#
Age-of-consent framework is clear and enforced, but recurrent age-verification failures (Character.AI, TikTok precedent) show implementation gaps at platform level.
Sub-modules (5)
Age VerificationAmber
Character.AI was ordered to guarantee correctly functioning age-verification systems, a 'cooling-off' mechanism against repeat registration by blocked minors, and default-private profiles for minors.
Claims (1):
- The Garante required Character Technologies to guarantee correctly functioning age-verification systems, ensure effective 'cooling-off' mechanisms preventing renewed registration attempts by blocked minors, and set minors' profiles to private by default.
Parental ConsentGreen
Below age 14, the Codice requires consent from whoever exercises parental responsibility for information-society-service processing to be lawful.
Claims (1):
- Under Art.2-quinquies of the Codice, implementing Art.8(1) GDPR, a minor who has reached 14 years of age may validly consent to processing of their personal data in relation to information-society services; below that age, consent must be given by whoever exercises parental responsibility.
Minor Profiling BansAmber
The Garante blocked TikTok's processing where the platform could not verify user age, holding that consent/contract from under-14s is invalid and thus devoid of any legal basis for further processing including profiling.
Claims (1):
- The Garante held that where a platform cannot verify a user's age, any consent or contract entered into by an under-14 user is invalid, leaving any associated processing (including for commercial/profiling purposes) devoid of a legal basis.
Education SettingsGreen
School information notices must be easily comprehensible to minors and are subject to Garante prior review for AI-based educational platforms.
Claims (1):
- The Garante issued a favourable opinion on a Ministry of Education AI-service scheme and accompanying guidelines for introducing AI in schools, requiring information notices to be easily comprehensible to minors.
Dependent AdultsRed
No dedicated dependent-adults (elderly/incapacitated persons) data-protection regime distinct from general GDPR safeguards was located in this research cycle.
Absence provenance: No dedicated dependent-adults data-protection guidance or enforcement item surfaced in this pass.. Searched: Garante privacy anziani incapaci tutela dati personali 2026.
Children & Vulnerable Groups
The Garante's provvedimento dated 3 July 2026 examined the generative-AI companion service character.ai, with particular attention to a dedicated version of the service designed for minor users, which had been launched in November 2024. This examination places Italy's data-protection regulator among those actively scrutinising generative-AI companion services for their treatment of under-18 users, a category of service that raises distinct concerns given the emotionally engaging, conversational nature of the product and the potential for minors to form parasocial attachments to an AI companion without adult-level capacity to assess the risks of doing so.
The existence of a dedicated minors-facing version of the service, launched nearly two years before the Garante's examination, indicates the provider had already made a deliberate product decision to serve the under-18 demographic, which in turn sharpens the regulatory question of what safeguards, age-verification mechanisms, and data-processing limitations were in place for that minors-specific product tier. The sources reviewed this cycle establish that the Garante examined the service and its minors-specific version, but do not specify the provvedimento's ultimate findings, remedial requirements, or sanctions, if any, arising from that examination.
This generative-AI/minors matter should be read alongside the broader algorithmic-governance developments this cycle, particularly the workplace-AI emotion-inference provvedimento, as both reflect the Garante applying heightened scrutiny to AI systems that engage with, infer from, or affect the psychological and emotional states of individuals, whether workers or, in this case, minor users of a generative-AI product.
Outlook
Further detail on the character.ai provvedimento's findings and any resulting remedial measures would clarify whether Italy is moving toward a more prescriptive standard for minors-facing generative-AI products specifically. Given the Garante's demonstrated pattern of proactive AI-system scrutiny this cycle, further provvedimenti addressing other generative-AI companion or chatbot services with minor-facing product tiers should be considered a plausible continuation of this line of regulatory attention.
1 earlier distinct update(s)
Children & Vulnerable Groups
The Garante's Character Technologies enforcement action carries a binding children's-data-protection dimension this cycle. Alongside the EUR 158,000 fine imposed 9 July 2026, the corrective-measures order requires Character Technologies to guarantee age-verification systems, implement cooling-off mechanisms preventing minor re-registration after account closure, and set default-private minor profiles, with compliance to be reported to the Garante within 120 days. This is a Confirmed-confidence, Tier-1-sourced finding with a binding compliance deadline, marking a tightening trajectory for this module.
The specificity of the corrective measures, particularly the cooling-off mechanism preventing re-registration and the default-private setting for minor profiles, indicates the Garante is moving beyond generic GDPR privacy-notice failures toward prescriptive, child-specific design requirements for generative-AI platforms likely to be used by minors. The 120-day reporting deadline gives a concrete compliance-verification point in the near term.
Outlook
Watch for Character Technologies' 120-day compliance report to the Garante, due in approximately early November 2026 based on the 9 July 2026 order date, which will indicate whether the prescribed age-verification and cooling-off measures were implemented as ordered.
Sources and claims (4)
- ConfirmedGarante Privacy — The Garante required Character Technologies to guarantee correctly functioning age-verification systems, ensure effective 'cooling-off' mechanisms preventing renewed registration attempts by blocked minors, and set minors' profiles to private by default.observed
- ConfirmedGarante Privacy — Under Art.2-quinquies of the Codice, implementing Art.8(1) GDPR, a minor who has reached 14 years of age may validly consent to processing of their personal data in relation to information-society services; below that age, consent must be given by whoever exercises parental responsibility.observed
- ConfirmedGarante Privacy / Agenda Digitale — The Garante held that where a platform cannot verify a user's age, any consent or contract entered into by an under-14 user is invalid, leaving any associated processing (including for commercial/profiling purposes) devoid of a legal basis.observed
- ConfirmedGarante Privacy — The Garante issued a favourable opinion on a Ministry of Education AI-service scheme and accompanying guidelines for introducing AI in schools, requiring information notices to be easily comprehensible to minors.observed