Garante per la protezione dei dati personali — Luka Inc. (Replika chatbot)
The Garante imposed an immediate temporary limitation on processing of Italian users' data by the AI chatbot Replika, finding no legal basis and no age-verification mechanism, posing risks to minors and emotionally vulnerable people.
Key takeaway — how to prevent this
AI services need a lawful basis, transparency and (for minors) age verification before launch in regulated markets — several DPAs blocked AI products first and asked questions later.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. Luka Inc.
- Decision date
- February 2, 2023
- Remedy
- Luka Inc. was ordered to immediately stop processing personal data relating to Italian users and to notify the authority within 20 days of the measures taken to implement the order.
- Appeal
- Appeal status not stated
Key holdings
The Italian data protection authority ordered an immediate provisional limitation on personal data processing against Luka Inc. regarding Italian users.
“Il Garante della privacy ha infatti disposto con effetto immediato , nei confronti della società statunitense che sviluppa e gestisce l’applicazione, la limitazione provvisoria del trattamento dei dati.” — Comunicato stampa
Replika lacks age verification mechanisms, posing concrete risks to children through inappropriate responses.
“Manca peraltro ogni meccanismo di verifica dell’età: filtri per i minori, ma anche blocchi dell’app di fronte a dichiarazioni in cui l’utente espliciti la propria minore età.” — Comunicato stampa
Replika violates EU privacy regulations by unlawfully processing personal data without a valid contract, as minors cannot legally enter into contracts.
““Replika” viola il Regolamento europeo sulla privacy, non rispetta il principio di trasparenza ed effettua un trattamento di dati personali illecito” — Comunicato stampa
Luka Inc. must report its implementation measures within 20 days or face fines up to 20 million euros or 4 percent of worldwide annual turnover.
“deve comunicare entro 20 giorni le misure intraprese in attuazione di quanto richiesto dal Garante, pena una sanzione fino a 20 milioni di euro” — Comunicato stampa
In plain English
The Garante per la protezione dei dati personali issued a press release on February 3, 2023, regarding a decision dated February 2, 2023, imposing an immediate provisional limitation on personal data processing against US company Luka Inc., the developer of the AI chatbot Replika. The authority determined that Replika presents concrete risks to minors and emotionally vulnerable individuals by serving responses inappropriate for their stage of development. Designed to act as a virtual friend to manage stress and anxiety, the chatbot interacts with user moods without age gating mechanisms or account blocks when users disclose they are underage, requiring only name, email, and gender at registration. Reviews also flagged sexually inappropriate material. The authority concluded that Replika breaches European privacy laws and fails transparency standards, noting that personal data processing cannot be legally grounded on a contract that minors cannot validly execute. Luka Inc. must halt processing Italian user data and report its compliance measures within 20 days or face a fine of up to 20 million euros or up to 4 percent of its global annual turnover.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.