside the EU

Why is PayPal so popular in Europe then?[0] Significantly more popular than even Visa/MasterCard directly it seems.[1] I didn't even know the extent of it until just now but this is very surprising. 80-90% market share across various major countries.

[0] https://ecommercedb.com/news/paypal-usage-around-90-in-europ...

[1] https://ecommercenews.eu/top-3-payment-methods-per-european-...

Well, Paypal has been around for longer and works across the world, which explains some of it.

But I question the accuracy of these stats - I would expect to see SEPA wires and direct debit being significant everywhere, Multibanco and MBWay[0] in Portugal, TWINT in Switzerland, giropay in Germany, etc

Also, even if they are accurate, they rank Joe's homemade soap shop the same as a major retailer, and don't consider how many customers actually use each payment method.

[0]: https://www.marktest.com/wap/a/n/id~2985.aspx

Because credit cards have traditionally not been popular in Europe. Up to a certain age, my dad was the only person I knew had a credit card. For a long time, PayPal was the most straightforward way to deal with US merchants, because you can link it to an EU bank account.

I don’t actually know anyone who uses PayPal for anything but purchases outside the EU. Virtually all payments for online shopping here in The Netherlands are done using IDEAL (which is a system shared by all banks). When I lived in Germany, I did most online purchases through IBAN (you basically give your account number, do a 1 cent verification transaction and it is linked).

At any rate, IDEAL is so much better than dealing with all the PayPal crap or using credit cards. Select your bank, scan a QR code, confirm with Face ID and done.

Do your banks not issue debit cards? I understand credit cards being unpopular because the rewards are weak because the transaction fees are low but hard to see how either IDEAL or IBAN are superior to using a physical debit card that you can just tap, or a debit card added to Apple Wallet or equivalent. This will work the exact same way worldwide, whether you're in Europe, the Americas, or Asia, so I don't see how IDEAL is a superior system.

I am far, far from a PayPal fan but the ability to seamlessly deal with merchants across the globe from you seems like a pretty good value add. And again, you didn't dispute why PayPal is so popular in Europe.

Banks do Issue Debit Cards but up until recently you couldn’t use debit cards online.

For local, in person, transactions my experience tells me the ratio of Debit vs Credit has to be in the order of 10 to 1.

Again, that’s just my experience living in Italy in not a huge city.

But Europe is definitely not homogeneous so other people will probably have a differente experience.

As for getting paid by people across Europe, in my 10+ years as a freelancer I never had to rely on anything different than SEPA direct transfer.

If we’re talking about online payments:

> In Europe, however, non-secure shopping was already happening online as early as the 1980s. Terminal-based services including Germany’s Bildschirmtext (launched in 1983), and Minitel in France (launched in 1982), offered various services including the ability to purchase air and train tickets.

https://www.kevin.eu/blog/history-of-online-payments/

Which would appear to be a whole decade before PayPal?

>Europe fails on producing unicorn that grow by exploiting people's addictions

Not true, there's plenty of scummy dating apps for the German speaking market funded by Swiss and Bavarian VCs to exploit single lonely desperate men. European tech founders don't hold some holy moral high ground compared to the US ones. They can all be equally unscrupulous when it comes to making money. Does Wirecard ring any bells?

>machine from ASML

Not this again, if I had a biscuit crumb for every time the chip hipsters on HN mentioned ASML as an example of European tech dominance, I would have died from obesity several times over. The simple fact that Europeans can only name ASML (and SAP) every time when discussing EU tech dominance, speaks volumes that we actually don't have much of a tech industry relative to US. (I'm also European BTW)

Short story: the only reason ASML won lithography and its competitors Canon and Nikon lost, is that US decided to license its domestic EUV tech From Sandia labs to ASML, and denied it to Canon and Nikon, purely because ASML acquired Silicon Valley Group Inc, US's leading lithography supplier at the time, giving ASML a strategic US presence on US soil, versus their Japanese competitors.

Longer story: [1]

>it probably has a bunch of NXP chips in it too

NXP mostly makes relatively low margin chips. The margins US semi companies like Nvidia, Intel, AMD, Micron, Quallcomm, Broadcom make, dwarf NXP and EU semi makers by orders of magnitude.

>Europe has huge business software companies like SAP

Companies? That's plural. But you only listed one. Which other large business SW companies do we have?

>like Klarna, Spotify, Revolut, Mollie, Just Eat/Takeaway etc.

That's it? A music streaming service that's potentially unsustainable[2] and a bunch of local food delivery and scummy online payment apps nobody outside of EU has ever heard of?

Where is EU's IBM? Or Oracle? Or iPhone? Or Android? Or Windows? Or Intel? Or AWS? Or Office365? Or Google? Or ChatGPT? Or Xbox? Or Steam? Or Netflix? Or Nvidia? Or AMD? You know, the big international money makers in the tech world, not some local EU ones that make peanuts.

US's handful of top tech companies outmatch the EU's entire tech sector combined (including UK, Switzerland and Norway), both in market cap and sheer numbers. It's not even a competition.

Or why did Linus Torvalds, Bjarne Stroustrup, Guido van Rossum or Andrej Karpathy move to the US to make their impacts in the tech world instead of staying in their native European countries and doing it here?

Europe is basically completely absent in terms of raising international champions in SW and HW products and services, especially in the consumer facing market. Our strength is making innovations and start-ups that end up swallowed by US money/entities and relocated across the Atlantic in some Delaware holding where they flourish on US soil. A few local payment and food delivery apps doesn't tilt the balance much for us. Even India ca do those better.

