The Personal Information Protection Commission (PIPC) of Korea is responding to the rapid expansion of generative AI services by strengthening privacy policy standards. On March 4, 2025, PIPC convened a roundtable with major domestic and international AI companies and experts to discuss improvements in privacy policy transparency. The meeting focused on addressing gaps in clarity, legal grounds, and user accessibility in current privacy practices. This initiative is part of ongoing efforts to ensure responsible data handling and build public trust in AI technologies.
The policy changes directly impact generative AI companies such as Google, Meta, Microsoft, OpenAI, Naver, Kakao, SK Telecom, LG Uplus, NCAI, Scatter Lab, and Rytan Technologies, as well as their users. Evaluations revealed shortcomings in how companies disclose data categories, legal bases for processing, retention periods, and third-party sharing. Some services used vague language or required complex steps for users to access privacy policies, making it difficult for individuals to understand or exercise their rights. The new guidelines aim to address these issues by requiring clearer, more specific disclosures and improving accessibility.
Implementation began with a comprehensive evaluation in 2024, where the average score for privacy policy quality was 57.9 out of 100 across seven sectors. After intensified guidance and corporate engagement, the 2025 evaluation showed improvement, with an average score rising to 71. The PIPC plans to publish revised privacy policy guidelines and hold explanatory sessions in April 2025 to help companies adapt. These actions are designed to ensure that generative AI providers meet higher standards for transparency and user protection.
Frequently asked questions include: What are the main shortcomings in current generative AI privacy policies? Many policies lack specificity regarding data categories, legal grounds, and retention periods. How will the new guidelines help users? The guidelines will require companies to provide clearer, more accessible information, making it easier for users to understand and manage their personal data. What is the timeline for these changes? Revised guidelines and explanatory sessions are scheduled for April 2025, with ongoing support for companies to implement improvements.
The Personal Information Protection Commission’s policy initiative is a timely response to the challenges posed by generative AI services. By focusing on transparency and accessibility, the Commission is setting a higher standard for privacy protection. The improvement in evaluation scores indicates that companies are responding positively to guidance. Continued engagement and clear timelines will be essential for maintaining momentum and ensuring that users benefit from more understandable and trustworthy privacy policies.