Luka Inc. fined EUR 5 million over Replika, with a separate inquiry opened into the model’s training lifecycle
Subject: Luka Inc. (US operator of the Replika chatbot)
What happened
Replika offers a written and voice interface letting users generate a virtual companion cast as a confidant, therapist, romantic partner or mentor. The Italian Garante had already ordered the application blocked in February 2023 and continued investigating the infringements as they stood on 2 February 2023.
How it was handled
The authority found that, as at 2 February 2023, the company had not identified a legal basis for the processing carried out through Replika; its privacy policy was inadequate in several respects; and it had no age-verification mechanism at registration or during use, despite declaring that minors were excluded from potential users. Technical assessment also showed the age-verification system currently implemented remains deficient in several respects.
Outcome
The injunction order was adopted on 10 April 2025 and announced on 19 May 2025: a EUR 5 million fine plus an order to bring processing into compliance with the GDPR. The authority simultaneously opened an independent investigation requiring Luka to explain data processing across the whole lifecycle of the generative AI system — risk assessments and protective measures at each development and training stage, the types and categories of data used, and whether anonymisation or pseudonymisation was applied. Pending the appeal, the ancillary penalty of publishing the injunction order is not applied.
What it means for Chinese exporters
- · Lifting a blocking order does not close the case. More than two years separated the February 2023 block from the April 2025 fine, and remediation in between did not erase the findings as at the historical date — clean up historical compliance gaps deliberately and keep the remediation evidence, rather than waiting for them to lapse.
- · Writing "this service is not for minors" in your terms without technical verification is self-incrimination. The authority expressly contrasted the company’s declaration with the total absence of any verification mechanism, and kept testing after remediation. Age gating must survive third-party testing.
- · Companion and emotional-support chat products are a high-attention category in the EU: user input inherently contains special-category data such as health and sexual orientation, so the Art. 9 conditions and the impact assessment must be argued separately rather than folded into a generic chatbot compliance file.
- · One penalty often triggers a second investigation. Regulators will then demand evidence of data governance across the whole training chain — keep a standing pack ready: data-source ledger, annotation standards, de-identification methods, and stage-by-stage risk assessments.
Related regulations
Sources (1)
- Italian Garante fines Luka Inc., operator of the Replika chatbot, EUR 5 millionItalian Data Protection Authority (Garante per la protezione dei dati personali) · published 2025-05-19 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.