[1] https://www.dpreview.com/forums/post/65642319

[2] https://www.youtube.com/watch?v=gDfNRWsMRsU

Thanks for this realistic and nuanced assessment

And using SAP as an example is, let's say on par with citing Exxon...

Europe suffers from a lack of initiative, vision and financing, much more than regulation. The Nokia fumble is just one of several examples.

On the other hand there is a lot of tech development in Europe "hidden" inside big "classical" companies. Has anyone heard of Cariad for example?

I went to reply that Bosch is similar in terms of having some really interesting highly technical research going on under the radar, then realized that Bosch is now collaborating with Cariad on some of those topics. Fun!

It's funny that you mention AirBnB, because there were several well-funded german attempts to clone it[1][2]. But now that these failed, the grapes were always sour.

[1]: https://www.eu-startups.com/2011/04/9flats-and-wimdu-the-ger...

[2]: https://techcrunch.com/2011/06/01/airbnb-buys-german-clone-a...

Now this is not an AirBnB clone, but booking.com is even scummier then AirBnB or those German-clones (don't know how big they're outside of Europe tough)

That has always been Europe's model. Lean back and wait to see what innovation establishes itself, then copycat it and get the copycat sold to the US original.

I don't think this changes my argument, though it is an interesting point. (NB: I'm from the UK, so I know about these companies.) I still claim that Europe's record in software is far behind the US - even if you think some of those unicorns do bad stuff.

Arduino and Raspberry PI were created in Europe also.

Nokia/Siemens were replaced by Apple and Android (Google)

In car tech is moving to being built on top of Android.

Cloud computing-Amazon, Microsoft and Google.

Sure Europe has some smaller companies, but it’s behind in tech and the reasons are:

- regulations

- bankruptcy laws, where US bankruptcy code encourages risk taking which is needed in a fast moving industry like tech

The problem that I think a lot of americans don't get is that Europe isn't the US. It's not "money above all" "move fast and break things" "disrupt everything and ignore the law until you're profitable".

We do care about privacy, worker's right, &c. and we do understand that allowing foreign, especially american, companies to break things isn't a net benefit for us.

Uber abusing their """contractors""" despite the fact that they clearly are employees and should therefore have the same rights as other employees

E-mobility companies using public infrastructure (paid by local taxes) while themselves tax evading their profit

Airbnb allowing people to transform their regular flats into full time 365/365 hotel rooms despite the housing crisis

>We do care about privacy

Nobody in the world actually cares about privacy. All the GDPR stuff did was ruin every website on the internet, most people click accept all, few people click deny because they are paranoid, everyone still uses instagram, facebook, and iphones which constantly broadcast your information to Apple. e.t.c. But at least the politicians get to strut around pretending like they did something.

>worker's right

No, you guys care about worker equality. Workers right means that if I want to work extra to beat my colleagues for promotion, and forgo having a family, I should be able to. EU laws say, "No, you cannot do this because its unfair to all the people that want to have families and work less".

To be clear, worker equality is not a bad thing, since it does guarantee a lot of protection, but on the flip side, it doesn't allow for as much innovation.

EU could easily beat US if it allowed the same level of corporate freedom instead of trying to pass labor regulation laws, and focused resources of worker protection on things like unemployment insurance.

> All the GDPR stuff did was ruin every website on the internet, most people click accept all, few people click deny because they are paranoid, everyone still uses instagram, facebook, and iphones which constantly broadcast your information to Apple. e.t.c. But at least the politicians get to strut around pretending like they did something.

Then you clearly don't know what GDPR is and how different companies treat data in the US and in Europe.

> No, you guys care about worker equality

Ok, call it whatever you want, is it mathematically and objectively inferior to your superior American Standards Of Ethics And Morals ?

Just follow the damn law, it's really not that hard. Add a pop up, ask for consent, detail what the data is used for, don't collect what you don't need. It really isn't hard, if you american super-geniuses can't do that you should stop flexing your tech capabilities.

90% of what is in GDPR should be standard when handling data, if you can't comply with it you don't care about data privacy in the first place.

> EU could easily beat US

Beat it at what game ? You're exactly the stereotype I'm talking about, if all that matter is money then you're 100% right. But then again if we talk about social security, paid parental leave, paid vacation, work life balance, &c. it's a whole other story. Feel free to do whatever you want in your country but don't come to other continents and try to force it down out throats

> EU laws say, "No, you cannot do this because its unfair to all the people that want to have families and work less".

Which law are you referencing ?

You are way overestimating the actual effect that GDPR has on what people think data privacy is, i.e companies not having insight into personal lives.

> if all that matter is money then you're 100% right.

Money is the only thing that matters. Every EU benefit that you get costs money, its just paid for indirectly.

"No-one cares about privacy, they just pretend they do" is a dismissive non-argument. "You don't care about workers' rights, you care about worker equality" is word games: you are just re-defining what that expression means.

How many people do you know that run a rooted android phone with nothing google, no social media apps, and use something like Firefox focus for browsing?

Thats what caring about privacy is. If you use an iPhone or Mac that sends all your data for Apple to use in their own ad servers, but claim that you are against companies tracking you, you are a hypocrite, plain and simple.

As for rights vs equality, no, its not word games. They are two very different things. Rights is the ability to do things without anyone getting in your way. Equality means that protections (and restrictions) are offered to everyone regardless of how much money they make

Replying about the GDPR point, it is not about putting cookie banners and in my country alone I have witnessed it's benefits several times when companies who used to abuse people's data got in trouble.

