When AI Meets Children: Italy’s Garante Fines Character.AI Over Transparency And Safeguarding Failures

Background

The Italian Data Protection Authority, the Garante per la protezione dei dati personali (“Garante”), has issued a significant decision concerning the data protection implications of generative AI services, with particular focus on transparency, age assurance and the processing of personal data in connection with the development and operation of AI models.

The decision, adopted on 3 July 2026 (Decision No. 487), concerns Character Technologies, Inc. (“Character”), the US company behind Character.AI, a generative AI service that enables users to interact through chat with AI-generated or user-created “Characters”. The case provides important guidance for AI developers and other organisations offering AI-driven services to users in the European Union, particularly where such services may be accessed by minors or involve the processing of personal data for the training or operation of AI models.

The proceedings originated with an ex officio investigation opened by the Garante in November 2024. Following its investigation, on 26 January 2026, the Garante formally commenced sanction proceedings, identifying five heads of complaint.

The Alleged GDPR Violations and the Garante’s Findings

The first issue considered by the Authority was whether EU data protection law applied to Character.AI, given that it is a US-based company with no office or other establishment in the EU.

Under Article 3(2) GDPR, the GDPR applies to organisations established outside the EU where they offer goods or services to individuals in the EU (the “targeting” criterion). The Garante concluded that Character.AI met this criterion, as its service was accessible to users in Italy, was available in Italian, and had been available in Italy since 8 April 2024.

The five violations alleged by the Garante were as follows:

The first alleged violation concerned Character’s failure to comply with the transparency obligations on the following grounds:

• Character’s privacy notice remained available exclusively in English for more than a year after the Italian-language version of the Service was launched in April 2024. An Italian translation was only made available in August 2025.
• Although Character had a ticketing system through which individuals could exercise their rights, it failed to adequately inform users of their right to object under Article 21. The existence of a mechanism does not, by itself, satisfy transparency requirements.

Its privacy policy provided misleading and imprecise information about the “post-training” of its large language models (LLMs) a probabilistic model of natural language that predicts the word or symbol statistically most likely to follow a given input. The policy used a single, undifferentiated statement that user data “may be used to train and improve” its AI models, without distinguishing pre-training (the initial build of the model, carried out before launch, typically on internet-scraped data) from post-training (ongoing refinement of the already-live model using real users’ interactions). Because the notice did not draw that distinction, an ordinary Italian user reading it from the Service’s launch in Italy (8 April 2024) could reasonably conclude that their own conversations were already being used for post-training. The Garante found this was not the case: processing of EEA users’ data for post-training purposes had not yet begun at that point. The violation, in other words, is not that Character misstated a fact, but that its wording was vague enough to let users believe processing was already under way when it was not contrary to the GDPR’s requirement that information given to data subjects be concrete and certain.

• Character sometimes identified more than one legal basis for the same processing purpose for example, both consent and legitimate interest to justify personalised advertising. The Garante rejected the justification that relying on multiple legal bases in this way was necessary to reconcile the different legal regimes applicable across the various jurisdictions in which Character operates, not the EU alone, emphasising that users must be able to identify the specific legal basis applicable to each processing operation, rather than being presented with interchangeable alternatives. This matters because the applicable legal basis determines which rights a data subject can exercise: the right to object under Article 21, for instance, attaches to processing based on legitimate interest but not to processing based on consent, while only consent can be freely withdrawn. Presenting interchangeable bases for the same purpose therefore left users unable to identify which of those rights actually applied to their data.

Secondly, the Garante found that Character breached Article 14 GDPR which sets out the information a controller must give data subjects when their personal data have not been collected directly from them, as is typically the case with data scraped from the internet by failing to inform users and non-users alike that their personal data had been used for the pre-training of its proprietary LLMs.

Character’s 2023 privacy policy addressed only the post-training/deployment phase and did not adequately disclose the earlier pre-training activities, which the Garante found were carried out using data drawn largely from material scraped from the internet data liable to include personal data about individuals who had never used Character.AI at all, which is why the disclosure obligation extended to non-users as well as users.

