Italy: Data Protection Authority opened investigation into Luka’s processing of personal data for development and training of the Replika chatbot compliance with General Data Protection Regulation

On 19 May 2025, the Italian Data Protection Authority (DPA) opened an investigation into Luka, the provider of the artificial intelligence chatbot Replika. The DPA will assess Luka’s compliance with the General Data Protection Regulation (GDPR) regarding its processing of personal data for the purposes of training its generative AI chatbot. The investigation builds upon previous investigations of Replika by the Italian DPA, requesting that Luka provide information on the life cycle of its data processing for generative AI training purposes, and in particular to clarify its risk assessment and data protection methods implemented.