Snap AI chatbot scrutinized by UK watchdog over how it processes kids’ data

The British data privacy authority on Friday announced a preliminary enforcement notice against the American camera and social media company Snap Inc. for potentially failing to adequately assess the privacy threat posed by “My AI,” a generative AI chatbot embedded in its app.

The Information Commissioner’s Office (ICO), which also helps enforce the European Union's General Data Protection Regulation (GDPR), noted that Snap’s data protection risk is particularly significant because of how “My AI” processes the data of children between the ages of 13 and 17.

A preliminary notice alerts a company to what actions the ICO will mandate depending on its response. If a final enforcement notice is adopted, the ICO could require Snap to stop processing data connected to “My AI” in the United Kingdom, according to an authority press release.

If that were to happen, Snap could not provide UK users the ‘‘My AI” product until it properly assessed its risks.

“We are closely reviewing the ICO’s provisional decision,” a Snap spokesperson said via email. “Like the ICO we are committed to protecting the privacy of our users.”

The spokesperson added that “My AI” went through a “robust legal and privacy review process before being made publicly available.”

UK Snapchat+ subscribers were first offered the “My AI” product in February, the ICO press release said, describing its chatbot feature as “the first example of generative AI embedded into a major messaging platform in the UK.” The product was made available to the entire Snapchat user base in April.

The feature relies on OpenAI’s GPT technology.

As of May, Snapchat had amassed more than 21 million monthly active UK users, the release said.

The release noted that the findings are provisional and said “no conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that an enforcement notice will ultimately be issued.”

The ICO said it will “carefully consider” Snap’s response before issuing a final enforcement notice.

“The provisional findings of our investigation suggest a worrying failure by Snap to adequately identify and assess the privacy risks to children and other users before launching ‘My AI,’” John Edwards, UK Information Commissioner, said in a statement.

The release said the preliminary notice should remind organizations developing or using generative AI that they “should be considering their data protection obligations from the outset.”