Few examples of positive outcome doesn't mean that there was a net good. https://techcrunch.com/2019/08/10/most-eu-cookie-consent-not...

If EU wanted to privacy right, the solution would have been a technological one instead of a policy one. The whole GDPR thing was simply a show put on by politicians, nothing more.

Not this again. GDPR references cookies only once, along with IP addresses and other things, as examples of things that can be used to identify people. It made no law on how all of those things should be handled.

It was the ePrivacy Directive that actually regulated cookie use.

https://gdpr.eu/cookies/

This is pure bullshit. Nobody in Europe is preventing anybody to work himself to the death if he wants to. What it is prevented is to have somebody work himself to death on UNPAID overtime. This is just exploitation .

EU Working Time Directive of max 48 hours?

Exactly. Americans worship their own corporations and hold them above the law. Calvinism hundreds of years later. Money is everything, perceived status is everything.

This is more or less all wrong. GDPR is not there to make companies pay and keep on committing crime, but rather to make them correct their business to be compliant.

Fines are laughably low.

Besides, the whole GDPR is in place to protect European citizens from abuse of a fundamental right, which is privacy, from commercial and not commercial actors. If you are willing to give out everything about you for the latest new iToy and not receive a cent, be my guest, nobody is going to stop you in America. But here, we have regulations in place to prevent the overselling and oversharing of customer's own data.

Besides, "Europe can't do computers", Linux is a Finnish creation, as an example. You are confusing factories that produce hardware with the software that runs on it.

1, Europe cannot do hardware very well... on this I agree, software is okay but not close on the scale of US/China (or they start in Europe).

2 3 & 4, Wüt? That's not how these bans work... So could you please elaborate further?

Ethical considerations aside, I'm not sure how a country stays competitive on the global landscape if they refuse to use some form of LLM models over the next 20 years. The productivity gains possible with these relatively early iterations is far too large to ignore. Maybe they'll fund their own versions but their past history doing this hasn't been reassuring [1].

[1] https://arstechnica.com/uncategorized/2007/07/eu-approves-16...

it's perfectly reasonable to assume that some countries may ban or restrict LLMs entirely

and place trade sanctions/penalties on goods/services imported from that don't have similar/comparable legal prohibitions

(similar to the GDPR and/or plans for carbon producers)

Adobe Firefly showed you can train generative image models without ignoring the copyright questions posed by this, over the next 20 years someone will figure out how to train an LLM without ignoring the GDPR questions posed by that.

While true, Adobe Firefly is significantly worse than models from companies like Midjourney

That should probably be telling you something, ripping off all the good art that artists do makes for better pictures?

As a German with very limited faith in our government, I don't think they'll pull through with this. Our current coalition isn't this deranged; the ratio between potential gains and potential losses just doesn't add up. We're a regressive bunch, but not that regressive. I hope.

It breaks the laws, its openAI's problem not Europe's fault for caring about privacy.

Here's the thing: the Europeans have a cast iron case.

No consent was given by the content creators, no consultation was attempted, and certainly no share of compensation offered, for what is now a commercial enterprise.

This is not to endorse the European position - which is foolish, regressive and short sighted - but only to outline the case overly bureaucratised societies make when established protocols encounters innovation.

Soylent Green is people. At least the original sources there got a good video show and nice drugs.

> No consent was given by the content creators, no consultation was attempted, and certainly no share of compensation offered, for what is now a commercial enterprise.

It's about privacy concerns, not copyright.

Governments with heavy social programs can't risk losing anymore taxpayers at a time where their systems are already strained by a lack of workers/population decline. This seems like a preemptive measure to prevent that more than a result of privacy concerns.

Presuming these ulterior motives gets so tiresome. These bans are instated by data protection authorities, which largely operate independently. E.g., the Dutch data protection authority regularly fines the government. Pretty sure that is the case for other EU countries too.

You're welcome to disagree with my presumption but you don't appear to be stating anything definitive about this matter either.

All these governments have a duty to their aging population, which also tends to make up the majority of the active voter base. Every action they take tends to be multipronged but at the end of the day it's meant to protect those social programs. Consider mass migration to increase labor force and birth rates. Sure they can claim it was purely out of good will, but you'd have to be pretty myopic not to see the reality there.

You keep on conflating data protection agencies with governments. They aren't the same thing - the Garante per la Protezione dei Dati Personali is an independent administrative authority - and even the GP pointed that out.

I assure you, unless it's about multi-billion euro companies, the German state does not care at all whether they'll lose a tax payer or ten or ten thousands (source: me, a tax payer that gets fucked by the bureaucracy at every opportunity). Data Protection is taken extremely seriously and everything that is associated with "big data" is extra suspicious. Throw in "think of the children" for extra spice.

I doubt tax income on copyright dividends even registers.

Cast iron case for what?

The main argument is around GDPR which limits/bans the collection and storage of personal information without consent. They definitely did this, and it's quite clear in the law that it's unacceptable (as it should be).

OpenAI is the worst of the SV/SF "if we get big enough before we get caught it won't matter" mentality. Unsurprising given who's behind the company.

What does collection and storage of personal information mean in this case?

The model weights?

They're integers. There's no personal information stored in the model.

The fact that the model can generate someone's personal information is like saying that a person can type someone's personal information into a Word document so we should ban Office 365.

All digital data is just bytes...

