ChatGPT Privacy Complaint: Why AI ‘Hallucinations’ Just Got Serious

What’s Going On With ChatGPT Now?

A new privacy complaint just landed in Europe—and it puts OpenAI’s ChatGPT under serious scrutiny. The issue? The AI chatbot allegedly generated false and potentially defamatory information about a real person. This isn’t just another case of a chatbot getting something wrong—it’s a legal and privacy red flag.

The complaint, filed with the Polish data protection authority, claims that ChatGPT produced incorrect personal details about a public figure and then failed to correct or erase that data when requested. That raises major questions about how generative AI handles personal information, and whether tools like ChatGPT are complying with data protection laws like the GDPR.

This blog breaks down what happened, why it matters, and what it could mean for the future of AI, privacy rights, and legal accountability.

What the Complaint Is About

In March 2025, a Norwegian individual named Arve Hjalmar Holmen discovered that ChatGPT had generated a fabricated narrative falsely accusing him of murdering his two sons and attempting to kill his third. This fictitious account alarmingly included accurate personal details, such as his hometown and the number and gender of his children, making the falsehoods particularly damaging.

This incident highlights the dangers of AI generating incorrect data, which can have severe consequences for individuals.

Supported by the privacy advocacy group noyb (None of Your Business), Holmen filed a formal complaint with the Norwegian Data Protection Authority. The complaint alleges that OpenAI’s ChatGPT violated the General Data Protection Regulation (GDPR).

The complaint outlines several core issues tied to how ChatGPT handled Holmen’s personal data, including:

• Generating false and defamatory outputs: The AI produced a completely fabricated story implicating Holmen in serious crimes he did not commit.
• Lacking transparency: OpenAI failed to provide insight into how such inaccurate information was generated or sourced.
• Failing to uphold data rights: Upon discovery of the false information, there was no accessible mechanism for Holmen to correct or have the inaccurate data deleted

What Are AI ‘Hallucinations’ and Why Do They Matter?

In the world of AI, a “hallucination” isn’t a glitch—it’s when a language model like ChatGPT generates information that sounds convincing but is factually wrong or entirely made up.

This happens because tools like ChatGPT don’t “know” facts in the way humans do. They’re trained to predict the next word based on patterns in data, not to verify the truth. That means even when a response sounds accurate, it might be completely false.

Why it matters:

• False claims can spread easily and be taken as fact—especially when they look polished and professional.
• Reputational harm is real. If an AI invents a criminal charge or misquotes someone, it can seriously damage that person’s public image. Individuals can easily suffer reputational damage when AI-generated content falsely labels them or provides incorrect biographical details.
• No built-in fact-checking means the burden is often on users to verify what AI says—something many people don’t realize they need to do.

The Privacy Angle: Why the Norwegian Data Protection Authority and GDPR Are Involved

The General Data Protection Regulation (GDPR) is Europe’s strongest data privacy law. It gives EU citizens the right to know what personal data companies hold about them—and to correct or delete it if it’s wrong.

The recent complaint against OpenAI argues that ChatGPT violated those rights by generating false personal information and failing to fix or remove it when requested. According to the filing, the platform didn’t provide clear answers about how the data was sourced or how a correction could be made. The risks are particularly high for showing ChatGPT users, as the AI can generate alarming inaccuracies that affect their reputations.

This raises bigger questions:

• If an AI creates inaccurate data about someone, who’s responsible?
• Should companies be forced to build tools that let users fix or remove hallucinated content?
• How do we handle personal data in systems where content is generated, not stored?

Under GDPR, accuracy and transparency aren’t optional—they’re legal requirements. This case could set a major precedent for how generative AI tools like ChatGPT are regulated going forward.

What OpenAI Has Said (and Not Said)

As of now, OpenAI hasn’t issued a public comment specifically addressing the complaint filed in Norway. However, the company has previously acknowledged that language models like ChatGPT can generate inaccurate or misleading content, commonly referred to as “hallucinations.”

OpenAI’s public stance has emphasized:

• Transparency about limitations – The company warns users that ChatGPT responses may be incorrect or outdated and encourages independent fact-checking. However, critics argue that a tiny disclaimer stating the AI can make mistakes is insufficient to address the legal obligations under GDPR.
• Ongoing safety updates – OpenAI regularly updates its models with safety mitigations, but admits that hallucinations remain a known challenge.
• User control tools – While users can rate outputs or provide feedback, there’s currently no built-in way to correct or remove false personal information generated by the model.

The silence around this specific GDPR complaint has raised concerns, especially among privacy advocates, about how OpenAI plans to handle personal data rights in jurisdictions with strong privacy laws. Without meaningful redress mechanisms, critics argue that generative AI risks violating basic standards of data accuracy and accountability.

What This Means for Users: Efforts to Eliminate Inaccurate Result

If you’re using AI tools like ChatGPT, here’s the bottom line: don’t assume everything it says is true—especially when it involves real people.

Right now, there’s no reliable way to correct or erase false information generated about you. If an AI creates a made-up claim tied to your name, there’s no simple “edit” button—and that can have real-world consequences, from reputational harm to misinformation spreading online.

This is especially important when using AI for:

• Researching public figures or private individuals
• Drafting bios, summaries, or legal content
• Exploring sensitive or identity-related topics

Until stronger safeguards are in place, users should approach AI-generated content with caution and critical thinking. It’s a powerful tool—but not a flawless one.

The Bottom Line: Risks of Defamatory Output

This privacy complaint against ChatGPT isn’t just about one false response—it’s about what happens when an AI model is allowed to produce defamatory results using personal data, and no one is held accountable.

As AI companies scale their reach and online search capabilities, the pressure is growing for stronger regulation, clearer transparency, and enforceable user rights. Tools like ChatGPT can be incredibly useful—but if they spread false information without offering a way to fix it, that’s a serious problem under European privacy law.

Expect more global scrutiny, especially from data protection lawyers and privacy regulators like Norway’s Data Protection Authority and others across the EU. At the same time, developers and lawmakers will need to address how to prevent similar violations, enforce accuracy standards, and define a proper legal basis for handling personal data—because right now, that foundation is missing.

For everyday users, this case is a reminder: use AI carefully, question its outputs, and think twice about what personal information you share. Privacy isn’t just a tech issue—it’s a trust issue.