European regulators continue to tighten their grip on artificial intelligence companies, with Italy taking another major step. This time, Character Technologies, the American company behind the popular Character.AI, has been fined €158,000 for data protection violations.
The decision by the Italian Data Protection Authority (Garante) is yet another message to AI developers that compliance with the General Data Protection Regulation (GDPR) is not optional. It also highlights the growing concerns of European authorities about the way generative AI services collect, process and exploit the personal data of millions of users.
Why was Character.AI penalized?
Character.AI has gained immense popularity in recent years, allowing users to create and interact with virtual AI-powered characters. These characters can portray historical figures, fictional heroes, or even original personalities created by users themselves.
See also: Character.AI launches Stories feature for teens
However, according to Garante's findings, the company did not provide sufficient and clear information on how personal data its users'. The auditors found that the relevant privacy notices did not fully meet the requirements of European law, which limited transparency towards users.
At the same time, the company is accused of delaying completing the mandatory Data Protection Impact Assessment (DPIA), a process considered particularly important for services that process large volumes of personal information or use innovative, high-risk technologies.
Minors at the center of concerns
Particular emphasis in the Italian authority's decision was given to the protection of children and adolescents, as the platform is particularly popular among younger ages.
The auditors found that mechanisms age verification are not considered sufficient to prevent minors from accessing content or functions that may not be suitable for them. According to Garante, additional technical and organizational measures to ensure that minors are effectively protected when using the service.
This issue is becoming increasingly important, as artificial intelligence applications now allow for highly realistic conversations, which creates new challenges for both privacy protection and the psychological safety of younger users.
Obligations not met
Garante also pointed out that Character Technologies did not promptly appoint an official representative within the European Union, as required by European legislation for companies operating in the European market without having their headquarters in a member state.
This representative acts as a point of contact between the supervisory authorities and the company, facilitating compliance with the GDPR and more effective management of potential user complaints or requests.
See also: Character.AI: Parental controls and safety measures for teens
So far, Character Technologies has not made any official public comment on the decision.
Europe is tightening its stance on AI
The case is not an isolated incident. In recent years, European authorities have significantly increased scrutiny of artificial intelligence platforms, demanding greater transparency and stricter protection of personal data.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Italy has played a leading role in this process. In 2023, Garante caused international outrage when it ordered the temporary suspension of ChatGPT in the country, citing concerns about the collection of personal data and insufficient age verification of users. The service was only reinstated after OpenAI made a series of changes to enhance compliance with European requirements.
This specific stance shows that European regulators are no longer limited to imposing fines, but are seeking to shape a clear operating framework for artificial intelligence services.
What the decision means for the future of AI services
The Character.AI case confirms that as artificial intelligence becomes more present in citizens' everyday lives, so do the demands for responsible management of personal data. Companies are now not only called upon to innovate, but also to demonstrate that their technologies operate with respect for privacy and with substantial safeguards for the most vulnerable users.
See also: Lawsuit against Character.AI and Google over teen's suicide
The fine may be relatively small in financial terms for a rapidly growing AI company, but its symbolic weight is significant. It is yet another indication that in Europe, the development of AI will be accompanied by strict regulatory control, with the protection of personal data and minors remaining at the heart of any new digital service.