>> This is not to endorse the European position - which is foolish, regressive and short sighted

Potentially, but I’m glad somebody is taking a minute to question whether or not a handful of tech companies have the right to consume everyone’s information, build their entire business with it and then sell that back to the people whose data they wouldn’t have existed without in the first place.

yes I agree that the query is not a bad thing. However, what I think is a bad thing is if the query ends up with a ban (which I think it will) and prevents the obvious value of this new class of technology for the rest of humanity

> have the right to consume everyone’s information, build their entire business with it and then sell that back to the people

That’s quite literally what google has done for 25 years, just with advertising for monetization.

Yes, and arguably Google has been way under-regulated for the externalities they caused to the system (one example is having adversarial bidding wars for companies over their own keywords, which is simply a rentier tax on Google advertising)

I think we're finally coming around on that (I think a lot of regulators were slow on antitrust in the internet space because the harm to the consumer/environment is not immediately obvious - i.e. it's mostly non-monetary externalities)

Same as America as a whole and offshoring to reduce labor cost. The externalities are slow but they're clearly there in the increasing polarization and the growth of the precariat.

It’s not. Indexing and linking to primary sources is very different to consuming all of those primary sources and spitting it back without attribution. Google entered this area a bit with the info boxes they display alongside results but it’s a very different proposition from AI.

This is an interesting point, if someone develops a card catalogue for a library, they aren't providing a market substitute for each one of those books. As far as I know, "fair use" law has to account whether or not the end product can serve as a substitute for the original work.

Fair use copyright law in the US allows for selling summaries of books, and those can serve as a substitute for the original work in many cases. Many students use Cliff Notes to get through their literature courses without ever doing the assigned reading.

https://www.cliffsnotes.com/literature

Except it was considered by most as a win-win situation. Google consumed it for the purpose of directing people to the original content (except for Google’s recent foray into info cards and quick answers within search). The info in the LLM doesn’t reference back to the source. There may be 1000 sources for a given concept embedded in the model anyhow.

And that's what no-robots was for

Exactly that. I wrote about the problem and a potential solution here for the interested

https://barac.at/essays/request-for-funding-a-business-exper...

This logic applies to nearly everything. People invent things and then sell it but the invention is not possible if they did not rely on the information they often have for free.

This is so backwards.

If you limit scraping and fair use, it further entrenches the power of the tech and content giants.

If you're upset about big tech's power and influence, you should be cheering on the free use of publicly available information, as it has the best shot at unseating that power.

I'm not sure it's "unseating". Moving from one lobe of enclosed corporate power to another doesn't help. I think this serves more to enclose that which was free, than to liberate what was closed.

>I think this serves more to enclose that which was free, than to liberate what was closed.

What has been closed? Every day there's new foundational models being released. It's exhausting trying to keep up with the pace of change - Alpaca, Vicuna, LLaMA, etc. I'd be shocked if there wasn't a truly open source foundational model with performance equivalent to OpenAI's GPT-4 by the end of the year.

Any move to limit fair-use and scraping of publicly available information through copyright laws, no matter how good of a reason it is, gives more power to the biggest companies.

> If you limit scraping and fair use, it further entrenches the power of the tech and content giants.

Explain?

Fair use has been a thorn in the side of content and publishing giants for a long time as it allows for upstarts to create derivative works and databases without violating the original copyright.

If you block fair-use and scraping, those that hold the most data and copyrights (the largest companies) will be the only ones able to create quality foundational models, thus holding the keys and further entrenching their power.

If I'm a person and I limit the way you scrape my private blog, It's not clear how I'm entrenching anyone

If it's on the internet and not behind a paywall, it's not private.

In the US, anything you create is automatically copyrighted and you have full rights to decide who does what with it, unless you explicitly waive those rights, even if you post it publicly on the Internet.

Too many people seem to think that just because something’s public it means they’re allowed to do whatever they want with it. That’s incorrect. The only barrier is whether someone you copy from is willing to bring legal action.

There are a number of exceptions to copyright, and at least in the US, the supreme court's understanding of "transformativeness" applies to chatgpt and other similar tech.

The relevant quote, originally written in 1990 and cited in 94, is thus:

" [If] the secondary use adds value to the original--if the quoted matter is used as raw material, transformed in the creation of new information, new aesthetics, new insights and understandings--this is the very type of activity that the fair use doctrine intends to protect for the enrichment of society. "

We've wandered into uncharted legal territory with only a few light posts guiding the way. Nothing about this is settled or obvious.

AFAIK, using copyrighted works for training machine learning models does not infringe on copyrights and falls under fair use.

https://www.thefashionlaw.com/ai-trained-on-copyrighted-work...

> it's not private.

Doesn't need to be private in order to be copyrighted.

I don't think anyone is arguing that copyright laws shouldn't apply to ChatGPT. In practice, I believe it's quite rare for ChatGPT to output copyrighted works but if does, the copyright holder would indeed have a claim against OpenAI for redistributing their work without permission.

That being said, this is not what the current ban is about. The ban was ordered by GDPR regulators who have suddenly decided that using publicly available information on the web to train machine learning models is not allowed due to "privacy concerns". It has nothing to do with copyright.

By this way of reasoning, if you’re going around minding your own business not having your face covered I can just take a picture of you and your face and use it to train my models? I mean, it’s out there, it’s not behind a paywall so it’s not private.

We can’t just live in a world where something is by default up for grabs by big companies just because it’s out there.

Didn’t Google become entrenched by scraping?

Scraping seems to create a few dozen winners and 99% losers from the data we have.

If anything, it's the opposite. It's the legal restrictions around scraping that have entrenched the power of the walled-gardens today.

They built their businesses on scraping, then when they had their lock-in and monopolies, they turned around and fought against scraping to keep up-starts from eroding their business.

