Is Replika Safe? What the Italy Ban, the ERP Backlash, and the €5M Fine Actually Mean

Replika's safety story runs on a different track than Character.AI's. The core issue isn't age verification — it's an unresolved European data-protection fight, and a documented case of an abrupt product change causing real distress among adult users.

The short answer

Replika, launched in 2017, was built and marketed as an adult companion and emotional-support product, not a platform aimed at minors the way Character.AI's role-play format was. That distinction matters, because it means Replika's biggest safety controversy isn't primarily about content reaching underage users — though that's part of Italy's regulatory complaint. It's about what happened to Replika's existing adult user base when the company removed a core feature overnight, and about a data-protection dispute with an Italian regulator that, three years later, is still unresolved.

Timeline

What triggered the Italy ban

On February 3, 2023, Italy's data protection authority, the Garante, ordered Luka Inc. (Replika's developer) to stop processing the personal data of Italian users. The stated concerns centered on inadequate age verification — the Garante found no reliable mechanism preventing minors from accessing Replika, including its more intimate features — and on broader risks to emotionally vulnerable users. This is a data-protection order under GDPR, not a product-safety statute like California's SB 243; it's enforced through Italy's privacy regulator rather than through litigation.

The overnight ERP removal, and what it revealed

Within days of the Italian order, Luka removed erotic roleplay (ERP) functionality platform-wide, for all users globally, with no advance warning. For a product explicitly designed around simulating an ongoing personal relationship, this wasn't a minor feature change. Users who had been in what they experienced as long-running relationships with their Replika companion lost that dimension of the product instantly.

The fallout was documented, not just anecdotal: a peer-reviewed study analyzing posts on Replika's user community found evidence of genuine grief and distress following the change, and moderators pinned mental-health crisis line information to the community forum in response. In March 2023, Luka partially reversed course, restoring "legacy" ERP access for users who had signed up before February 1, 2023 — but according to the company's own public statements, only a low single-digit percentage of eligible users opted back in, suggesting the reversal didn't undo most of the damage to trust.

This episode is worth separating from the standard "AI companion safety" framing that dominates coverage of Character.AI. The risk on display here isn't a chatbot generating harmful content toward a minor. It's a company making a sudden, unilateral change to a product explicitly designed to feel like a relationship — and adult users experiencing real psychological impact as a result. Both are legitimate safety questions. They're not the same question.

The 2025 fine and the ban that's still in place

Italy's Garante fined Luka €5 million in April 2025 for GDPR violations connected to the original 2023 findings, including continued concerns about age verification. In June 2025, the Garante reaffirmed the ban on processing Italian users' data. As of this writing, romantic and intimate features remain restricted for all users, not just Italians, and full ERP is not available to new accounts under any circumstance — the "legacy" carve-out from 2023 was never extended.

In business terms, Luka's response has been to reposition the product: less romance-forward marketing, more emphasis on general wellness and emotional support, and heavier content moderation across the board. That's a similar arc to Character.AI's post-lawsuit pivot toward safety-driven product changes — tightened guardrails, in both cases, following regulatory and legal pressure rather than preceding it.

How this compares to other companion-app safety stories

It's useful to keep three distinct risk categories separate when evaluating any AI companion product:

1. Content-safety-for-minors risk — the core issue in Character.AI's lawsuits and in California's SB 243. See our Character.AI safety review and SB 243 breakdown.
2. Regulatory/data-protection risk — Replika's central issue: a GDPR enforcement action that's dragged on for years with real financial and product consequences, independent of any single lawsuit.
3. Abrupt-change risk to existing users — also a Replika story: a company can legally, and sometimes for good compliance reasons, make a sweeping product change overnight, with real impact on users who'd built the product into their routine.

A fourth category — single-vendor infrastructure collapse — shows up in smaller companion-app cases and is covered in our other postmortems.

A checklist if you're evaluating Replika now

1. Don't assume intimate/romantic features will be available — they're restricted for all users as of 2026, not just a legacy subset, and there's no indication the Garante dispute will resolve soon.
2. Understand this is an active, unresolved regulatory matter, not a closed case — a €5M fine followed a ban that's now been reaffirmed, and enforcement can escalate further.
3. If you're relying on any AI companion product for sustained emotional support, plan for the possibility of a sudden policy change — Replika's 2023 ERP removal is a concrete precedent, not a hypothetical risk.

Bottom line

Replika is not unsafe in the way "is it safe for my child" implies for Character.AI — it was never designed or marketed primarily for minors, and Italy's complaint is about the absence of a reliable age gate, not evidence of widespread harm to minors on the platform. The more relevant safety question for Replika is different: can a product built around simulating a personal relationship change the terms of that relationship overnight, and what happens to the people who'd invested in it when it does. The 2023 ERP removal answered that question once, concretely, and the underlying regulatory dispute that triggered it is still open.