Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Luka Inc.: Non-compliance with general data processing principles

The Italian DPA imposed a fine of EUR 5,000,000 on Luka Inc.

€5,000,000 Fine
Luka Inc.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR Art. 24 GDPR Art. 25 GDPR
Controllers Personal Data Supervisory Authorities Processing AI Act Violations
Apr 10, 2025 Source garanteprivacy.it

Full text

The Italian DPA imposed a fine of EUR 5,000,000 on Luka Inc. The developer created a chatbot called Replika with a written and voice interface. It is based on a generative AI system, specifically an LLM model, that is constantly fed and improved by user interactions. Replika is intended to be a 'virtual companion' that improves users' moods and emotional well-being by helping them understand their own psyche. Replika can be set up as a friend, therapist, romantic partner, or mentor. The controller failed to demonstrate a valid legal basis for its data processing and failed to provide sufficient information on data processing in its privacy policy. Additionally, the controller failed to adopt appropriate measures to protect personal data collected from children and implement an age verification mechanism. The total sum of the fine can be reduced by 50% if paid within sixty days.

Industry: Media, Telecoms and Broadcasting

How it connects

References

All 8

Related across sources

Statement 3/2024 data protection authorities’ role in the Artificial Intelligence Act framework Final 1 Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework Adopted on 16 July 2024 The European Data Protection Board has adopted… Statement ·EDPB Jul 16, 2024 Artificial Intelligence Single Point of Contact for AI Regulation Authority Cooperation
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
2025 EDPB Annual Report 2024 De EDPB heeft het Jaarraport van 2024 gepubliceerd. Met ook een handzame samenvatting voor degene die geen tijd hebben. Er wordt ook een lijst met zaken van enkele DPAs… Apr 23, 2025 Direct Marketing Legitimate Interest Privacy by Design
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
C-131/12 Google Spain SL and Google Inc. v AEPD and Mario Costeja González C-131/12 (Google Spain) CJEU May 13, 2014 IP Address Material scope (GDPR) Personal Data
Related documents