This blog is a great overview of the current landscape around scraping laws.

https://blog.ericgoldman.org/archives/2022/12/hello-youve-be...

It doesn’t have to be all or nothing. You can regulate the big companies and leave the smaller companies unregulated. I’m not sure what regulations, if any, are necessary here but pausing to think about it when the consequences are potentially world changing seems like a good idea.

The problem is not what was scraped, but add conversation data to the training set (without obvious disclosure)

Samsung got bit by it https://twitter.com/GergelyOrosz/status/1643903974536347649

Luckily the US courts will not agree with their foolish, regressive and short-sighted European counterparts.

This is not the first time. Google built a trillion dollar business based on taking content created by people over the internet and monetizing it without prior consent of the creators. It was the largest information heist in the history of mankind.

They also tried to do the same with the book industry, fortunately publishers had money to pay for lawsuits against Google.

Exactly

Based on that, anyone who has read something on the Internet can no longer start a business?

> handful of tech companies

What about the Open Source models? What prevents the rest of the companies to innovate here?

I find any comparison between a human reading something and a model owned by a private company ingesting all the worlds information absolutely ridiculous.

It's a more advanced google search. They may not like the fact that it was built on publicly available data but pandoras box has been opened for the world and European companies will become less competitive without this valuable tool in all of their companies' tool boxes.

"It was beautiful. We were selling rich women their own fat asses back to them." -- Fight Club

At least for what Italy is concerned, the issues raised do not seem to be correlated to the training phase, but rather to the actual usage of chatGPT.

Also, based on the combination of the fact that data was made public, article 6, paragraph 1, letter f), and their business, I would argue that their use of personal data scraped on the web for training purposes is legitimate

> No consent was given by the content creators, no consultation was attempted, and certainly no share of compensation offered, for what is now a commercial enterprise

I see the argument. (I'm not sure it's the one Italy made.) Still, it's weird to see GDPR turning into a generic IP bludgeon being cheered on.

No consent was given by the content creators, no consultation was attempted, and certainly no share of compensation offered, for what is now a commercial enterprise.

But these bans are not based on potential copyright violation of content that was used to train the original model. The ban is primarily based on GDPR violations, so privacy. The ban in Italy seems to be based on three point:

- A data breach occurring on March 20.

- Mass collection of private data for training the model (not sure whether this refers to ChatGPT user queries or the original data, which could contain privacy-sensitive data, also see 'right to forget').

- No age verification.

See e.g. https://www.bbc.com/news/technology-65139406

That's not why they banned it though. If chatGPT was offered as a downloadable model which any user could run on their own machine with no internet access, there would be no basis for the ban.

When I read any of your comments, a part of it stays in mind, forever.

Does that mean I have to pay you royalties for thinking about it or mentioning it? I don't think so.

GPT is like a primitive intelligence that read a large part of the web and got influenced by it, nobody deserves compensation or consultation for the public data it was trained on.

If you put something on a public internet page, you should expect that other beings, artificial or not, are going to get influenced by it.

It’s not immoral or unethical to digest information, but the difference is when a computer can do that digesting of information the scale is very different than if a human does it and it blows up the incentives for people to create content in the first place. In the most extreme version, no human writing would be read or seen by other humans, it would be all fuel for the machine intelligence.

If that it to be our future, we have to figure out how to rearrange incentives so that humans continue to be motivated to create the content that feeds the machine intelligence or the whole system falls apart.

Does that mean I have to pay you royalties for thinking about it or mentioning it?

Yes, if HN were to post copyrighted work that only they could spread, then you would be liable. In the same trend, any patents that HN comments share should not be redistributed/sold by you.

Chatgpt circumvents copyright law in a way that is hard to detect. How many sentences of moby dick does it take to prove chatgpt is plagiarising other peoples protected works?

That is mostly not how US copyright or patent law works. Your claim just wrong. It is legal to spread limited amounts of copyrighted material under fair use, and anyone can create and sell new content based on copyrighted material as long as it is sufficiently transformative.

It's also totally legal to print out a bunch of patents and redistribute those in a book or whatever (except on certain secret patents which aren't relevant here). You can't copyright a patent filing. The only legal restrictions are on building and selling things that infringe on patent claims.

Ok but really all they had to do is add a fucking popup to ask for consent, detail what they store and how they use it

If this is "backward" and "foolish" then I'm a caveman

> If you put something on a public internet page, you should expect that other beings, artificial or not, are going to get influenced by it.

Well yes, and that's exactly why we have laws and regulation

Example: you can't just use "open source" code however you please, you have to abide by the license

I am not a lawyer, but this doesn’t seem strong at all.

How is it different than a person reading several books on a subject and giving a speech based on what they’ve learned? Obviously if the speech was repeating verbatim what was read, this would not be acceptable. But that is not the case here.

Likewise, should the authors of books a child learns to read with be able to claim copyright over all works and language the child produces afterwards simply because their material formed the basis for that child’s neural network related to reading and writing?

Not a lawyer either, but I think it's different because it's not a person...

> No consent was given by the content creators

I assumed consent was hidden deep in some ToS agreement.

Yeah, just forget llm,gpt and the fancy words for a min, you have a company it reads websites data it deems useful and creates a middle layer API to regurgitate/massage all that work back to you and charging you a fee. OpenAI deserves fee but are they forgetting where the training data came from?

For this they are right.

> which is foolish, regressive and short sighted

Yet americans constantly complain about china not honouring ip protection laws. Why should a company such as openai be allowed to steal content and then reproduce it without royalties?

