The encyclopedia · Legal & Compliance · Legal decision · 2025
Italy fines Replika's maker €5 million over GDPR and children's data
Luka's Replika chatbot ran with no effective age check and thin privacy notices, so Italy's Garante fined it €5m and opened a separate AI-training probe
Luka · 2025-04-10
What happened
On 10 April 2025 Italy's data-protection authority, the Garante, fined Luka Inc — the US developer of the Replika AI companion chatbot — €5 million for breaching the GDPR. The decision was announced on 19 May 2025.
The Garante found no valid legal basis for how Replika processed personal data (Article 6) and that its privacy notices failed to set out what data was collected, for what purpose and who received it (Articles 12–14).
It also found the service had no effective age-verification, even though it claimed to be for adults only. Because minors could sign up, the Garante found they were left exposed to a chatbot that reportedly carried on explicitly suggestive and psychologically manipulative conversations; the age gate Luka later added was still deficient.
Luka was also told it could not rely on consent that users had never been properly informed to give. Separately, the Garante opened a new investigation into how the AI model behind Replika was trained.
Why it happened
- Luka let an emotionally intimate AI companion run with no workable age check, betting that an '18+' label meant children would not show up
- With no clear legal basis and a privacy notice that hid the basics, the company made users' trust the whole defence — and the regulator was never going to accept it
The lesson
An 'adults only' label is not a safeguard: if nothing stops a child from signing up, the regulator treats the product as aimed at children, and weak consent will not survive that test
Aftermath
The Garante imposed the fine and reserved a separate proceeding on the legal basis for the data processing across the whole life cycle of the generative AI system. Luka can appeal in the Italian courts.
Sources
- CommLaw Group — US-based AI developer fined €5 million for GDPR violations: key takeaways
- The Leveraged Years — Italy's Garante fines Replika maker Luka €5 million
spotted an error? The club wants to know.
More like this
Amazon's €746M GDPR record fine was scrapped on a technicality
AliExpress got a €550M EU fine — the DSA's first big test landed on Alibaba
Meta offered EU users only a binary 'consent or pay' choice — €200M DMA fine
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.