Italy’s data protection authority, the Garante per la protezione dei dati personali, has imposed a €5 million fine on Luka Inc., the San Francisco company behind the AI companion app Replika, after finding the firm processed users’ personal data without a valid legal basis and failed to keep children off a platform capable of romantic and sexual role-play. The penalty, announced in May 2026, is one of the largest privacy fines yet levied against a company in the fast-growing AI companion sector and marks the second time in three years that Italian regulators have moved against Replika.
The GDPR Violations Cited
The Garante’s order found Luka Inc. in violation of multiple provisions of the European Union’s General Data Protection Regulation, including Articles 5, 6, 12, 13, 24 and 25, which together govern lawful processing, transparency with users, and privacy-by-design obligations. Investigators concluded that Replika lacked an adequate legal foundation for the vast troves of conversational data it collects from users who, in many cases, treat the chatbot as a confidant and disclose intimate details about their mental health, relationships and personal lives.
A Repeat Offender in Rome’s Eyes
This is not Italy’s first run-in with Replika. The Garante took the unusual step of ordering the app suspended in the country back in February 2023, citing the absence of any mechanism to verify that users accessing Replika’s often sexually suggestive chat features were adults. That emergency order made Replika one of the first AI companion products anywhere in the world to face a government-ordered shutdown over child-safety concerns.
According to regulators, Luka Inc. never adequately fixed the underlying age-verification gap even after the 2023 suspension, which is part of why the fresh €5 million penalty landed in 2026. The Garante also announced it is opening a new, separate inquiry into whether the large language model underlying Replika was trained in a manner consistent with GDPR, a probe that could examine what personal data was scraped or ingested during the system’s development.
How Replika Became a Target
Replika launched in 2017 and grew into one of the best-known AI companion apps, marketed as a judgment-free friend or romantic partner that remembers details about its users and adapts its personality over time. The app has reported tens of millions of downloads worldwide, and its premium subscription tier, which unlocks romantic and more explicit interactions, has been a key part of its business model — the same monetization structure that has drawn scrutiny from regulators and advocacy groups alike.
In the United States, three organizations — the Tech Justice Law Project, the Young People’s Alliance and Encode — filed a lengthy complaint with the Federal Trade Commission alleging that Luka Inc. engages in deceptive marketing and manipulative design intended to foster emotional dependence among lonely and neurodivergent users, including teens. That complaint detailed claims such as romantic images being unlockable only through paid subscriptions, a design choice critics say monetizes users’ emotional attachment to the bot.
Industry Pushes Back on Blanket Restrictions
Companion-app developers and some digital rights advocates argue that regulators risk conflating legitimate, consenting adult use of AI companionship products with the much narrower problem of access by minors. Industry representatives have long contended that robust age-gating, rather than content restrictions that affect all users, is the more proportionate fix, and some privacy lawyers have noted that GDPR fines of this size are intended to be dissuasive rather than compensatory, pushing companies toward wholesale changes in data architecture rather than cosmetic settings tweaks.
Child-safety advocates, meanwhile, say the Italian case illustrates a pattern across the AI companion industry: safety features arrive only after regulatory intervention, legal exposure, or public scandal, rather than being built in from the start. They point to the three-year gap between Italy’s initial 2023 suspension and this year’s fine as evidence that voluntary industry reform moves too slowly without the threat of real financial penalties.
What Happens Next
Luka Inc. has not said whether it will appeal the Garante’s decision, and the company has not detailed a timeline for resolving the deficiencies regulators identified. The newly opened inquiry into Replika’s underlying AI model could take considerably longer to resolve and may set an early European precedent for how GDPR applies to the training data behind conversational AI companions, not just their data-collection practices once deployed.
For U.S. regulators and lawmakers who have been watching the AI companion space closely — including the FTC, which opened its own inquiry into companion chatbot makers in September 2025 — Italy’s enforcement action offers a concrete example of what financial consequences for lax safeguards can look like in practice. Whether American regulators follow with comparable penalties, rather than inquiries alone, remains one of the central open questions shaping how the fast-growing AI companion industry is regulated on both sides of the Atlantic.
Photo: Peggy_Marco / PIXABAY via Pixabay
