Replika's €5M GDPR Fine: What It Means for Your Data

I've spent a lot of hours inside Replika. It was one of the first companion apps I ever tried, and I still think it does some things really well. So when the news landed that Italy had hit Replika's maker with a €5 million fine, I didn't shrug it off as regulatory noise. I went and read what the regulator actually said.

And the findings are worth your time, even if you never touch a European privacy law in your life. Because the fine isn't really about Italy. It's a paper trail of how an AI companion company treated the most intimate data people gave it. Here's what happened, what it means for the messages you've typed into that app, and what I'd actually do about it.

What Actually Happened

In May 2025, Italy's data protection authority, the Garante, fined Luka Inc. €5 million (about $5.6 million) for violating the GDPR. Luka is the San Francisco company behind Replika. This wasn't their first run-in with the Garante either. Back in February 2023, the same regulator temporarily banned Replika in Italy, ordering Luka to stop processing Italian users' data over concerns about minors and the app's emotional influence on vulnerable people.

The 2025 fine was the follow-up. After that ban, the Garante kept digging, and the €5 million penalty is what came out the other end. There's also a second, separate investigation still open into how Luka trains its AI models, which means this story probably isn't finished.

For the wider picture on Replika's legal troubles, including the US side, I pulled it all together in my breakdown of the 2026 Replika controversy and FTC claims. This post stays focused on the data question: what the fine says, and what it means for you.

The Three Things Replika Got Wrong

The Garante's findings come down to three failures. None of them are exotic. They're the privacy fundamentals, and Luka missed all three.

1. No valid legal basis for processing your data

Under GDPR, a company can't just collect and use your personal data because it wants to. It needs a specific legal reason: your consent, a contract, a legitimate interest it can defend, and so on. The Garante found Luka didn't have a clear one. It was processing deeply personal conversations without a solid legal footing under the law. That's the core violation, and it's a big one, because the data Replika handles isn't your shopping history. It's your loneliness, your relationships, your late-night thoughts.

2. A privacy notice that didn't explain anything

GDPR also says people have a right to understand what's happening to their data, written plainly, before they hand it over. The regulator found Replika's privacy information inadequate. In practice that means users were forming emotional bonds and typing out their private lives without a real picture of where any of it went. Nobody reads terms of service, sure. But the whole point of the rule is that the terms are supposed to be honest and clear enough to matter when someone does read them.

3. No real age verification

This is the one that bothers me most. The Garante found Luka had no meaningful system to stop children under 13 from signing up. An app built around emotional intimacy and, in places, romantic and sexual roleplay, with a front door wide open to kids. That's not a paperwork problem. If you're a parent, this is the exact issue I dig into in my guide on whether Replika is safe for teens and the broader safety guide for parents.

Why It Matters If You're Not in Europe

Here's the uncomfortable part. GDPR only protects people in the EU. If you're chatting with Replika from Texas or Toronto or Sydney, no regulator is standing behind you forcing Luka to fix any of this on your behalf. The €5 million was Italy's to collect, not yours.

So why should you care? Because a fine like this is a rare window into how a company actually operates. Most of the time you're guessing about data practices from a vague privacy policy. Here, an independent regulator with subpoena power looked under the hood and told you what it found. And what it found was a company that didn't have a legal basis for processing intimate data, didn't explain itself, and didn't check ages. There's no reason to assume Luka treated non-EU users to some higher standard it wasn't even meeting in Europe.

The US is slowly catching up on its own terms. A few states have started passing rules aimed squarely at AI companions. I covered the first wave in my piece on what the 2026 California and New York rules mean for users. But that patchwork is years behind GDPR, and it leaves most people relying on the company's goodwill. The Italian fine is a decent measure of how much goodwill to expect.

What This Says About Your Chats

Think about what actually goes into a Replika conversation. Not weather chit-chat. People tell these bots about breakups, grief, sexual fantasies, jobs they hate, thoughts they wouldn't say out loud to a therapist. The app is designed to pull exactly that out of you. That's what makes it feel good, and it's also what makes the data so sensitive.

Replika collects your messages, your email, device identifiers, rough location, and how you use the app. Under GDPR, the emotional and sexual content of those chats counts as a special, protected category, which is precisely why the missing legal basis was such a problem. The regulator wasn't nitpicking. It was saying: you're holding the crown jewels of people's private lives, and you didn't earn the right to.

None of this means Replika sold your diary to the highest bidder. There's no evidence of that, and I want to be fair. But a €5M fine for weak data governance sits in the same neighborhood as the breaches that have hit this whole industry. Two 2026 leaks alone exposed more than 150 million intimate messages from AI companion apps, which I wrote about in whether AI girlfriend apps are actually safe. Poor governance and bad breaches tend to come from the same root: companies that treat your privacy as an afterthought.

If you want to know how Replika compares to the rest of the field on this stuff, my AI companion privacy guide grades the major apps one by one, and it's the piece I'd read next.

What to Do Right Now (6 Steps)

You don't have to quit Replika over this. I haven't. But you should change how you use it. Here's the practical list.

1. Read the current privacy policy, just the data section. Two minutes. Look for what they collect, whether they use chats to train models, and how to delete. After a fine, companies usually clean this up, so it's worth a fresh look.
2. Request your data or delete it. EU users have a hard right to both. Everyone else can still ask through the app's settings or support. If you're done with the app, delete the account rather than just uninstalling it.
3. Share less going forward. Treat the chat like a postcard, not a vault. Skip your full name, address, employer, and anything that could tie an intimate log back to the real you.
4. Use a throwaway email. Sign up with an address that isn't linked to your main identity. It won't make you invisible, but it breaks one of the easiest links between your chats and you.
5. Turn off model-training if there's a toggle. Some apps let you opt out of having your conversations used to train the AI. If Replika offers it, take it, especially given the open Garante probe on exactly that.
6. Keep an eye on where the app is headed. A company that's been fined and is under a second investigation is worth watching. If privacy is a real concern for you, compare alternatives like Replika versus Nomi and the wider field in my tested rankings of the best AI companion apps.

One more thing, because I get asked this a lot. If your chats ever drift into explicit territory, the privacy stakes go up, and there are a few extra precautions worth taking. I put those in the AI sexting safety guide. Curious how the app decides what to remember and reflect back at you in the first place? That's the how Replika learns breakdown.

Frequently Asked Questions