Italy Fines U.S. AI Firm €5M for GDPR Violations

Gianni Dell’Aiuto | WBN News Global | May 23, 2025

In a landmark decision, Italy's Data Protection Authority (Garante) has imposed a €5 million ($5.4 million) fine on San Francisco-based Luka Inc., the developer behind the AI chatbot Replika, for violating the European Union's General Data Protection Regulation (GDPR).

Replika, launched in 2017, offers users AI-generated avatars designed to serve as virtual companions. The Italian regulator's investigation revealed that Luka Inc. lacked a legal basis for processing users' personal data and failed to implement effective age-verification measures, allowing minors to access the service without appropriate safeguards.

These violations are considered serious under the GDPR, particularly given the potential risks to vulnerable groups such as children. The absence of transparency and accountability in Replika's data processing practices contributed to the severity of the penalty.

Beyond the financial sanction, Garante has initiated a separate investigation into Replika's use of generative AI technology. This probe aims to assess whether the methods employed to train the chatbot's language model comply with EU privacy standards, especially concerning the collection and utilization of personal data.

This enforcement action underscores the extraterritorial reach of the GDPR, emphasizing that companies outside the EU must adhere to its regulations when offering services to EU residents. It also highlights the increasing scrutiny on AI technologies and the importance of robust data protection measures in their deployment.

Tags:
#GDPR Compliance, #Data Privacy, #AI Regulation, #Luka Inc, #Replika Chatbot, #EU Compliance, #Tech Fines

Gianni Dell’Aiuto is an Italian attorney and expert in legal risk management, data protection, and digital ethics. Proudly Tuscan, based in Rome, and able to work worldwide. With over 35 years of experience, he advises companies on how to navigate complex regulatory frameworks such as the GDPR, AI Act, and NIS2. He is the author of multiple books, including Homo Googlis, and a regular contributor on legal innovation and digital rights. Gianni is committed to helping businesses turn compliance into a strategic advantage in the global marketplace and to supporting communities and individuals in building digital awareness and responsibility. Click here for more information on his website

Sources: Reuters, European Data Protection Board, 2B Advice, Babl.ai