Italy fined Replika's operator five million euros

The design

On 19 May 2025, Italy's Garante announced it had fined Luka Inc., the operator of the Replika chatbot, €5 million, concluding the investigation it opened after its February 2023 emergency order. According to the Garante's press release, the authority found that “the alleged infringements notified in February 2023 … had indeed occurred”: as of 2 February 2023, Luka had not identified a lawful basis for processing Replika users' data, its privacy policy was inadequate, and it had no age-verification mechanism at registration or during use. The underlying decision, dated 10 April 2025, also states that a technical assessment found the age-verification system Luka has since implemented “continues to be deficient in several respects.”

What the evidence says

Both documents are the Garante's own findings, closing the formal investigation that the 2023 emergency order had left open; this entry treats the fine and its stated grounds as the regulator's conclusion, distinct from the earlier order's provisional finding. The press release notes that “pending appeal against the decision, the ancillary penalty consisting in the publication of the injunction order shall not be applied,” indicating Luka Inc. retains or is exercising a right to challenge the decision; no court ruling on any such appeal is cited here.

What it asks of people

Beyond the fine, the decision orders Luka Inc. to bring its privacy policy and age-verification system into compliance with the Regulation's transparency and data-protection-by-design requirements within 30 days of notice, and to report to the Garante on the steps taken within 60 days.

Privacy and safeguards

Separately from the fine, the Garante states it has opened a new, independent investigation into how personal data is processed across the entire lifecycle of the generative AI system behind Replika, requesting details on risk assessments, the categories of data used to train the underlying language model, and whether anonymization or pseudonymization measures apply. That inquiry is described as ongoing in the press release; no outcome is reported in either document available here, so what the training-data investigation will find remains unresolved as of the date these sources were retrieved.

• Has Luka Inc. appealed the €5 million fine, and with what result?
• What did Luka Inc. report back within the 30- and 60-day deadlines the order set?
• What has the Garante's separate investigation into Replika's training data found, if it has concluded?

A five-million-euro fine closes one question the 2023 order raised, but the Garante's own press release opens a second, still-pending one about what happens to a user's data before it ever reaches a conversation with the chatbot.