Italian Regulator Fines Replika for Data Privacy Failures
Italy's data protection authority fined Luka Inc., which operates the Replika AI chatbot, €5 million for privacy violations including lack of age verification and inadequate privacy policies. The regulator has opened a new investigation into the AI model's training methods and data handling practices.
What happened
The Italian Garante per la protezione dei dati personali (data protection authority) imposed a €5 million fine on Luka Inc., the company operating the Replika AI chatbot, in May 2025.
The regulator found violations of data protection requirements including absence of effective age verification mechanisms and inadequate privacy policy provisions, despite the platform declaring it did not permit access to minors. The platform enabled minors to access sexually explicit content.
The Garante opened a new investigation into the AI model's training methods and data processing practices across the full lifecycle of the generative AI system, including data types used, risk assessments, and anonymization measures applied during model development and training.
Reported impact
The chatbot, which offers users the ability to generate virtual companions configured as confidants, therapists, romantic partners or mentors, had been subject to a blocking order issued by the regulator in February 2023.
Index analysis
The investigation focused on data handling and protective safeguards in model development, examining what data categories were used to train the generative language model underlying the service and whether appropriate pseudonymization or anonymization measures were implemented.
Governance controls
The regulator found that Luka Inc. failed to implement age verification controls required under data protection law, and provided a privacy policy that was inadequate across multiple dimensions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.