Snap’s AI chatbot has come under the scrutiny of the UK’s data protection watchdog, raising concerns about potential privacy risks to children. The Information Commissioner’s Office (ICO) has issued a preliminary enforcement notice to Snap, expressing worries that the company may not have adequately assessed the privacy risks associated with its generative AI chatbot called ‘My AI.’
The ICO’s action does not indicate a breach but suggests that the UK regulator has doubts about Snap’s compliance with data protection regulations, especially the Children’s Design Code introduced in 2021. The ICO stated in a press release that its investigation preliminarily found that Snap’s risk assessment before launching ‘My AI’ did not sufficiently evaluate the data protection risks posed by the generative AI technology, particularly concerning children aged 13 to 17.
Snap will have the opportunity to address the regulator’s concerns before the ICO makes a final decision on whether the company has violated the rules. Information Commissioner John Edwards expressed concern over Snap’s failure to properly identify and assess privacy risks, emphasizing the need for organizations to consider both the benefits and risks associated with AI.
Snap introduced the generative AI chatbot in February, later expanding access to free users. While the company implemented moderation and safeguarding features, reports emerged of the chatbot making inappropriate recommendations and facing bullying from Snapchat users.
In response to the ICO notice, a Snap spokesperson stated their commitment to user privacy and mentioned that ‘My AI’ underwent a rigorous legal and privacy review before becoming publicly available. Snap intends to collaborate with the ICO to ensure compliance with risk assessment procedures.
This incident is not the first involving AI chatbots and European privacy regulators. Italian authorities ordered the cessation of data processing for Replika and OpenAI’s ChatGPT due to concerns about minors’ safety. Google’s Bard chatbot also faced delays and scrutiny from privacy regulators in Europe, leading to enhanced privacy disclosures and controls. Poland’s data protection authority is also investigating a complaint against ChatGPT.
