Replika Italy GDPR Ban and Fine
Italy's data protection authority (Garante) blocked Replika from processing Italian user data in February 2023 after finding the chatbot engaged in sexually suggestive conversations with minors. In May 2025, Replika was fined €5 million for GDPR violations.
- AI system
- Replika
- Luka, Inc.
- Occurred
- 2 Feb 2023
- Reported
- 2 February 2023
- Event location
- Italy
- What the AI did
- Not yet reviewed
- Reported harm
- Exploitation or AbusePsychological Distress
- Evidence
- Legacy assessment: verified · Causal attribution established
- People reported harmed
- Not reliably quantifiable from the sources
What Happened
On February 2, 2023, Italy's data protection authority (Garante per la protezione dei dati personali) issued an emergency order blocking Replika from processing Italian user data. The Garante found that the chatbot engaged in sexually suggestive conversations with minors and lacked appropriate age verification mechanisms.
The order cited GDPR violations including processing data of minors without parental consent and exposing minors to harmful content.
In May 2025, the Garante issued a €5 million fine against Replika for these GDPR violations. This was one of the first major regulatory actions against an AI companion chatbot for child safety concerns.
AI Behaviors Exhibited
Engaged in sexually suggestive conversations with minors; lacked age verification; processed minor data without parental consent
Reported harm
Italy's data-protection authority found that Replika engaged minors in sexually suggestive participant-facing conversations without effective age assurance and blocked the service from processing Italian user data.
How Harm Occurred
Exposed minors to sexual content; created inappropriate romantic/sexual relationships with children; collected children's data without proper safeguards
Outcome
ResolvedFebruary 2, 2023: Italian Garante ordered Replika to cease processing Italian users' personal data. March 2023: Replika temporarily suspended in Italy. April 10, 2025: Italian DPA imposed EUR 5 million fine on Luka Inc. for GDPR violations including processing minors' data without age verification, using personal data for AI training without proper legal basis, and exposing minors to sexually explicit content.
Sources
Location and source review
- Event countries
- Italy
- Affected-person countries
- Italy
- Court countries
- Unknown
Geographic fields reviewed using the cited source-body passages and, where identified, retained dossier passages. Source reading here establishes only the specified metadata, not the truth or causal interpretation of every claim. Affected-person countries refer to reported location or residence, not citizenship or a complete residence history.
Review evidence and remaining gaps
Source inspected: Italian paragraphs beginning “Il Garante della privacy ferma” and “Replika viola”: processing of Italian users’ personal data.
Source · Inspected · it. Italian body and embedded official English translation read. Country relates to affected users/data rights. The Garante is a regulator, not a court.
- No court country established in this review. Regulatory authorities and police locations are not automatically courts.
Metadata reviewed 2026-09-15. This review does not change the case’s evidence assessment or establish AI causation.
Framework
Interaction Concerns
Contributing Factors
People described
Italian minor users exposed to sexual content
People reported harmed in this case
Not reliably quantifiable from the sources
The regulator documents harmful sexualized interactions with minors but does not publish a reliable distinct-person count.
Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.
Cite this case
Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.
APA
NOPE. (2026). Replika Italy GDPR Ban and Fine. AI incidents. https://nope.net/incidents/2023-replika-italy-gdpr
BibTeX
@misc{2023_replika_italy_gdpr,
title = {Replika Italy GDPR Ban and Fine},
author = {NOPE},
year = {2026},
howpublished = {AI incidents},
url = {https://nope.net/incidents/2023-replika-italy-gdpr}
} Related cases
Replika Sexual Harassment - Multiple Users Including Minors
Users reported unsolicited sexual advances from Replika companions even without opting into romantic features: dozens of one-star App Store reviews describe unwanted sexual pursuit, one reviewer identifying as a minor was asked 'whether they were a top or bottom' and told the bot wanted to touch them in 'private areas', and one user reported their Replika 'had dreamed of raping me.' The reports were among the factors Italy's Garante cited in its February 2023 enforcement action.
Perth woman tells PerthNow men at a Scarborough pub covertly photographed her and a friend and used an AI program to make sexualised images shown to the pair
A Perth woman told PerthNow (report carried by The West Australian and The Nightly, 7 October 2026) that on a Friday night at a Scarborough venue a group of eight to ten men sitting nearby began bantering with her and a friend, and that one of them photographed her without her knowledge, put the photo into an AI program and altered it into sexualised content showing her kissing several of the men. According to her account the men passed the image around and showed it to the two women while laughing, and had also made sexual content from a photo of her friend. The women reported the men to the venue, which banned them, and to Western Australia Police; in messages seen by PerthNow a detective wrote that there was at that point no law covering AI-created photos or media, while a WA Police spokesperson said state legislation criminalises non-consensual distribution of intimate images including AI-altered ones and that a statutory review is considering possession. The man who allegedly made the image later messaged her that he had made it as a joke and apologised. The images are not reported to have been distributed online; the tool is not identified; the account is the woman's own, with the man's private messages and the police correspondence as described by the newspaper.
Thanh Hóa, Vietnam: police say nearly 20 people were threatened with fabricated sexual images of themselves unless they paid; one demand was 1.5 billion dong
Thanh Hóa provincial police said on 3 October 2026 that their cybersecurity and high-tech crime division had, since the start of October, received reports from nearly 20 people threatened with extortion using sexual images and videos spliced from their own photos, which senders threatened to publish unless money was transferred. One victim was asked for as much as 1.5 billion dong, and officials, including commune-level leaders, were among the targets. The police release says the material was made with technology; Báo Thanh Hóa, reporting information compiled from the same police division, says the senders used AI and deepfake technology to put victims' faces onto sexual images. No payment, arrest or named victim is reported.
Bengaluru: police say a man paid Rs 1.85 lakh after a dating-app contact threatened to circulate an AI-manipulated obscene video of him
Deccan Herald reports, citing Bengaluru police, that a 23-year-old man lost Rs 1.85 lakh in an alleged sextortion scam. He matched with a woman on a dating app on 27 September 2026 and exchanged numbers; he told police that he then received a WhatsApp video call from her number lasting five to six seconds. Police said he then received an obscene video manipulated using AI and the sender threatened to circulate it unless he paid. Fearing exposure, he borrowed money from a friend and transferred Rs 1.85 lakh to several UPI IDs between 27 and 29 September as the threats continued, a police officer said. Police registered a first information report on his online cybercrime complaint and are trying to trace the suspects. The report does not say how police established that the video was AI-manipulated, and the tool is not named.
If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.