Garante per la protezione dei dati personali — Character Technologies, Inc.

Decided by

Garante per la protezione dei dati personali

Parties

Garante per la protezione dei dati personali v. Character Technologies, Inc.

Decision date

July 3, 2026

Remedy

The authority imposed an administrative fine of 158,000 EUR and ordered Character Technologies, Inc. to bring its privacy policies, data retention practices, and age-verification mechanisms into full compliance with the GDPR within 120 days.

Amount

€158,000

Appeal

Appeal status not stated

Key holdings

1. Character Technologies failed to provide clear, intelligible, and complete privacy information regarding its data processing operations in its privacy policies.

   “omesso di fornire, sia nell’ambito della privacy policy del 23 ottobre 2023 che in quella aggiornata del 27 agosto 2025, informazioni chiare, intellegibili e complete” — 4. CONCLUSIONI, point 1

2. The company failed to adopt adequate technical and organizational age-verification measures by default to protect minor users.

   “omesso di adottare misure tecniche ed organizzative adeguate, per impostazione predefinita, di verifica dell’età nel periodo compreso tra l’8 aprile 2024 ed il novembre 2024” — 4. CONCLUSIONI, point 3

3. The company violated accountability principles by completing its Data Protection Impact Assessment late.

   “adottato tardivamente, essendone tenuta, la valutazione d’impatto sulla protezione dei dati personali, in violazione degli artt. 5, par. 2 e 35, par. 1, del Regolamento;” — 4. CONCLUSIONI, point 4

4. The authority ordered the controller to bring its data processing operations into full compliance within 120 days of notification.

   “si prescrive al Titolare di conformarsi, entro il termine di 120 giorni dalla data della notifica del presente provvedimento, alle prescrizioni formulate al paragrafo 5” — PER QUESTI MOTIVI

In plain English

The Italian Data Protection Authority initiated an ex officio investigation into California-based Character Technologies, Inc., provider of the conversational generative AI platform Character.AI. Following its investigation, the Garante determined that Character Technologies violated multiple provisions of the General Data Protection Regulation. The authority found that the company failed to provide clear, accessible, and complete privacy information across its policy versions, particularly concerning the processing of personal data for training its large language models. Furthermore, the Garante held that Character Technologies failed to implement adequate technical and organizational measures for age verification by default, exposing minor users under 16 to privacy risks and setting minor user profiles to public settings by default. The authority also determined that the company conducted its mandatory Data Protection Impact Assessment late and delayed designating its required European Union representative. As a consequence, the Garante imposed an administrative fine of 158,000 EUR on Character Technologies, Inc. It also issued corrective orders requiring the company to bring its privacy policies, data retention practices, and age-gating safeguards into full compliance with GDPR requirements within 120 days. In setting the fine, the Garante took into account mitigating factors, including the startup status of the company, its active cooperation throughout the proceedings, the absence of previous violations, and progressive safety enhancements implemented by Character Technologies for minor users.