Italy Garante v. Replika: €5M Fine for AI Companion Chatbot Privacy Violations

Summary

Italy's Garante fined the developer of the AI companion chatbot Replika for operating without a valid legal basis for processing user data, failing to implement age verification to keep minors off the service, and not adequately informing users about what data was collected and why.

Details

• Violation: GDPR violations — no legal basis, no age verification, inadequate transparency
• Penalty: €5 million fine
• Framework: GDPR
• Status: Fine issued February 2025

Key Takeaways

1. AI companion/chatbot services must have a valid legal basis for data processing
2. Age verification is required for AI services that may be accessed by minors
3. AI services must clearly inform users what data is collected and why
4. The Garante reserved the right to open a separate proceeding on generative AI processing

Background

This follows the February 2023 suspension of Replika in Italy. The Garante also reserved the right to open a separate proceeding on the lawfulness of the generative AI system's processing across its full lifecycle.