> which is foolish, regressive and short sighted

Foolish and regressive because we don't want a foreign corporation to raise almost endless profit off of our data? Keep your products in the US then, nothing of value will be lost if we prevent access to Meta, Twitter and all this bullshit.

Regulating but not innovating. Always the same story, always the same result ..

You're posting that on the web (European innovation)...

Yes, the first 0.001% of the technology came from Europe. What have you done for us in this millennium?

Spotify to name one.

Spotify who set up shop in the US at the first indication of viability? Not very promising for the EU when the majority of their employees are in the US.

They were in Europe for years before moving to the States.

Also Siemens then. The European tech scene isn't as sexy, they tend to make things that are useful, not just things that get VC hype.

And now compare how many employees they have in the US vs EU.

Pretty sure they also trade on the NYSE?

I think the two biggest contributions would be RepRap giving the world open access to FDM printing, which was the catalyst for modern 3D printing, and microcontrollers like the RasberryPi and Arduino (again open).

But it's true that Europe doesn't produce massive advertisement or tech companies, largely because our consumer laws would frankly make it impossible to grow by monetizing privacy data if you also had to respect European law. The real question, is why we allow foreign companies to do so, but I'm not sure anyone really wants to discuss that in earnest.

What has anyone done apart from extract more money from thick people with addictive technology?

Cookie banners, GDPR, bans on sharing news. Is that not enough for you?

Linux

And what was Linus's next move, as soon as it became clear that he had done something important...?

Not really the point, it came from Europe.

Nobody's arguing Europe wasn't capable of innovating thirty years ago.

We don't have an economy but we have the strongest bureaucrats.

and yet, better infrastructure and common rules give better systems overall, in europe we used gsm way before the americans, and so chip credit cards, bank transfers are free (no need for paypal or anything), etc etc (just to pick some example). why this? regulation.

> bank transfers are free (no need for paypal or anything)

PayPal has 90% market share in Europe. <https://www.mordorintelligence.com/industry-reports/europe-m...>

The amount of pain in the butt coming from US readers on these news is astonishing. "sTaY In tHe mIdDlE AgEs tHeN YoU EuRoPoOr"

Apropos of nothing, I noticed French media pronounces GPT geepeetee instead of what in French should be jaypaytay. Probably because it sounds just like ‘J’ai pété’ which means ‘I farted.’ Since chat is the French word for cat, saying ChatGPT out loud,is basically saying ‘Cat, I farted’.

Hahaha, this is so funny. Thank you for sharing. See also Nvidia culitho and its meaning in Spanish.

Now OpenAI have their new mascot.

“Chat” as in “internet discussion” is pronounced the same way in French as in English, as it is an English loan word, and not like “Chat” as in “cat”.

I'm happy to see that even people on HN, a space supposedly for tech-oriented people, have exactly zero clue about the difference between chatGPT, GPT itself and a generic LLM. But here you are pretending you know stuff while you try to lecture Europeans on what's best for us.

This place has become a parody of itself.

The same way Europeans are always lecturing Americans on what's best for us, or different?

I come on this site to learn about new tech and to generally be informed about what’s going on in tech and tech adjacent topics.

Comments are usually great but I can’t help but notice that every time an article like this one is posted the discussion quickly degenerate into either a contest of who’s better at something between countries, which is completely idiotic, or a silly subtle flame war.

Goes to show that even in places where people are smart and can be nuanced, discussions that involve national identities are hard to handle.

Personally, I think it’s ok for different countries to deal with the same issues differently.

I’m fine with the US (or California if we’re being honest here) pushing for new technologies and being in the forefront.

And I’m fine with the EU being more considerate when it comes to their approach to pretty much everything. Everything has pros and cons.

I just find it interesting that no matter the platform, certain topics seems to always pull out the worst attitude in people.

Truth be told, The EU-peeps where often correct ...

I’m curious at what point we’ll get the first mid-sized or larger company - someone without a physical presence in Europe - simply shrugging their shoulders at EU regulators.

Given the rapid expansion of EU regulation of tech in recent years, it can’t be that far off. I’m curious what happens next!

If they continue to violate EU law beyond the reach of enforcement, the fines and interest on fines builds up in abstentia. This remains as an ongoing liability. If they were ever to be acquired by a corporate with a presence in the EU, it would inherit that liability and be forced to pay or exit the EU.

The net market value of the original transgressing company, as seen by any potential acquirer with a global presence (so probably all of them) therefore drops steadily ... eventually well into the negatives. This will severely impact the listed market cap even if the company is not looking to ever be acquired.

If sufficiently provoked, the EU could also issue sanctions against any other company doing business with them in the mean time.

Eventually most first-world banks are loath to touch the business.

Things decline from there ...

> If they were ever to be acquired by a corporate with a presence in the EU, it would inherit that liability and be forced to pay or exit the EU.

Absolutely, but that wouldn't really affect the vast majority of smaller or mid-sized businesses in the US and China (and elsewhere). Not everyone is looking for an exit. You're absolutely right for major public companies, and I doubt we'll see them doing anything like this. (Though eventually some could withdraw from Europe altogether if it ceases to make economic sense to be in compliance.)

> If sufficiently provoked, the EU could also issue sanctions against any other company doing business with them in the mean time.

Hmm, this seems fairly unlikely for a smaller or mid-sized business. Possible, certainly, but unlikely.

> Eventually most first-world banks are loath to touch the business.

This one though, I very much doubt. Why would a regional US bank refuse to lend to a local mid-sized B2B supplier with good credit and in good standing, just because the Latvian privacy authority is upset with them for practices that are entirely legal and ordinary in the US?

