DocumentedData Privacy & Regulatory Violation2023-02-02 (ban); 2025-05-19 (fine)Italy

Italy Replika Chatbot Ban and 5M Euro Fine

Italy's Garante issued an urgent order halting Replika from processing Italian user data February 2023. Found: no effective age verification (only name, email, gender); no valid legal basis for processing; sexually suggestive content served to minors; English-only privacy policies citing US COPPA instead of GDPR; significant risks to emotionally vulnerable adults, some of whom reported mental-health crises when erotic roleplay was later restricted.

Fine: €5.0MAI system:Replika AI companion chatbot

Impact

First major EU regulatory action against an emotional AI companion. Later Character.AI teen suicides validated the regulator's concerns.

Outcome

Despite June 2023 interim remediation order, Luka did not sufficiently comply. May 19, 2025: 5 million euro fine imposed, plus ongoing investigation into whether the underlying LLM training methods themselves violate GDPR - one of the first regulatory probes of LLM training legality in Europe.

Sources

  1. Source 1European Data Protection Boardwww.edpb.europa.eu/news/national-news/2025/ai-italian-supervisory-authority-fines-company-behind-chatbot-replika_en
  2. Source 2TechCrunchtechcrunch.com/2023/02/03/replika-italy-data-processing-ban/
  3. Source 3IAPPiapp.org/news/a/italy-s-dpa-reaffirms-ban-on-replika-over-ai-and-children-s-privacy-concerns

Related incidents

Same category, country, or harm tier.

Israel·May 2, 2023
Amnesty: Israeli 'Red Wolf' Facial Recognition in the West Bank
Amnesty International's May 2023 report 'Automated Apartheid' documented Israeli use of an experimental facial recognition system, Red Wolf, deployed at military checkpoints in the H2 area of Hebron. The system scans Palestinians' faces and adds them to vast surveillance databases (Wolf Pack and Blue Wolf) without consent. The report, based on 2022 field interviews and testimony from current and former Israeli military personnel, framed the deployment as automating restrictions on Palestinian movement.
South Korea·March 2023
Samsung Employees Leak Confidential Data to ChatGPT
Within ~20 days of Samsung allowing engineers to use ChatGPT, three separate confidential data leaks occurred: proprietary semiconductor source code, defect-detection algorithms, and internal meeting recordings, all uploaded to ChatGPT consumer tier which retains inputs for training by default.
Multi-country·2021 to 2025 (ongoing)
Clearview AI Cascading EU Regulatory Fines
Clearview AI scraped 10+ billion facial images from social media and public sources to build a facial recognition database sold to law enforcement and private clients. Coordinated complaints filed May 2021 by Privacy International, noyb, Homo Digitalis, and Hermes Center in 5 EU countries. Clearview refused to comply with GDPR Article 27 (EU representative requirement) and ignored legal notices.
← Back to all incidentsSee full catalogue