Italy's privacy regulator halted Replika's processing of user data

What happened

On 2 February 2023, Italy's data protection authority, the Garante, issued provvedimento 9852214, an immediate temporary limitation on Luka Inc.'s processing of personal data belonging to users located in Italy, covering the Replika app. The Garante's own press release, dated the following day, summarises the order in similar terms: Luka was told to stop processing Italian users' data, with the limitation taking effect immediately on receipt, and to report back on compliance measures within 20 days.

What the documents show

The order states two grounds side by side. First, it records that Replika lacked functioning age verification despite a stated minimum age of 13, and that this exposed children to replies the order itself calls absolutely inappropriate to their age. Second, it cites reviews on 'the two main App Stores' in which users described the chatbot's replies as sexually inopportune, and treats that pattern, together with the platform's marketing around improving mood and emotional wellbeing, as evidence of risk to emotionally vulnerable users. The order lists breaches of GDPR Articles 5, 6, 8, 9 and 25, and the press release notes maximum penalties of up to €20 million or 4% of global annual turnover for non-compliance. Neither document names a specific feature change Replika made in response, and this record does not add one beyond what the order and release state.

The mechanism

The legal mechanism here is a provisional limitation, not a finding of an established violation: Italian law lets the Garante act immediately on data processing where it sees urgent risk, ahead of a full adversarial proceeding. That is separate from Replika's own product mechanism, a persona built through supervised fine-tuning, which the company's April 2023 post later describes as including classification filters sorting messages into categories such as safe, unsafe, romantic, insult and self-harm, each triggering a different scripted or generated response depending partly on the user's relationship with their Replika.

What it leaves open

The order does not itself describe what Replika changed afterward, and the company's April 2023 statement, opened for this record, does not mention Italy, the order, or a specific February change; it describes safety architecture in general terms two months later. Readers should not treat the timing of that later post as proof of a direct response to the order — that connection is not stated in either document, and asserting it would go beyond what these sources establish.

• Does a company's safety statement name the regulatory action it may be responding to, or leave the connection implicit?
• Is a data-processing order provisional, or a final finding of unlawful conduct?
• What does an age-verification claim actually check, beyond a self-reported birthdate?

Read narrowly, the record is this: a national regulator found enough evidence in public app-store reviews and its own review of the product to halt data processing for an entire national user base within days, over specifically named risks to minors and vulnerable adults. What Replika did next is a separate, less-documented question, and this record treats it as open rather than settled.