More broadly though, I am genuinely curious where one would draw the line on foreign compliance. Any business anyone starts is presumably out of compliance with North Korean law, but (understandably) this is kind of just ignored. What about Tajik law though? Or South African law? I presume there's a balancing act involved with these decisions, but say there is a hypothetical Chinese entity that just doesn't have very much exposure to EU markets: getting them to comply with (potentially onerous) EU regulations could become an increasingly hard sell.

I'm not saying this is a desirable outcome, to be clear, I just wonder at what point the incentives will cease to align and we'll begin to see more non-compliance by non-EU entities with EU regulation.

> This one though, I very much doubt. Why would a regional US bank refuse to lend to a local mid-sized B2B supplier with good credit and in good standing, just because the Latvian privacy authority is upset with them for practices that are entirely legal and ordinary in the US?

A bank would be hesitant (but not necessarily totally unwilling) to loan money to a business if the EU (not if it's just Latvia) has a massive outstanding financial claim against it as there is an increased risk of a situation where the business uses bankruptcy law to discharge it's liabilities ... and, as mentioned some merger/acquisition paths are blocked ... it's a risk thing, and it depends on the business, but it's baggage you really don't want.

> More broadly though, I am genuinely curious where one would draw the line on foreign compliance. Any business anyone starts is presumably out of compliance with North Korean law, but (understandably) this is kind of just ignored. What about Tajik law though? Or South African law? I presume there's a balancing act involved with these decisions, but say there is a hypothetical Chinese entity that just doesn't have very much exposure to EU markets: getting them to comply with (potentially onerous) EU regulations could become an increasingly hard sell.

Ultimately it comes down to power plays between major trading blocks with agreements to respect each others laws to some degree, so Tajik or South African law can be largely ignored, China less so, USA or EU even less.

We're already seen what it looks like, i.e. when the USA would sanction foreign businesses that dealt with Iran.

Now the USA has weakened and can't play globocop anymore, these days it's a 3 way standoff between the USA, EU and China ... less unilateral, more haggling.

seems reasonable

if there's ANY PII at all in the training set then the weights and any output should be treated as PII too

of course the only way to verify that a model doesn't contain PII is to provide the entire training set and the process for turning it into a model

and opening up this data would completely destroy any economic benefit that could be gained from exploitation of the model

which in turn completely destroys any incentive to create it in the first place

what a pity

I bet they will still continue to hoover up all kinds of data from Europe, either directly or via common crawl. So these "bans" seem really tough to enforce, they may end up in a disadvatageous situation where openai is banned from usage by EU citizens, but the european data is still collected for training, daily by the terabyte.

PS it's kind of hilarious we're in the land of internet bans in the west now, eu bans openai, us bans tiktok, full speed ahead towards censored walled gardens.

It will be a risk for companies that do operate in the EU though, like Google and Microsoft. Even if they'd sell their LLM-enabled products outside the EU, they could still be fined for using EU citizen data unauthorized. And this seems nearly impossible to untangle. Like, how do you know on a content-generating site which posts were written by EU citizens and which weren't? Exposing that information alone could be a privacy violation.

Actually, there's two interesting things:

1. it shows that Europe is starting to act "as a whole" : Italy used RGPD to ban ChatGPT (whatever the motivation) so every counrty in EU has to think about it and ban it too

2. what some people call "regressive legislation" is the legislation that want to stop IA from using any sources to build without paying the content creator for it... And if I remember correctly, nobody is pretending that it's fair

Right or wrong this is just going to lead to others taking the lead and accelerating away in this technology.

Url changed from https://stealthoptional.com/news/italys-chatgpt-ban-spreads-..., which points to this.

Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter."

https://news.ycombinator.com/newsguidelines.html

Italy has not banned ChatGPT: that would be accomplished by a DNS-level block on national ISP resolvers that has not been applied, which would be trivially circumvented by using an unaffected DNS resolver.

Rather, OpenAI has decided to respond to an injuction to stop processing Italian PII within 20 days by immediately configuring their Cloudflare account to block connections from IPs where the GeoIP lookup resolves to Italy, which is easily circumvented by a VPN or proxy.

It kind of makes sense for Italy and possibly France to ban it in terms of the culture of those countries which have always stuck two fingers up at what everyone else is doing in favour of their own approach to life. I’m quite surprised Ireland and Germany are taking this approach though, particularly the former where the tech industry is providing a substantial amount of the high paying jobs in the economy.

Except none of the mentioned countries has banned it (except Italy, of course)

Title is clickbait, those countries are considering the privacy implication of it

Very clickbait-y title. It is not clear that any other county's data privacy agency is considering a ban. It has become apparent that they are following up with their Italian counterparts. Something that if you put in one sentence seems blatantly obvious.

"Several other European data privacy agencies follow up with Italian data privacy agency after Chat GPT ban."

This is a really interesting thread to read as a lawyer who spends his days (recently) considering how existing laws apply to AI training and operation.

I'll start by describing my understanding of the allegation, and then talk to some points raised.

I don't read Italian, but the English-language statement by Garante (Italy) is here. [0]. It appears to allege both that the original training (creation of the model) and the ongoing improvement via customer Inputs was done without a "legal basis." GDPR requires companies to have a "legal basis" for processing personal data before they do so -- whether that be from consent, or a legitimate interest (very vague), or for a task carried out in the public interest.

Italy isn't going into details, but saying they're banning while they investigate.

Some interesting questions raised in the thread: does the model actually contain personal data? Probably yes. Even if data is converted to integers during training, since those integers can be reversed into personal data, GDPR counts it as "pseudonymized" not "anonymized," and therefore subject to GDPR.

