Facts
As generative AI services spread quickly and privacy concerns grew, PIPC began a preliminary inspection of major LLM-based AI services in November 2023 with the Korea Internet & Security Agency (KISA). At its 6th plenary meeting of 2024, on 27 March 2024, it considered the results for OpenAI, Google, Microsoft, Meta, Naver and Wrtn. The providers generally met basic legal requirements, such as publishing privacy policies, preprocessing data and guaranteeing data subjects' rights. However, public web data used for training could contain Korean residents' resident registration numbers and credit card numbers. According to press reports of the figures, KISA had detected identifiers such as resident registration and passport numbers exposed on 20,999 web pages in 2023.
What was the legal question in OpenAI, Google, Microsoft, Meta, Naver and Wrtn (preliminary inspection of AI services)?
The inspection was not a sanction proceeding over a specific breach. It examined how personal data is handled at each stage of an AI service: whether identifiers are removed from training data before pre-training, and how users' questions and the model's answers are used. Providers turned out to have staff read and correct conversations to build training datasets, often without users being able to tell. Services built on the same model applied different safeguards for personal, children's and sensitive information, and vulnerabilities in open-source and replica models were hard to fix quickly.
What did the Personal Information Protection Commission (PIPC) decide?
PIPC resolved to issue improvement recommendations to the six providers. They were asked to step up removal of key identifiers, such as resident registration numbers, from training data, with PIPC planning to share URLs of exposed Korean data for use at the pre-training stage. They were also asked to tell users clearly when people review their inputs and to make inputs easy to delete; to describe AI-related processing in more detail in privacy policies; to provide a function for reporting inappropriate answers; and to set up a process for fixing vulnerabilities quickly. OpenAI, Google and Meta were found to exclude sites that aggregate personal data and to stop models from disclosing it, but not to remove identifiers sufficiently.
Why does OpenAI, Google, Microsoft, Meta, Naver and Wrtn (preliminary inspection of AI services) matter?
The recommendations turn general data protection rules into concrete expectations for each stage of an LLM service, from training data to user conversations, addressed to named companies. PIPC described the exercise as the first use in the private sector of the preliminary inspection procedure introduced by an amendment to the Personal Information Protection Act. An improvement recommendation is not a fine, so its effect depends on how providers change their practices. A NewDaily review in August 2026 found that human review of conversations remains possible at OpenAI, Google, Microsoft and Meta, although disclosures about it have become more specific.
Related stages
According to the same NewDaily review, Naver's CLOVA X service closed on 9 April 2026. The review was the newspaper's own; no PIPC re-inspection was found. PIPC measures against individual AI providers, including the 2023 fine on OpenAI for late notification of a ChatGPT data leak and the 2025 corrective recommendation to DeepSeek, are covered in separate entries.