{"id":10940,"date":"2026-09-30T18:03:56","date_gmt":"2026-09-30T15:03:56","guid":{"rendered":"https:\/\/legalaccelerators.com\/?p=10940"},"modified":"2026-09-30T18:40:57","modified_gmt":"2026-09-30T15:40:57","slug":"a-e158000-gdpr-fine-compliance-is-not-optional","status":"publish","type":"post","link":"https:\/\/legalaccelerators.com\/ro\/a-e158000-gdpr-fine-compliance-is-not-optional\/","title":{"rendered":"A \u20ac158,000 GDPR fine: compliance is not optional"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Character.AI learns that a US address doesn’t buy an EU exemption<\/i><\/p>\n

On 3 July 2026, Italy\u2019s data protection authority (Garante) fined Character Technologies<\/p>\n

Inc. \u20ac158,000, following an ex officio investigation opened in November 2024, after<\/p>\n

Garante observed the platform\u2019s rapid growth among younger users in Italy.<\/p>\n

The company operates Character.AI, a generative AI platform where users create and<\/p>\n

interact with virtual characters through chat.<\/p>\n

\n<\/p>

Why was the company fined?<\/b><\/h2>\n

Italy’s data protection authority identified a series of GDPR violations.<\/p>\n

1. Inadequate privacy notices (Articles 12\u201314 GDPR)<\/b><\/p>\n

Garante reviewed two versions of Character.AI’s privacy notice, dated October 2023 and<\/p>\n

August 2025, and found both fell short of the transparency requirements set out in<\/p>\n

Articles 12 to 14 of the GDPR.<\/p>\n

Neither notice clearly explained the purposes for which user data was processed, the legal<\/p>\n

basis relied on for that processing, how long the data would be retained, or the safeguards<\/p>\n

applied when data was transferred outside the EU.<\/p>\n

For a platform whose core function is ongoing, data-intensive conversation with an AI<\/p>\n

system, that lack of clarity matters more than it might for a simpler service, users had<\/p>\n

little way of understanding what happened to what they typed, or for how long.<\/p>\n

\n<\/p>

2. Late DPIA and missing EU representative (Articles 35 and 27 GDPR)<\/b><\/p>\n

Under the GDPR, any processing likely to result in high risk to individuals requires a<\/p>\n

Data Protection Impact Assessment (DPIA) before the processing begins, not after, and<\/p>\n

processing children’s data through an AI chat interface plausibly qualifies.<\/p>\n

Character conducted its DPIA late, only after the platform had already been operating and<\/p>\n

growing its user base across the EU. The company was similarly delayed in appointing anEU representative, a legal requirement for any non-EU company offering services to EU<\/p>\n

users, meant to give regulators and individuals a real point of contact within the bloc.<\/p>\n

\n<\/p>

3. Insufficient age verification<\/b><\/p>\n

This was the most consequential finding in Garante’s decision. Character.AI’s existing<\/p>\n

safeguards for verifying a user’s age were found to be inadequate, meaning the platform<\/p>\n

could not reliably prevent minors from accessing content or interactions not suited to<\/p>\n

their age. Combined with the platform’s immersive, conversational format, designed to<\/p>\n

keep users engaged in long, personal exchanges with AI-generated characters, the<\/p>\n

absence of solid age controls was treated by the authority as a serious gap.<\/p>\n

\n<\/p>

The jurisdiction argument<\/b><\/p>\n

Character’s defence rested on a familiar excuse: as a US-based company, EU rules<\/p>\n

shouldn’t apply to it with the same rigour as they would to a European business. It is an<\/p>\n

argument regulators have heard before, and Garante rejected it just as quickly, applying<\/p>\n

the \u201ctargeting\u201d criterion under Article 3 GDPR.<\/p>\n

The rule is simple and leaves no room for interpretation: if a service is accessible to, and<\/p>\n

used by, people in the EU, GDPR applies, regardless of where the company happens to be<\/p>\n

headquartered. A US address has never been, and was never designed to be, an<\/p>\n

exemption from European data protection law.<\/p>\n

\n<\/p>

What does compliance look like in practice?<\/b><\/h2>\n