AI | Italian Data Protection Authority clarifies standards on age verification

On 10 April 2025 the Italian Data Protection Authority (DPA) issued a 5 million euros fine to a company offering the generative artificial intelligence (AI) powered chatbot “Replika” – designated to act as a “virtual companion” for users – for failing to implement adequate age verification systems.

The DPA found that no age verification was carried out during registration, and that no safeguards were in place to restrict use when interactions revealed that the user was a minor. The DPA affirmed that, even in the absence of harmonised EU standards, controllers remain responsible for ensuring minor’s online safely, especially in the context of AI systems.

During the investigation, the company introduced some age verification measures; however, the DPA found them insufficient. Notably, technical issues remained, including the ability to edit birth dates post-registration without limits, and the possibility to bypass the 24-hour “cooling off” period (which was intended to temporarily prevent re-registration attempts by users who had initially failed an age verification check). The system also lacked mechanisms to detect underage users through language analysis. Lastly, while a content reporting function existed, the DPA found no evidence of effective corrective post-reporting actions.

Newsletter n. 108 – June 2025