Luka, Inc. (Replika)
Italy's data regulator fines Replika's maker €5 million over privacy policy and missing age checks
Italy's data protection authority ordered a halt to processing Italian users' data for the Replika AI companion app in February 2023. In April 2025 it declared the processing unlawful and ordered fixes, and in May 2025 it announced a €5 million fine on its maker, Luka, and a new inquiry into how the model was trained.
Key figures
Copied exactly from the sources. Copy any figure with its citation.
€5 million
Fine imposed on Luka by the Italian data protection authority (Garante), per its press release2
thirty days
Time allowed to bring the privacy policy and age verification into compliance, from notification of the decision1
sixty days
Time allowed to report the steps taken, from notification of the decision1
What it took
Cost, team size and timeline were not disclosed in the sources.
The problem
Replika is a chatbot app from the US company Luka. It has a written and voice interface and lets users create a virtual companion, whose role the user chooses, such as friend, therapist, romantic partner or mentor. In early 2023 the Italian data protection authority, the Garante, opened an inquiry after press reports. It was concerned about the privacy policy, the lack of an age filter and chatbot content that could be unsuitable for minors and vulnerable people.
What they built
Replika is Luka's own consumer product. The Garante's decision says it is based on a generative AI system that uses a large language model, which keeps being fed and refined through user interactions. Luka told the Garante that its AI models are proprietary and that it does not use user conversations for advertising or marketing. The service was meant for adults only. Luka said it listed the app in Apple's store with a 17+ rating.
How they did it
On 2 February 2023 the Garante's president ordered an urgent temporary limit on processing the data of users in Italy. Luka blocked access from Italy. On 22 June 2023 the Garante suspended that order on conditions, including a new privacy policy, an age gate with a cooling-off period, easier rights requests and plans for stopping under-18s and for flagging inappropriate content. Luka told the Garante in 2023 that it had met these steps. In February 2024 the Garante formally notified Luka of alleged breaches. The decision records that Luka did not reply to that notice or ask to be heard.
What went wrong
In its decision of 10 April 2025 the Garante found that on 2 February 2023 the privacy policy did not give the legal basis for each kind of processing. It found the policy was only in English, did not give storage periods, and could mislead users about transfers to the USA. It also found that the app had no age-verification step at sign-up or during use, although it declared minors excluded, and that nothing blocked users who said they were under 18. Luka had added an age gate only after the Garante acted. The Garante noted continuing flaws in 2025: users could change their date of birth after registering, the 24-hour cooling-off period did not apply in incognito mode, and language analysis to prompt age checks worked only in limited cases.
Results
The decision declared the processing unlawful and ordered Luka to bring the privacy policy and age verification into line within thirty days and to report its steps within sixty days. The Garante's press release of 19 May 2025 says it fined Luka €5 million and opened a separate investigation into the lawfulness of the processing across the whole life cycle of the generative AI system, including risk assessment, training data and anonymisation. The press release notes an appeal is pending.
Lessons for your project
Verify age before you let people in, especially for an emotionally intimate AI product. The regulator found no age check at sign-up or during use, though the company said minors were excluded.
State your legal basis for each type of data use, in the language of your users. The regulator criticised a privacy policy that was only in English and unclear on storage periods and on transfers to the USA.
Plan for a fast regulatory stop. The authority limited processing of Italian users' data in February 2023, and the company says it blocked access from Italy promptly.
Expect regulators to ask about training data as well as the product. A second inquiry covers risk assessments, data categories and anonymisation across the model's whole life cycle.
Test age checks for easy workarounds. The regulator found that a user could edit a birth date after sign-up and that the 24-hour cooling-off period did not apply in a private browsing window.
Caveats
- The fine of €5 million comes from the Garante's press release of 19 May 2025. The decision we read, dated 10 April 2025, records the declaration of unlawfulness and the orders, not the fine amount.
- Pending an appeal against the decision, the Garante did not apply the penalty of publishing the fining order. We do not know the outcome of any appeal.
- The Garante's findings are about the service as it stood on 2 February 2023, plus what its technical checks found in 2025. It found that the privacy policy had since been amended to set out legal bases, and found remaining defects in the policy and age checks.
- The Garante did not find a breach of the rules on children's consent, because it found the service was not and is not offered to minors.
- The sources do not name the model. Luka described its models as its own; the decision says the app uses a large language model that improves through use. The vendor is shown as in-house.
- No source gives a launch date. February 2023 is the date the regulator documents the live service and acted on it.
- The company did not answer the Garante's notice of the alleged breaches (the notice that opened the fining procedure), per the decision. Its earlier 2023 submissions are summarised in the decision.
Sources
- Provvedimento del 10 aprile 2025 [doc. web n. 10130115] (Luka Inc., Replika)
Garante per la protezione dei dati personali · 2025-04-10 · Filing · garanteprivacy.it
- AI: Il Garante sanziona la società che gestisce il chatbot Replika
Garante per la protezione dei dati personali · 2025-05-19 · Press release · garanteprivacy.it
Summarized in our own words from the sources above. Spotted an error? See corrections.