Facts
Replika is a chatbot with written and voice interfaces, developed by the US company Luka Inc. and built on a generative AI system using a large language model. Users can set up a 'virtual companion' as a friend, therapist, romantic partner or mentor. The Italian Data Protection Authority (Garante) opened an investigation of its own motion after press reports and, on 2 February 2023, temporarily restricted the processing of Italian users' data because of the risks to minors and emotionally vulnerable people. The investigation focused on the privacy policy, the legal bases for the processing and the age verification system.
Question
The authority examined whether Luka had identified a legal basis under Article 6 of the General Data Protection Regulation (GDPR) for each processing operation carried out through Replika, whether the privacy policy met the transparency requirements of Articles 12 and 13, and whether the company, which claimed that minors were excluded from the service, had an effective age verification mechanism to ensure this. It also assessed compliance with accountability (Article 24) and data protection by design (Article 25).
Decision
The Garante found infringements of Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24 and 25(1) GDPR. As of 2 February 2023 the company had not identified the legal bases for its processing, and its privacy policy was inadequate in several respects. There was no age verification at registration or during use, and the system introduced later was still deficient. The authority imposed a EUR 5 million fine and ordered Luka to bring its privacy policy and age verification into compliance within thirty days and to report on the measures within sixty days. It opened a separate proceeding on the legal bases for processing throughout the lifecycle of the generative AI system, including training.
Why it matters
The decision concerns a companion chatbot designed to build emotional relationships with users. The Garante found that the company had not identified a legal basis for each processing operation and that its age verification had concrete gaps. Users could change their date of birth later, the 24-hour waiting period could be circumvented, and there was no age check based on the language used by the user. The legal bases for processing throughout the lifecycle of the generative AI system, including training, are the subject of a separate proceeding.
Related stages
According to the published decision, an appeal against it is pending, so the ancillary sanction of publishing the injunction order is not being applied. The amount of the fine is redacted in the published decision ([OMISSIS]); the EUR 5 million figure comes from the Garante's press release of 19 May 2025.