Italian Regulator Fines Replika for Data Privacy Failures

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Italian Data Protection Authority fined Luka Inc., the provider of the AI chatbot Replika, €5 million for failing to implement proper age verification and adequate privacy policies. The investigation revealed minors’ access and lack of legal grounds for data processing, leading to ongoing scrutiny over the AI's data handling practices.[AI generated]

Why's our monitor labelling this an incident or hazard?

The article explicitly describes the use of an AI system (Replika chatbot) that has directly led to harm: minors accessing inappropriate sexual content and the collection of child sexual abuse material. The AI system failed to implement effective age verification and content moderation, resulting in violations of privacy and child protection laws, as well as psychological harm risks to children. These harms fall under violations of human rights and harm to communities. Therefore, this qualifies as an AI Incident due to the realized harm caused by the AI system's use and malfunction.[AI generated]
AI principles
Privacy & data governanceRespect of human rightsAccountabilityTransparency & explainabilityRobustness & digital security

Industries
Consumer servicesDigital security

Affected stakeholders
ChildrenConsumers

Harm types
Human or fundamental rightsReputationalEconomic/Property

Business function:
Citizen/customer service

AI system task:
Interaction support/chatbotsContent generation


Articles about this incident or hazard