AI Regulation Tracker / Enforcement

Italy's Garante Fines Character.AI Owner 158,000 Euro and Orders Working Age Checks for Minors

Regulatory summary: Italy's data protection authority fined Character Technologies Inc. 158,000 euro for GDPR failures and ordered it to make age verification work, add a cooling-off period so blocked minors cannot re-register, and set minor profiles to private by default, with proof of compliance within 120 days.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Italy's Garante Fines Character.AI Owner 158,000 Euro and Orders Working Age Checks for Minors regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The Garante moved from investigation to a concrete penalty and binding remediation against a foreign AI companion operator. It fined Character Technologies 158,000 euro and ordered three specific product-level fixes for minors: functioning age verification, a cooling-off period to block instant re-registration by a rejected minor, and private-by-default profiles for minor accounts. The authority also faulted the company for inadequate privacy notices, a late DPIA, and late appointment of the EU representative required under Article 27 of the GDPR.
Operators of consumer-facing generative-AI, chatbot, and companion products reachable by users in the EU, especially any service a minor could access. Inside those companies, the order lands on product and trust-and-safety teams that own age assurance and account flows, and on privacy and legal teams that own DPIAs, privacy notices, and the EU representative appointment.
Status: Announced July 9, 2026 via the Garante press release.
Audit your minor-facing account flow end to end: test whether age verification can be beaten, whether a blocked minor can re-register immediately, and whether new minor profiles default to private. In parallel, confirm your DPIA is current, your privacy notices meet Articles 13 and 14, and your Article 27 EU representative is appointed and documented.

Regulatory Briefing

Bindingness: Enforcement decision under the GDPR, in force and subject to appeal. This is an administrative sanction and corrective order issued by a national supervisory authority, not proposed legislation. It binds Character Technologies Inc. directly and takes effect on notification, with the 158,000 euro penalty and the 120-day compliance clock running unless a court suspends or overturns it on appeal.
Scope: Character.AI's processing of personal data in Italy, with particular focus on users who are minors. The reasoning applies GDPR duties that reach any controller offering an AI companion or chatbot service to people in the EU, including transparency, DPIA, EU representative, and protection of children's data.
What Changed: The Garante moved from investigation to a concrete penalty and binding remediation against a foreign AI companion operator. It fined Character Technologies 158,000 euro and ordered three specific product-level fixes for minors: functioning age verification, a cooling-off period to block instant re-registration by a rejected minor, and private-by-default profiles for minor accounts. The authority also faulted the company for inadequate privacy notices, a late DPIA, and late appointment of the EU representative required under Article 27 of the GDPR.
Who This Affects: Operators of consumer-facing generative-AI, chatbot, and companion products reachable by users in the EU, especially any service a minor could access. Inside those companies, the order lands on product and trust-and-safety teams that own age assurance and account flows, and on privacy and legal teams that own DPIAs, privacy notices, and the EU representative appointment.
Current Status: Announced July 9, 2026 via the Garante press release. The underlying decision (provvedimento) is dated July 3, 2026. The penalty and corrective orders are in force; the compliance report is due within 120 days. Character Technologies may challenge the decision before the competent Italian court.
Effective Date: Effective on notification of the decision; the 120-day window to adopt and report compliance measures runs from that point.
Primary Source: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594
Secondary Analysis: Reuters, Euronext, eWeek, PYMNTS, and TechNadu reported the 158,000 euro figure (about 180,500 dollars), the age-verification and cooling-off orders, the private-by-default requirement, and the 120-day reporting deadline (July 9-10, 2026).
Workflow Impact: Product teams will need age assurance that resists trivial bypass, a re-registration barrier for rejected minors, and default-private settings for minor accounts. Privacy teams will need a completed and current DPIA, GDPR-grade privacy notices, and a designated EU representative on file. Evidence of all of this has to be assembled into a compliance report the regulator can read.
Operational Next Step: Audit your minor-facing account flow end to end: test whether age verification can be beaten, whether a blocked minor can re-register immediately, and whether new minor profiles default to private. In parallel, confirm your DPIA is current, your privacy notices meet Articles 13 and 14, and your Article 27 EU representative is appointed and documented.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Italy / EU	The Garante moved from investigation to a concrete penalty and binding remediation against a foreign AI companion operator. It fined Character Technologies 158,000 euro and ordered three specific product-level fixes for minors: functioning age verification, a cooling-off period to block instant re-registration by a rejected minor, and private-by-default profiles for minor accounts. The authority also faulted the company for inadequate privacy notices, a late DPIA, and late appointment of the EU representative required under Article 27 of the GDPR.	Operators of consumer-facing generative-AI, chatbot, and companion products reachable by users in the EU, especially any service a minor could access. Inside those companies, the order lands on product and trust-and-safety teams that own age assurance and account flows, and on privacy and legal teams that own DPIAs, privacy notices, and the EU representative appointment.	Announced July 9, 2026 via the Garante press release. The underlying decision (provvedimento) is dated July 3, 2026. The penalty and corrective orders are in force; the compliance report is due within 120 days. Character Technologies may challenge the decision before the competent Italian court.

Source File

Instrument: Garante per la protezione dei dati personali sanction and corrective order against Character Technologies Inc. (Character.AI)
Authority: Garante per la protezione dei dati personali (Italian Data Protection Authority)
Date: Decision (provvedimento) dated July 3, 2026, docweb 10269571; press announcement July 9, 2026, docweb 10269594
Citation: Garante press release, Character.AI: il Garante privacy sanziona la societa e impone verifiche dell'eta e tutele per i minori (docweb 10269594)
Primary Source: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594
Corroboration: Reuters and Euronext, Italy privacy watchdog fines Character.AI owner over age-check failures (Jul 9, 2026); eWeek, Italy Fines Character.AI Parent Over Age-Check Failures; PYMNTS, Italy Penalizes Character.AI Owner Over Child Safety and Privacy Controls; TechNadu, Italy's Garante Fines Character AI Owner 158,000 Euro (Jul 9-10, 2026).

Frequently Asked Questions

How much is the fine and who has to pay it?

The fine is 158,000 euro, roughly 180,500 dollars, and it is imposed on Character Technologies Inc., the U.S. company that operates Character.AI.

Is this decision in force, or can it be appealed?

It is in force as an enforcement decision, effective on notification. Character Technologies can challenge it before the competent Italian court, and an appeal could suspend or change it, but until then the penalty and corrective orders apply.

What exactly must the company fix for minors?

Three things: age verification that actually works, a cooling-off period that stops a blocked minor from immediately re-registering, and minor user profiles set to private by default. It must report the measures adopted within 120 days.

Which GDPR duties did the Garante say were breached?

Inadequate privacy notices to users, a late data protection impact assessment, a late appointment of the EU representative required under Article 27, and deficient safeguards and age verification for minors.

Does this only matter for companies operating in Italy?

No. The decision applies GDPR duties that reach any controller offering an AI companion or chatbot service to people in the EU. It is a concrete precedent that any EU supervisory authority can draw on, so operators reachable by EU minors should treat the ordered controls as the emerging baseline.