Italy fined Replika's maker €5 million and opened a new inquiry

The regulator's decision and press release detail a €5m fine, unlawful data processing findings and a probe into model training.

Historical event

May 19, 2025

First source published

April 10, 2025

Site publication

September 18, 2026

What happened

On 10 April 2025 Italy's data protection authority, the Garante, adopted a formal decision against Luka Inc., the US company behind the companion app Replika, finding that its processing of personal data as of 2 February 2023 had been unlawful. The regulator made the decision public on 19 May 2025 through a press release stating it had fined the company €5 million and opened a separate, independent inquiry into how the generative model behind Replika is trained.

What the documents show

The decision documents a sequence stretching back to February 2023, when the Garante had ordered a temporary block on Replika in Italy over children's access and an inadequate privacy policy, a block the company complied with while making changes. The 2025 decision concludes that, as of the original February 2023 date, Luka had not identified a legal basis for several of its processing operations and had published a privacy policy that was, among other faults, available only in English and unclear about international data transfers. It further finds that, even now, a user can freely edit their stated birth date after registration with no re-verification, and that the 24-hour cooling-off period meant to stop minors re-entering a false birth date can be bypassed by using a new email address in a private browsing session. The press release states the new inquiry will examine 'risk assessments and the measures adopted to protect data' across the model's training lifecycle.

The mechanism

The Garante's order works through EU data protection law's territorial reach: because Replika was shown to be offered to, and used by, people in Italy, the regulator asserted jurisdiction under the Regulation's targeting provision rather than needing an EU corporate establishment. The €5 million penalty and a thirty-day compliance order sit alongside that finding, while the newly opened inquiry is a separate legal track aimed specifically at the model's development pipeline rather than the consumer-facing app.

What it leaves open

The decision does not resolve whether Luka has an EU establishment, a question the company had raised and the regulator rejected for lack of evidence; that dispute could resurface elsewhere. Neither document states the outcome of the new training-data inquiry, which the press release describes as just beginning. An appeal against the decision was pending at the time of the press release, so the described penalty is not yet final under Italian procedure.

• Can a user's self-reported birth date ever function as a real age-verification control?
• What would the training-data inquiry need to find to change how the app itself operates?
• Does a fine change a company's practice faster than an earlier, unenforced corrective order did?

Two years passed between the Garante's first emergency block and this formal finding, a gap that is itself a record of how slowly a cross-border privacy case can move even when the underlying technical gaps, like an editable birth date, remained largely the same throughout.

Sources & reading trail

The Garante's formal decision finding Luka Inc.'s processing unlawful as of 2 February 2023 and ordering corrective measures.

Source published: 10 April 2025 · Retrieved: 16 September 2026

The regulator's press release stating the €5 million fine and the new investigation into the generative model's training data.

Source published: 19 May 2025 · Retrieved: 16 September 2026

Company documents, filings, studies and official records establish the record; the reading and the questions are Lovebot Journal editorial analysis. This retrospective draft does not imply the site published on the event date.

Continue reading

• Italy's privacy regulator halted Replika's processing of user data
• Three companion privacy policies diverge on chat data
• The EU AI Act bans manipulation and requires bot disclosure
• Browse the complete the archive

Published September 18, 2026, not on the date of the event described.