Snapchat could face a fine of millions of pounds after the UK data watchdog issued it with a preliminary enforcement notice over the alleged failure to assess privacy risks its artificial intelligence chatbot may pose to users and particularly children.
The Information Commissioner’s Office (ICO) said it had provisionally found that the social media app’s owner failed to “adequately identify and assess the risks” to several million UK users of My AI, including among 13- to 17-year-olds.
Snapchat has 21 million monthly active users in the UK and has proved to be particularly popular among younger demographics, with the market research company Insider Intelligence estimating that 48% of users are aged 24 or under. About 18% of UK users are aged 12 to 17.
“The provisional findings of our investigation suggest a worrying failure by Snap [the parent of Snapchat] to adequately identify and assess the privacy risks to children and other users before launching My AI,” said John Edwards, the information commissioner.
The ICO said the findings of its investigation were provisional and that Snap has until 27 October to make representations before a final decision is made about taking action.
“No conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that an enforcement notice will ultimately be issued,” the ICO said.
If a final enforcement notice is issued, Snap will be forced to stop processing data in connection with My AI, meaning it will have to be blocked for UK customers until the company carries out an “adequate risk assessment” of the service.
While the ICO’s priority is to stop any potential privacy breaches and ensure My AI is compliant, it also has the power to levy a fine of up to 4% of global turnover – Snap made $4.6bn (£3.8bn) in global revenues last year – or a maximum of £17.5m.
The My AI service is powered by OpenAI’s GPT technology, which has been at the vanguard of the global artificial intelligence arms race, and its launch marked the first example of generative AI being embedded in a major messaging platform in the UK.
“We have been clear that organisations must consider the risks associated with AI, alongside the benefits,” said Edwards. “Today’s preliminary enforcement notice shows we will take action in order to protect UK consumers’ privacy rights.”
Snap launched the My AI feature for users of Snapchat+, the social media site’s subscription service, in February. It was rolled out to its entire user base in April.
“We are closely reviewing the ICO’s provisional decision,” said a Snap spokesperson. “Like the ICO we are committed to protecting the privacy of our users.
“In line with our standard approach to product development, My AI went through a robust legal and privacy review process before being made publicly available. We will continue to work constructively with the ICO to ensure they’re comfortable with our risk assessment procedures.”
