What happened
01
On 9 July 2026, Italy's data protection authority, the Garante, announced a 158,000 euro fine against Character Technologies, which runs Character.AI, under a decision dated 3 July 2026.
02
The Garante opened the inquiry on its own initiative and found shortcomings in the privacy information given to users, a late data protection impact assessment and a late appointment of an EU representative.
03
It also found problems with protections for minors and with age verification on a service that lets users, including minors, create and chat with AI characters.
04
The company must make age checks work, stop blocked minors from signing up again, set minors' profiles to private by default, and report its measures within 120 days.
Why this is a design failure
An age gate that is easy to get past and a privacy notice that falls short leave children agreeing to terms they cannot weigh. The regulator found that the safeguards meant to come before a child starts chatting were not doing their job.
The fair alternative
Make age checks work and set young users' accounts to private by default.
Do
Check age in a way that holds, keep blocked minors out, and explain data use in plain words before sign-up.
Don’t
Don’t rely on a self-declared age or a quick tap as a child’s consent.
Design guide for this case
If you're designing an AI character chat app open to minors
Interface
Make minors' profiles private by default, and show a short plain-language privacy summary screen before sign-up, not just a link to the policy.
Words
In the content guide: "Explain data use in words a 13-year-old understands. One idea per line, no legal terms."
Flow
Use an age check that actually works, and stop blocked minors from signing up again with a new email or a different birth date.
Metrics
Don't count sign-up completion as success. Track how many blocked minors try to re-register and how many get through.
Testing
Have testers try to bypass the age check by changing their birth date or making a new account, and log every route that works.
Before launch
01
Does the age check do more than ask for a self-declared age?
02
Can a blocked minor easily sign up again?
03
Are minors' profiles private by default?