Garante fines Character.AI €158,000 over GDPR notices, late DPIA and minor age gates

On 9 July 2026 the Italian Data Protection Authority (Garante per la protezione dei dati personali) announced a €158,000 fine against Character Technologies Inc., the US company based in Menlo Park, California, that operates Character.AI, a generative-AI service that lets users, including minors, create and chat with virtual characters. The underlying decision is Provvedimento of 3 July 2026 (registro dei provvedimenti n. 487; doc. web n. 10269571), following an own-initiative inquiry opened in November 2024 after the Authority confirmed the service was available in Italy via web and app, addressed EEA data subjects in its privacy policy, and was offered in Italian. The Authority found GDPR infringements including inadequate privacy notices; late preparation of a data protection impact assessment (DPIA); late designation of an EU representative; and shortcomings in safeguards for minors and age-verification procedures. While acknowledging steps taken during the inquiry, it ordered further measures and required the company to communicate the measures adopted within 120 days of receiving the decision. This Italian GDPR case is distinct from US litigation involving Character.AI and is confined to the Garante's published text.

The detail most write-ups skip is what the Authority's technical check and operative orders actually turned on. The decision records that Character offered the service in Italian from at least 8 April 2024; that a neutral date-of-birth age gate was introduced in autumn 2023 and extended to earlier registrants in November 2024; and that a minors-oriented LLM experience, Parental Insight tools, and later age-assurance layers followed. On 8 April 2025 the Office tested web registration and found the stated EEA barrier at sixteen was not respected in the test path, that a self-declared fifteen-year-old Italian user could register, and that the resulting minor profile was public by default. The Authority held Character had failed to adopt adequate default technical and organisational measures for age verification between 8 April 2024 and November 2024, and for under-sixteen Italian users through at least 8 April 2025 (Articles 24(1) and 25(2)). Separately it found late DPIA formalisation (first structured DPIA dated 14 November 2024, after the first information request), late EU representative appointment (VeraSafe Ireland Ltd, written designation 31 May 2025), and notice failures under Articles 12–14, including inadequate information to Italian data subjects about LLM pre-training under Article 14. It did not uphold the contested Article 21 objection-mechanism claim (EDPB Opinion 28/2024 not applied retroactively) or the Article 27(4) broken-contact-link claim (treated as a corrected material error). Corrective orders include conforming the privacy policy on retention, transfers and related points; ensuring the sixteen-year EEA age gate works for Italian users; ensuring the mechanism that blocks further registration attempts by blocked under-age users (the “cooling-off period” named in the press release) works; and setting minors' profiles to private by default. The pecuniary sanction is euro 158,000.00 for the confirmed articles, with accessory publication of the injunction chapter on the Garante site.

The pattern is forgotten-constraint. Companion chat offered to minors ran on self-declared age and public-by-default youth profiles until regulators forced the gates and defaults the GDPR's risk-based design duties already required.