Mistral AI Faces Data Privacy Controversy Over Chatbot ‘Le Chat’

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Mistral AI has been accused of exploiting users' personal data without proper consent mechanisms. A complaint was filed with France’s CNIL over the absence of opt-out options in the free version of its AI chatbot, 'Le Chat', raising serious concerns about its adherence to data protection laws and user privacy.[AI generated]

Why's our monitor labelling this an incident or hazard?

The report describes a real complaint filed to the French data protection authority (CNIL) alleging that an AI system (Le Chat) actively exploited personal data without proper consent, constituting a violation of users’ fundamental privacy rights under applicable law. This is a concrete AI‐driven harm (GDPR violation), so it qualifies as an AI Incident.[AI generated]
AI principles
Privacy & data governanceRespect of human rightsTransparency & explainabilityAccountability

Industries
Consumer servicesMedia, social platforms, and marketing

Affected stakeholders
Consumers

Harm types
Human or fundamental rightsReputational

Severity
AI incident

Business function:
Citizen/customer serviceResearch and development

AI system task:
Interaction support/chatbotsContent generation


Articles about this incident or hazard

Thumbnail Image

RGPD : Mistral AI accusé d'exploiter illégalement les données personnelles de ses utilisateurs

2025-02-12
Le Figaro
Why's our monitor labelling this an incident or hazard?
The report describes a real complaint filed to the French data protection authority (CNIL) alleging that an AI system (Le Chat) actively exploited personal data without proper consent, constituting a violation of users’ fundamental privacy rights under applicable law. This is a concrete AI‐driven harm (GDPR violation), so it qualifies as an AI Incident.
Thumbnail Image

Mistral AI : la startup épinglée pour sa gestion des données personnelles

2025-02-13
L'Éclaireur Fnac
Why's our monitor labelling this an incident or hazard?
Mistral’s AI chatbot is being used in a way that likely breaches users’ data-privacy rights under GDPR—charging to disable automatic learning from user inputs—constituting an active violation of fundamental rights (personal data protection). This is a realized harm linked directly to the AI system’s data-handling practices, and a complaint has been filed as a result. Therefore, it is an AI Incident under the category of rights violations.
Thumbnail Image

La start-up française Mistral (Le Chat) dans la tourmente pour entorse présumée au RGPD

2025-02-12
Frandroid
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (the chatbot 'Le Chat') whose use has led to a legal complaint for violating data protection laws (GDPR). This constitutes a breach of obligations under applicable law intended to protect fundamental rights, specifically privacy rights. Since the complaint is active and alleges harm through unlawful data processing, this qualifies as an AI Incident under the framework, as the AI system's use has directly led to a violation of rights.
Thumbnail Image

Oui, le Chat de Mistral AI sait où vous vous trouvez (tout comme ChatGPT et Gemini)

2025-02-12
Numerama.com
Why's our monitor labelling this an incident or hazard?
The event involves an AI system (Le Chat by Mistral AI) that uses IP addresses to infer user location and tailor responses, which is a form of AI system use. The lack of transparency and insufficient user control over personal data processing leads to a legal complaint alleging violation of data protection laws (GDPR), which protect fundamental rights. This constitutes a breach of obligations under applicable law intended to protect fundamental rights, meeting the criteria for an AI Incident. The article also references similar practices by other AI chatbots but focuses on Mistral AI's specific shortcomings and the legal challenge, indicating realized harm in terms of rights violations rather than just potential or general concerns.