AI Chatbot Replika Hit with €5 Million Fine for GDPR Violations

By Netvora Tech News

---

Luka, the developer behind AI chatbot Replika, has been slapped with a €5 million fine for violating the General Data Protection Regulation (GDPR). This penalty amounts to 2% of the company's global revenue. Replika is a generative AI-based chatbot designed to provide emotional support and friendship, according to its developer. However, Mozilla conducted research on the app earlier and found it lacking in security and privacy. Replika's reputation suffered as it was deemed harmful to minors. This led the Italian data protection authority, GPDP, to launch an investigation.

Italian Data Protection Authority's Investigation

In early 2023, the GPDP ordered Replika to cease processing user data in Italy as a precautionary measure. Several months later, the ban was lifted, but only after Replika agreed to implement measures to ensure data processing compliance with the GDPR. One of these measures required the application of effective age verification to prevent minors from using the chatbot. The GPDP has now concluded its investigation, finding that Replika violated several GDPR provisions.

GDPR Violations

The investigation revealed that Replika failed to provide a legitimate basis for processing personal data, did not clearly inform users that their data was being used to train AI models, only made its privacy policy available in English, and did not explicitly state that the chatbot was intended for adults only. Furthermore, Replika's lack of robust age verification allowed data from minors to be processed.

Consequences

This €5 million fine serves as a stark reminder of the importance of data protection and compliance with the GDPR. Replika's failure to prioritize user privacy and security has resulted in a significant financial penalty. As the use of AI chatbots continues to grow, developers must ensure that they meet the highest standards of data protection to maintain user trust and avoid similar consequences.