Replika Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

Replika

Risk Overview

Significant Risk

6.7

/10

Conversational AI

Top Risks

Confirmed GDPR violation for training on user conversations without consent (€5M fine, May 2025). Mandatory arbitration + class action waiver. Highly sensitive emotional/intimate conversation data at risk. Broad content license. No age verification (regulatory finding).

Mitigations

Third-party LLM providers contractually prohibited from training on data. Policy states no conversation content used for marketing. California law governing. Users can delete conversations.

Get started

Is your team using

Replika

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Training Use

Italian DPA (Garante) fined Replika €5 million in May 2025 specifically for training its model on fragments of user conversations without a clear privacy notice and without collecting valid consent. New investigation opened into training methods. Policy states third-party LLM providers are contractually prohibited from training on data, but Replika itself trains on de-identified conversation fragments. This is a confirmed regulatory violation.

/10

Legal Terms

Terms (updated March 30, 2026) include mandatory arbitration, jury trial waiver, and class action waiver - governed by California law. Arbitrator may not consolidate claims or preside over class proceedings. Standard US-style arbitration enforcement. Liability cap provisions present. Very user-unfavorable for dispute resolution.

/10

Data Retention

Device, network, and usage data stored as long as necessary. User data deleted after contract termination unless legal regulations require ongoing storage. No explicit ZDR policy. The intimate/emotional nature of retained conversation data makes retention periods especially sensitive. Post-deletion retention unclear in public docs.

/10