The third violation concerned age verification and safeguards for minors, engaging Articles 24 and 25 GDPR. Article 24 requires controllers to implement appropriate technical and organisational measures to ensure and demonstrate compliance, while Article 25 requires controllers to build data protection into system design and apply privacy-protective settings by default. Character argued that the GDPR does not mandate any specific age-verification technology, which the Garante accepted. However, Articles 24 and 25 still require measures that are appropriate and effective in light of the risks, including the particular vulnerability of minors. The Garante therefore focused not on whether Character had adopted a particular technology, but on whether its safeguards worked in practice. Character’s age gate relied on self-declaration: users entered their own date of birth at registration, with no independent verification of what they entered. A technical test on 8 April 2025 showed that a a user who declared a birth date corresponding to age 15 could still register despite the age gate, and that accounts registered by users who had declared themselves minors were set to public visibility by default, rather than private.

The fourth violation concerned Character’s failure to carry out a timely Data Protection Impact Assessment (DPIA) under Article 35 GDPR. Character’s first DPIA was dated 14 November 2024, but it argued that it had conducted internal risk assessments beforehand and that a formal DPIA was required only where processing posed a high risk. The Garante rejected this, finding that the risk was already apparent given the use of generative-AI technology, large-scale processing and the involvement of minors. In the Garante’s assessment, any one of these three factors would have sufficed to trigger the DPIA obligation. In this case, the Garante concluded that all three factors were present. It therefore considered that a DPIA should have been conducted before the service was launched in September 2022. The Garante also stressed that undocumented internal assessments cannot be considered a legitimate substitute for the formal DPIA required by Article 35, particularly where the eventual DPIA itself failed to address significant risks, including those concerning minors and pre-training.

The fifth and final violation concerned Article 27 GDPR, which requires controllers established outside the EU that offer goods or services to EU data subjects to designate a representative in writing, save where the processing is occasional and low-risk. Character appointed VeraSafe Ireland Ltd. only on 31 May 2025, arguing that the Article 27(2) exception for “occasional” processing relieved it of the obligation until then. The Garante rejected this, finding that the service had been offered in Italian on an ongoing basis, not occasionally, and that the pre-training processing was large-scale. Character therefore breached Article 27(1).

Decision

In its decision issued on 3 July 2026, the Garante found Character Technologies, Inc. in breach of the GDPR : transparency under Articles 12(1), 13(1)–(2) and 14(1)–(2); Article 14(1)–(2) for failing to inform Italian data subjects about the use of their data to pre-train its proprietary LLMs (discussed above); Articles 24(1) and 25(2) for inadequate default safeguards for minors; Articles 5(2) and 35(1) for the late DPIA; and Article 27(1) for the late appointment of an EU representative.

Pursuant to Article 83 GDPR, the Garante imposed an administrative fine of €158,000.

Beyond the fine, the Garante issued a compliance order under Article 58(2)(d), requiring Character to further revise its privacy policy (clarifying legal bases, retention periods, and international transfer disclosures), bring its handling of pre-training data into compliance or delete it, ensure its age-gate and “cooling-off” mechanisms for blocked minors function correctly, and set minors’ profiles to private by default, with a compliance report due within 120 days.

Key Legal Principles and Implications

• The decision confirms that the accountability principle applies to AI systems in exactly the same terms as to any other processing operation. A controller must be able to demonstrate compliance, not merely assert it: knowing what personal data is processed, on what legal basis and for what purpose is a documented exercise, not a policy statement.
• The same logic extends to privacy by design. Safeguards that exist only in a policy document and not in how the service actually operates, do not satisfy Article 25.
• The decision is also instructive on what transparency actually requires. Making a mechanism available to data subjects, a ticketing system, a contact address, is not, without more, sufficient. Controllers are expected to bring these mechanisms to users’ attention proactively.

A Precedent With a Longer Reach

The reach of this decision extends well beyond one chatbot. It speaks to any provider of generative-AI services that interact with users and process personal data, apps, customer-facing chatbots, virtual assistants, regardless of where the provider is established, for the jurisdictional reasons set out above.

The decision also carries broader implications for organisations whose privacy notices do not accurately reflect the way their services operate in practice. It is particularly relevant to organisations offering products or services that may be accessed by minors.

The decision provides a reminder to organisations offering AI-driven services to users in Europe to review their data protection practices proactively and ensure that their privacy information, age-assurance measures and risk assessments accurately reflect how their services operate in practice.