- Company
- Luka Inc. (Replika)
- Regulator or court
- Italian Data Protection Authority (Garante per la protezione dei dati personali)
- Law
- GDPR (lawful basis, transparency, age verification)
- Status
- Challenged in court by Luka (per the Garante)
What happened
The Garante found that the company behind the Replika chatbot had not identified a legal basis for using people's data, had an inadequate privacy notice, and had no real age verification even though it said children were excluded. Italy had already ordered the app to stop processing Italian users' data in February 2023. The regulator also opened a separate probe into how the underlying AI model was trained.
Sources
Garante press release (Italian)IAPP reportSummary in our own words. General information, not legal advice.