South Korea's first AI fine targeted a chatbot's training data

The design

On 28 April 2021, South Korea's Personal Information Protection Commission held its seventh plenary meeting and fined Scatter Lab, maker of the companion chatbot Iruda, a combined 103.3 million Korean won in penalty surcharges and administrative fines. The PIPC's own release, and the violation-by-violation breakdown attached to it, describe eight violations of Korea's data-protection act across three Scatter Lab products: the messaging apps Text At and Science of Love, and Iruda itself. The commission found Scatter Lab used KakaoTalk conversations collected through the first two apps, without deleting or encrypting names, phone numbers, or addresses, to train and run Iruda, and separately posted some of those conversations, with gender and relationship details, to the developer site GitHub.

What the evidence says

The attached breakdown itemises the fine rather than leaving it as one number: 55.5 million won in penalty surcharges and 47.8 million won in administrative fines, spread across violations including collecting a minor's data without parental consent, processing sensitive information without separate consent, failing to delete withdrawn users' accounts, and using KakaoTalk conversations beyond their original purpose to build and run Iruda. A Q&A published with the release addresses one legal question directly: it concluded the conversations counted as personal information, since they could be linked to an identifiable account, but that collecting them from one side of a chat did not itself require the other party's separate consent, a narrower finding than describing the whole practice as unlawful collection.

What it asks of people

The order does not describe what Iruda's own users understood about the data behind the chatbot; it addresses what Scatter Lab disclosed to users of its other two apps. The commission found that listing 'new service development' in a privacy policy, with login treated as consent to it, did not amount to users agreeing their private conversations could be repurposed to train an unrelated chatbot. That turns on a narrow question, whether a stated purpose was specific enough to be meaningfully consented to, not a general ruling against reusing data across products.

Privacy and safeguards

Chairman Yoon Jong-in is quoted in the release calling the case unusually contested even among experts, and framing the sanction as a marker for how AI companies should handle personal data, alongside a self-check list the commission published for AI developers. The order addressed Scatter Lab's past conduct specifically; it did not audit Iruda's ongoing operation for other design practices, and this entry extends the finding to no other chatbot maker.

• Does a companion app disclose, specifically, whether conversations from one of a company's products train another?
• Is 'new service development' language in a privacy policy specific enough that a user's consent to it means anything?
• Were sensitive details, such as a psychological test result, collected under a separate, explicit consent?

The Iruda decision stands as an early marker rather than a settled rulebook: a national privacy regulator, years before most companion-specific statutes existed, found that a company's own broadly worded privacy policy could not stretch far enough to cover training an entirely different product on the same data.