What a regulator found inside Replika

Two years of proceedings, in order

The first row is the part users felt. One morning the app stopped answering, and the reason was not in the app: it was in an order signed in Rome. Nobody who had been talking to it every day had done anything wrong, and nobody had any way to fix it. That is the scenario we describe elsewhere as the service that vanishes from under its users, and this is the first documented case of it in the category.

The second row is the one almost no coverage mentions, and it is the one that matters most today: the block was lifted. Not because the authority changed its mind, but because the company did what it had been told to do. The age check you meet signing up exists because a regulator required it. Replika works in Italy now — anyone searching for whether it is still banned is reading news from three years ago.

The four findings

Being precise here is worth the space. An itemised, verifiable list of findings against a product of this type exists exactly once, and every item on it is something you can go and look for in the next app you sign up to.

The decision of 19 May 2025 found that the company:

1. had not identified a legal basis for its data processing operations. This is the most technical item and the heaviest: it means the company could not say which of the permitted grounds it was relying on to hold that data at all.
2. had a privacy policy that was inadequate in several respects.
3. had not implemented any age verification mechanism — neither at registration nor during use — while stating that minors were excluded from its users.
4. published that privacy policy in English only, without regard to the language of the country where the service was being offered.

The third item deserves a pause. The finding is not that the company let minors in. It is that the company said it kept them out while having no instrument capable of doing it. The gap between what a service writes in its terms and what the service actually does is precisely what an authority is equipped to measure — and precisely what no user can measure alone.

The case was afterwards published by the European Data Protection Board, which lifted it out of purely Italian practice and put it in front of every other supervisory authority in the Union.

The investigation that is still open

The least quoted part of the May 2025 decision is that on the same day, a second one began.

It is not about the notice, and not about age. It concerns the generative AI system itself: the risk assessment, the data protection measures applied during development and training of the model, which data was actually used, and whether anonymisation or pseudonymisation were applied.

Put plainly, the first file asked what you do with the data of the people who sign up. The second asks what you built the model out of. No company in this category has had to answer that one in public, and the answer — whenever it arrives — will concern a great deal more than a single product.

How many of the five would pass the same checks

Two of the four findings cannot be checked from outside. Whether a company has a valid legal basis, and whether its notice is adequate, are questions that need a regulator's file, answers given under obligation, and two years. We are not going to pretend we can do that from a browser.

The other two you can check yourself, and we did, for the five services we rank.

Age. Either something stands between you and the account, or nothing does.

Now read that column again with the Italian finding beside it. The services that verify anything verify it where a regulator told them to: the UK Online Safety Act, the Australian eSafety Commissioner. For users in the United States, Germany, France, Brazil and Japan, not one of the five does what the Italian authority required of Luka. The pattern is not that this industry disagrees about age verification. It is that age verification here arrives by order, and stops at the border of the country that issued the order.

Language. The fourth finding is the one you can check in ten seconds: open the privacy policy of whatever you use and see what language it is written in. Interface translation is not the same thing and should not be mistaken for it — GirlfriendGPT ships its site in twelve languages, a list we read out of its own translation files, which tells you exactly which countries it knows it is selling to. The finding was about the document that explains what happens to your data, not about the marketing wrapped around it.

Who you are actually contracting with

Before any of the four questions there is a zeroth one, and it is the layer you can reconstruct from outside for every service, because the companies publish it themselves.

None of this is an accusation. It is what the documents say, and the spread is the point. Candy AI is a European company with a register number you can look up, so it sits inside European rules by obligation rather than by order. A Cypriot entity declaring Hong Kong law offers the same customer something else entirely. Jurisdiction is not paperwork: it decides which authority can do for you what the Garante did for Italian users.

Two doors into the same building

Europe and the United States arrived at this category from opposite directions, and the dates show it.

In Europe the route was data protection, and it started moving on 2 February 2023 with an order that took a product off the market in one country. In the United States the route was product liability, and it started with a civil complaint filed in October 2024 — what that judge decided, and why every company in the category rewrote its age policy afterwards, is a story of its own.

The useful thing about seeing both is that they converge on the same two questions: who is accountable, and what stands between a child and the product. Neither route required the industry to agree that those questions mattered.

What you can actually do

More than it looks like, and less than you would want.

European data protection law gives you the right to ask a service for a copy of the data it holds about you, the right to ask for it to be deleted, and the right to complain to a supervisory authority if the answer does not come or does not convince you. It applies to companies outside Europe that offer services to people inside it — which is the exact basis on which an Italian authority reached an American company.

What you cannot do is recover text that has already left. No request brings back a conversation that now exists in copies you do not control. Which is why the right order is the opposite of how almost everyone does it: the checks below belong before the sign-up, not after an incident.

Four questions before you type anything personal

The Italian file is useful because it shows what an authority considers relevant. The same items take about fifteen minutes to check yourself, on the terms of any service.

1. Which company, under which law. If the terms do not name an entity, there is no address for a complaint and no law to appeal to.
2. What stands between a declared age and a verified one. A tick box is an answer, just not the one the sentence above it implies.
3. Whether the privacy notice exists in your language. If it does not, the company decided that people in your country could read English or go without.
4. Whether deleting the account deletes the history, and how. Not a support ticket — a documented procedure with a stated outcome.

Add a fifth that is not privacy but ends up being about it: which name appears on your bank statement. Some services bill under the brand, others under a neutral parent company. It is never decisive and it is the detail nobody mentions until it is already on the card.

And two habits that cost nothing and outperform all of the above: use an email address that does not contain your name, and never reuse a password. When one of these companies has an incident — and sooner or later one does — those two choices are the only part of it that was ever under your control.

What this does not tell you

It does not tell you which app is better. The Italian decision is about one company's paperwork and one company's failure to check an age, and a five million euro fine is not a review.

If you are choosing right now, our ranking of the best AI girlfriend apps of 2026 scores price, free limits, memory and media. It does not carry a safety score, and it will not: there is no honest way to put a number on something that cannot be verified from outside. The Italian file is the proof of that limit — it took two years and the powers of a regulator to establish things that were not visible on the terms page.

We check pricing, limits and terms at the source every month, and we write down what we could not verify. While we are on the subject of data: what this site collects about you is written down too, and it is considerably less than anything described above.