Garante per la protezione dei dati personali, injunction order against Luka Inc. (Replika chatbot), April 10, 2025

Summary

The Italian data protection authority ordered Replika's processing of Italian users' data blocked on February 2, 2023, and later investigated Luka Inc., the US company behind the generative AI companion chatbot. By decision of April 10, 2025, announced on May 19, 2025, it fined Luka EUR 5 million under the GDPR, finding that until February 2, 2023, Luka had no identified legal basis for the processing, had an inadequate privacy policy and had no age verification despite saying minors were excluded, and that its current age verification remained deficient. It ordered Luka to bring its processing into compliance and opened a separate investigation into how the underlying model was trained. The Garante noted that Luka has appealed the decision.

Key dates

1. February 2, 2023Filed
2. April 10, 2025Resolved
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. The Italian SA also found that, until 2 February 2023, the Company had not implemented any age verification mechanisms—either at registration or during use of the service—despite having declared that minors were excluded from potential users.

   Supports: findings; February 2, 2023, date

   AI: the Italian Supervisory Authority fines company behind chatbot Replika European Data Protection Board Primary source

2. The Italian Data Protection Authority imposed a €5 million fine* on US-based company Luka Inc., which manages the chatbot Replika

   Supports: fine amount and company

   *Pending appeal against the decision, the ancillary penalty consisting in the publication of the injunction order shall not be applied

   Supports: decision under appeal

   Provvedimento del 10 aprile 2025 [10130115]

   Supports: decision date

   AI: The Italian Data Protection Authority fines company behind chatbot Replika (press release, 19 May 2025, doc. web 10132048) Garante per la protezione dei dati personali Primary source