- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Luka Inc. – €5,000,000 Fine (Italy, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Italy's data protection authority fined Luka Inc. €5 million for failing to provide a valid legal basis for processing user data in its chatbot. This ruling is crucial as it underscores the need for transparency in data processing practices. Companies must ensure they have clear policies and protections in place, especially when dealing with sensitive data from children.
What happened
Luka Inc. did not demonstrate a valid legal basis for processing personal data through its chatbot.
Who was affected
Users of the Replika chatbot, particularly children whose data was inadequately protected.
What the authority found
The authority found that Luka Inc. violated multiple GDPR articles by not providing sufficient information and protections for personal data.
Why this matters
This ruling stresses the necessity for companies to have robust data protection measures and clear privacy policies. It serves as a reminder that non-compliance can lead to hefty fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA imposed a fine of EUR 5,000,000 on Luka Inc. The developer created a chatbot called Replika with a written and voice interface. It is based on a generative AI system, specifically an LLM model, that is constantly fed and improved by user interactions. Replika is intended to be a 'virtual companion' that improves users' moods and emotional well-being by helping them understand their own psyche. Replika can be set up as a friend, therapist, romantic partner, or mentor. The controller failed to demonstrate a valid legal basis for its data processing and failed to provide sufficient information on data processing in its privacy policy. Additionally, the controller failed to adopt appropriate measures to protect personal data collected from children and implement an age verification mechanism. The total sum of the fine can be reduced by 50% if paid within sixty days.
Related Enforcement Actions (1)
Other enforcement actions involving Luka Inc. in IT
Details
Fine Date
10 April 2025
Authority
Garante per la protezione dei dati personali
Fine Amount
€5,000,000
Enforcement Tracker ID
ETid-2611
About this data
Cite as: Cookie Fines. Luka Inc. - Italy (2025). Retrieved from cookiefines.eu
Last updated: