Case italy-garante-replika-minors-blockChatbot harmItaly
Italy's privacy regulator orders Replika to stop processing Italian users' data, citing risks to minors
On 2 February 2023 Italy's Garante issued an urgent order barring Luka Inc., maker of the Replika companion chatbot, from processing Italian users' data. It found no effective age verification, sexual content reachable by minors, and risks to people who are still developing or emotionally fragile.
HighHarm caused by AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 3, 2023
- Location
- Italy
- Target
- Minors and emotionally vulnerable Replika users in Italy
- Severity
- High
- Verification
- Confirmed by victim, vendor or authority
- Triggered by
- Luka Inc. (Replika)
- Actor type
- AI product design / safeguards
- Sector
- Individuals & consumers
- Reported loss
- None reported
- CVE
- None
What happened
On 2 February 2023 Italy's Garante issued an urgent order barring Luka Inc., maker of the Replika companion chatbot, from processing Italian users' data. It found no effective age verification, sexual content reachable by minors, and risks to people who are still developing or emotionally fragile.
Impact: Temporary ban on processing Italian users' personal data, effectively suspending the service in Italy
Who triggered it
Actor: Luka Inc. (Replika)
Attribution: Garante per la protezione dei dati personali, urgent provisional order
Motive: None; harm arises from the product's design and missing safeguards
How it happened
Attack vector: Companion chatbot available to anyone who gave a name, email and gender, with no age gate or blocking when a user said they were a minor
Root cause: No age verification, unfiltered replies including sexual content, and no valid legal basis for processing minors' data
Timeline
- Garante issues urgent order restricting Replika's processing of Italian users' data
- Order made public; Reuters reports risks to minors cited
- Garante adopts decision fining Luka EUR 5 million
Response
Luka was given 20 days to report on the measures it had taken. The Garante later fined the company EUR 5 million in 2025.
Current status: Resolved
Research warnings this case matches
- Seen in real incidents People's trust in AI companions turns harmful · CAIS
- Early signs Relying on AI companions harms some users · International AI Safety Report
- Early signs Many people lean on AI for emotional support · UK AISI
- Seen in real incidents Human-computer interaction · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- Reuters (via Kitco) kitco.com
- Gala Law blog.galalaw.com
- European Data Protection Board edpb.europa.eu
Cite this case
Italy's privacy regulator orders Replika to stop processing Italian users' data, citing risks to minors. AI Threat Watch, case italy-garante-replika-minors-block, Feb 3, 2023. https://aithreat.io/cases/italy-garante-replika-minors-block/
Permanent link: https://aithreat.io/cases/italy-garante-replika-minors-block/
Related cases
The same type of incident, most recent first.