Character.AI Italy Garante Fine (Minors' Data Protection)

On July 3, 2026, Italy's data protection authority (the Garante per la protezione dei dati personali) issued Provvedimento n. 487 against Character Technologies Inc., the U.S. operator of Character.AI, closing an investigation opened in November 2024 into the risks of a generative-AI entertainment service accessible to children.

The Garante found multiple GDPR violations:

1. Inadequate age verification — the service allowed minors to register and converse with AI characters without effective age assurance, and previously blocked underage users could re-register
2. Insufficient safeguards for minors, including profiles that were not private by default
3. A deficient privacy notice
4. A late data protection impact assessment (DPIA) that had not adequately evaluated risks to minors or risks connected to model pre-training
5. Late designation of an EU representative

The authority imposed a €158,000 fine and ordered corrective measures: ensuring age-verification systems function properly, implementing effective cooling-off mechanisms so blocked minors cannot simply re-register, and setting minors' profiles to private by default. The company must report the measures adopted within 120 days of notification.

The decision landed against the backdrop of Character.AI's documented harms to minors elsewhere (the U.S. suits settled in January 2026) and Italy's broader enforcement posture on conversational AI — the same authority banned and later fined Replika, and Italy's Law No. 132/2025 restricts minors' access to social chatbots. During the investigation, Character Technologies had already committed to removing open-ended character chat for under-18s in the United States (from November 24, 2025) and in Italy (by end of February 2026).

• Companion chatbot platform accessible to minors without effective age verification
• Underage users blocked from the service could re-register without obstacle
• Minors' profiles were not private by default
• The platform's own risk assessment (DPIA) failed to adequately evaluate risks to minors or risks from model pre-training

The Garante's findings describe structural exposure rather than a single harm event: minors could reach an AI companion service designed for open-ended emotional and roleplay conversation without age gates, default privacy protections, or an adequate assessment of the risks the service posed to them.

The enforcement treats inadequate age assurance and default-public child profiles as concrete rights violations under the GDPR's heightened protections for children's data, in a product category where Italy's regulator had already documented sexually inappropriate interactions with minors (Replika) and where U.S. litigation documented severe outcomes for minor users.

• November 2024: Garante opened an investigation into Character.AI, focused on the risks of a generative-AI entertainment service accessible to minors
• During the investigation, Character Technologies committed to removing open-ended character chat for under-18s (from November 24, 2025 in the United States and by end of February 2026 in Italy) and introduced an in-use age-verification system
• July 3, 2026: Garante issued Provvedimento n. 487 — a €158,000 fine plus corrective orders: ensure age-verification systems function properly, implement effective cooling-off measures preventing blocked minors from re-registering, and set minors' profiles to private by default
• July 9, 2026: Garante announced the decision publicly; the company has 120 days from notification to report the measures adopted
• Compliance window running as of August 2026