Case italy-garante-replika-5m-fineChatbot harmItaly
Italy fines Replika maker Luka EUR 5 million, partly over missing age verification
Italy's Garante fined Luka Inc. EUR 5 million in a decision adopted on 10 April 2025. It found that Replika had no age verification until February 2023, despite saying minors were excluded, and that its current checks were still deficient.
HighHarm caused by AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- May 19, 2025
- Location
- Italy
- Target
- Replika users in Italy, including minors
- Severity
- High
- Verification
- Confirmed by victim, vendor or authority
- Triggered by
- Luka Inc. (Replika)
- Actor type
- AI product design / safeguards
- Sector
- Individuals & consumers
- Reported loss
- None reported
- CVE
- None
What happened
Italy's Garante fined Luka Inc. EUR 5 million in a decision adopted on 10 April 2025. It found that Replika had no age verification until February 2023, despite saying minors were excluded, and that its current checks were still deficient.
Impact: EUR 5 million fine and an order to bring processing into compliance with the GDPR
Who triggered it
Actor: Luka Inc. (Replika)
Attribution: Garante per la protezione dei dati personali, final decision summarised by the EDPB
Motive: None; regulatory failures in the product's design
How it happened
Attack vector: Companion chatbot sign-up and use with no effective age checks
Root cause: No legal basis for processing, an inadequate privacy policy, and no age verification at registration or during use
Timeline
- Garante orders Replika blocked in Italy
- Garante adopts EUR 5 million fine decision
- Fine announced
Response
The Garante opened a separate investigation into the legal bases for the generative AI system behind Replika.
Current status: Ongoing
Research warnings this case matches
- Seen in real incidents People's trust in AI companions turns harmful · CAIS
- Early signs Relying on AI companions harms some users · International AI Safety Report
- Early signs Many people lean on AI for emotional support · UK AISI
- Seen in real incidents Human-computer interaction · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- European Data Protection Board edpb.europa.eu
- Silicon UK silicon.co.uk
Cite this case
Italy fines Replika maker Luka EUR 5 million, partly over missing age verification. AI Threat Watch, case italy-garante-replika-5m-fine, May 19, 2025. https://aithreat.io/cases/italy-garante-replika-5m-fine/
Permanent link: https://aithreat.io/cases/italy-garante-replika-5m-fine/
Related cases
The same type of incident, most recent first.