Did OpenAI actually not get consent? It seems to me they did obtain consent for using user inputs for training, since their terms of service plainly state they will use inputs for training data. But GDPR likes to demand higher standards of consent (checkboxes) and as far as I know OpenAI didn't use checkboxes.

I think this is pretty interesting to watch play out.

[0] - https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d...

Finally some facts - the rest of the thread is wild speculation and blind judgement. Yes, few countries lose access to strongest available LLM while the investigation is undergoing. There are bigger things at stake.

I don't think this is about current model containing personal data. IMO this is about "Open"AI operation, a US based company (with US lack of regulation and disregard for user privacy) collecting the data about the rest of the world. And we are talking about _very_ personal data. The kind of data people would be reluctant to share even with their doctors and psychologists, but will still mention to the non-judgemental chatbot with a memory they can seemingly wipe at will. This is potentially dangerous. Governments should at least investigate how this data is collected and used. The funny thing is, both sides of Atlantic benefit when EU is enforcing the GDPR.

Italy, France, Germany... that's already a big enough market for a more ethical competitor to step in and provide an alternative LLM. We desperately need another player in this field. (BTW, please sign the LAION's petition to democratize the AI research)

But in reality, there is a lot of fear of job replacement and this will stem their fears, it’s inevitable because when another country uses it to their advantage, it won’t feel good

So access to the system is blocked from these countries, but it continues to utilize the problematic data to server customers in other countries?

Not sure if this is really the best approach.

As long as bing is still online, I'm fine. Chatgpt is basically useless for me since it can't actually look anything up and read docs.

And so you get into a flying car, pay for rent with crypto, command ChatGPT to write a new great novel, but this hype will end.

They couldn't even get the bloody cookie law right.

Good luck banning a text interface. Christ, we could probably proxy it over morse code.

> They couldn't even get the bloody cookie law right.

What are you talking about?

> Good luck banning a text interface. Christ, we could probably proxy it over morse code.

Yes. You could. How many people have the know-how to do that, though? How many of them have an ham radio license? How many of them would be willing to deal with the eventual consequences of getting caught breaking the law?

That european regulations on tech are generally ill thought out nonsense that fall apart as soon as it hits the real world.

Is this the beginning of the Butlerian Jihad?

>> tech news outlet Reuters (from the article)

Was this articlr writen by ChatGPT itself? It sure reads like it...

Worse. It was written by a low-quality content mill that is one step above spam.

The Germany 'ban', for example? A German newspaper asked the Federal Commissioner if it could be blocked, and he answered "In principle, it could be", then followed with a bunch of boring nuanced qualifications that nobody wants to read, like the fact that in Germany this would be a state-level decision, or that they have just asked the Italian authorities for more information.

https://www.handelsblatt.com/politik/deutschland/nach-vorsto...

A couple of rounds of 'journalist' telephone game later, and it has become "ChatGPT Ban Spreads to Germany". Utter trash.

I think banning it is incredibly stupid. But if Europe wants to stay in dark ages it is their choice.

To use an Italian proverb, "the mother of fools is always pregnant".

tbf that's actually my biggest concern too. make it run on an offline personal pocket calculator, please

So Europe is basically being denied access to what is possibly paradigm-shifting technology because a few bureaucrats decided to.

A quick reminder of what GDPR proponents were saying in 2018:

> Thank you for teaching me about rules-based and principles-based regulation. This is one of the big reasons I enjoy living in Europe tbh, a bit of discretion and old 'common sense' is actually quite an awesome thing.

> However, after the initial bring-up pains any business which continues to have a problem with the GPDR most likely has a business model directly in conflict with the spirit of the law.

> Customers are going to have a choice between GDPR-compliant companies and USA-only ones and (if they care) they are going to assume the worst about why the GDPR can make a company retreat from the EU market.

> The GDPR gets so much hate because it hits so many businesses where it hurts: data. [...] Of course that's annoying from a business perspective, but from an individuals privacy perspective, it's fantastic.

> One surprising side effect of this might be that the hordes of machine learners and data scientists who used to work for adtech might go to healthcare/bioinformatics where we might get new breakthroughs.

https://news.ycombinator.com/item?id=17060085

https://news.ycombinator.com/item?id=17099484

Here's my prediction: VPN sales through the roof in Europe.

That last one is golden.

great, maybe these politicians will finally get voted out

Europe has GDPR laws to protect user rights and privacy. ChatGPT was not complying hence it was banned until they comply.

EU’s position will have zero impact on progress of AI, they’ll regress into ever increasing socialist state. If I were a EU citizen, I would fear the disadvantage of being left behind without the most powerful innovation of our times.

Europe is doing the right thing, gen AI can be a massive productivity boon but regulators coming in to ensure that the wealth created goes to the people instead of centralized foreign entities is definitely a good thing. In the space left by ClosedAI open source and locally run versions can flourish instead.

While this is a legitimate consideration, what EU regulators are doing right now is a step behind: they're trying to ensure that European data doesn't get syphoned out for shiny baubles again.

Anybody setting up an European chatGPT would be golden for the moment, even if it introduced back the same centralization of wealth.

To ensure that the wealth doesn't go to foreign entities, they could create a CERN-like organization and fund AI/ML research, with the short term focus on LLMs.

What they are ensuring is that the jobs would go to countries that have 10x productivity (or whatever productivity gain we will get). Quite opposite to ensuring that the wealth accumulates among workers.

Reply on news.ycombinator.com