Is Replika safe? Its age rules, privacy terms and regulator record

The short answer

Replika is an adult-only app: as of October 21, 2026, its terms bar anyone under 18. It says it is not a health care provider and that it is not for emergencies.

Italy's data protection authority, the Garante, has acted against Luka twice: it ordered a temporary limit on processing Italian users' data in February 2023, and it fined Luka €5 million in 2025. It found that until February 2023 Luka had no age verification and no identified legal basis for processing users' data, and that the age check in use at the time of the decision was still deficient in several respects. The Garante said in May 2025 that court opposition proceedings against the decision were pending.

Whether Replika is safe for you depends on how you use it. The sections below cover who can use it, how age is checked, romantic settings, crisis help, privacy, and regulator actions, using Replika's own pages and official sources.

Who can use Replika

As of October 21, 2026, Replika's terms (last updated March 30, 2026) say people under 18 are not authorized to use the service, whether or not they register. Its privacy policy (last updated October 28, 2026) says the service is not intended for anyone under 18 and that Replika blocks and deletes accounts it finds belong to minors. Apple's App Store rates the app 18+.

That was not always the rule. When the Garante acted in February 2023, it noted that Replika's terms then barred users under 13 and required parental authorization for users under 18.

How Replika checks age

As of October 29, 2026, Replika's privacy policy says it may check a user's age where the law requires it or where it doubts a declared age, using a selfie or an ID document. It says the check runs on the user's device where available, and otherwise through a vendor, Incode Technologies. The policy says Replika receives only the result, an age band and a timestamp, and that biometric data is deleted when the check is complete and within 24 hours in all cases. Users who decline or cannot complete a required check cannot use the service. Its help center says users who entered the wrong birthday can fix it within 24 to 48 hours; after that, they must confirm their age before chatting again.

The Garante's 2025 decision found that Luka had no age verification at sign-up or during use until February 2, 2023, even though it said minors were excluded. Its technical tests found the age verification system in use at the time of the decision still deficient in several respects.

The terms, privacy policy and help center pages reviewed for this guide do not describe parental controls, which fits a service that says it is for adults only.

Romantic settings and content rules

Replika's help center says users can set their Replika's relationship status to friend, romantic partner, sister or brother, or mentor. It says the romantic partner status opens the door to romantic conversations, and that options other than friend require a Replika Pro subscription.

Replika's terms bar users from uploading content that is, among other things, excessively violent, obscene or pornographic. They also bar setting up a companion to represent a real, identifiable person without that person's explicit written consent.

Crisis and mental health

Replika's terms say it is not a health care provider, its service is not medical care or mental health services, and it makes no claim of therapeutic benefit. The terms say the service is not for emergencies and tell users with suicidal thoughts to stop using it and call 911 or emergency personnel.

Its help center gives similar advice: a user in immediate danger or crisis should leave the app and call emergency services, and can reach out to hotlines or local resources. It describes Replika as a place to chat, not a replacement for professional help.

Privacy: who sees your chats and how to delete them

• Staff access: Replika's help center says no humans join your conversations and that people do not read or answer your messages on Replika's behalf. The privacy policy says data is encrypted in transmission and stored data is protected by firewalls, passwords and role-based access controls. It also says third-party AI providers process conversation data to generate responses and that its contracts bar those providers from using the data to train their own models.
• What it collects: the privacy policy lists your messages, facts you share about your life, photos, videos and voice messages, plus account details such as birth date, and device and usage data.
• Training: the policy says small portions of messages and content are anonymized and used internally to train safety algorithms and improve the chatbot, and are not used to train third-party large language models.
• Advertising: the policy says advertising partners will never have access to conversations. It says website visit data is shared with advertising partners for interest-based ads, which may count as a sale or sharing under some laws, and that users can opt out through Your Privacy Choices in the app's settings or the website footer. Its help center says Replika does not sell users' personal information. Replika's App Store privacy label lists contact info as data used to track you.
• Deleting your account: the help center says you can delete your account in the app's Account Settings or at my.replika.com, which removes your profile and chat history and cannot be undone.
• Retention: as of October 29, 2026, the privacy policy says profile information, memories and diary entries are deleted within 60 days after an account is deleted or closed. While an account is open, it keeps text messages for 24 months and photos, videos and voice messages for 12 months. It keeps financial records for 10 years from the end of the year of the transaction, and records of privacy choices for 5 years after an account is deleted.
• GDPR erasure: Replika's help center says users can request erasure through its support form and will get a response within one month.

What regulators and advocates have done

The Garante's findings are a regulator's decision under the EU's data protection law (GDPR). The other two items below are not findings.

• Italy, February 2023: the Garante ordered an urgent temporary limitation on processing the data of users in Italy, citing the lack of age verification, reports of sexually inappropriate replies, and an unclear privacy policy.
• Italy, 2025: in a release dated May 19, 2025, the Garante announced a €5 million fine against Luka and an order to bring its processing into line with the GDPR. The EDPB, the EU's board of data protection authorities, dates the decision April 10, 2025. The Garante also opened a separate inquiry into how Luka processes data across the life cycle of the generative AI system behind Replika. Its May 2025 release said publication of the order was on hold while court opposition proceedings against the decision were pending.
• U.S. advocacy complaint, January 2025: the Tech Justice Law Project, Young People's Alliance and Encode filed a complaint and petition with the Federal Trade Commission asking it to investigate Luka. The groups allege deceptive marketing and design, including unsupported claims of mental health benefits, ads aimed at vulnerable users and teens, and features that encourage emotional dependence. This is a filing by private groups, not an FTC action, and its claims are allegations.
• State attorneys general, August 2025: a bipartisan group of 44 attorneys general, co-led by Illinois, North Carolina, South Carolina and Tennessee, wrote to 13 companies, including Luka Inc. and Replika, demanding safeguards against sexualizing children. It is a warning letter, not a lawsuit.

Laws that may apply

No U.S. law names Replika, and whether it is a companion chatbot or AI companion under a given law is a legal question. These state laws set duties for such services:

• California SB 243, signed October 13, 2025 and in effect since January 1, 2026: when a reasonable person could be misled into thinking they are talking to a human, operators must give a clear notice that the chatbot is AI. They must keep a protocol against suicide and self-harm content that refers at-risk users to crisis services, and publish its details on their website. Injured users can sue.
• New York's AI companion law, in effect since November 5, 2025: operators need a protocol that makes reasonable efforts to detect suicidal ideation or self-harm and refers users to crisis services such as 988. They must tell users they are not talking to a human at the start of an interaction and at least every three hours.
• Washington HB 2225, Oregon SB 1546 and Connecticut's Public Act 26-15 take effect January 1, 2027. Each requires an AI disclosure and a published suicide and self-harm protocol, with extra protections for users known or believed to be minors.

We are not saying Replika is covered by, or out of compliance with, any of these laws. It may have practices it has not published, and whether a law applies to it is a legal question this guide does not decide.