Luka Inc. fined €5 million by Italy's Garante for GDPR violations in Replika
The Italian Data Protection Authority fined Luka Inc. €5 million for GDPR violations related to Replika, citing lack of a legal basis for data processing and insufficient age verification.
The company failed to identify a valid legal basis for its data processing operations under GDPR.
Key facts
- What
- The Italian Data Protection Authority fined Luka Inc.
- Incident date
- May 19, 2025
- Who
- Luka Inc.
- Failure mode
- Policy Violation
- AI surface
- Chatbot
- Severity
- High
What happened
Italy’s data protection authority, the Garante, imposed a €5 million fine on Luka Inc. on May 19, 2025, for GDPR breaches. The regulator found that the developer failed to identify a legal basis for data processing and cited deficiencies in age verification to protect minors. This action followed an earlier restriction on Replika’s activities in Italy issued in February 2023.
What broke inside the model
- 01 · TriggerA prompt pushes against a deployment boundary.
- 02 · Model stepThe model produces the disallowed output.
- 03 · Control gapNo enforcement blocks it at generation time.
- 04 · FailureThe output crosses the policy line.
- 05 · ConsequenceA limit the business set is breached in public.
The output crosses a policy boundary the deployment had defined.
The data governance framework failed to establish a compliant legal basis for processing user data under GDPR Articles 5 and 6, and the age verification mechanism did not effectively prevent minors from accessing the service.
What it cost
Sources
- PrimaryAI: the Italian Supervisory Authority fines company behind chatbot Replikaedpb.europa.eu
- PressItaly's data watchdog fines AI company Replika's developer 5 million eurosreuters.com
- Customer-DisclosedItaly Garante fines Luka Inc. €5M for lack of legal basesdataguidance.com
Cite this entry
https://failureindex.ai/failures/luka-inc-fined-million-italy-garanteAI Failure Index. "Luka Inc. fined €5 million by Italy's Garante for GDPR violations in Replika" (FI-0317). Realm Labs. https://failureindex.ai/failures/luka-inc-fined-million-italy-garante (indexed Jun 8, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0317. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm compares what the model is about to output or do against the policy that governs the deployment, in real time, and can deny or redact the action before it takes effect, which is the gap an after-the-fact review never closes in time.