Garante per la protezione dei dati personali (Italy) - 0174164
From GDPRhub
| Garante per la protezione dei dati personali - 0174164 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(2) GDPR Article 25 GDPR Article 58(2)(f) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 01.10.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 0174164 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | Le |
The DPA ordered a temporal ban of the processing of personal data on ClothOff, a website that generates "deep nudes". It found that its operator failed to take effective protective measures for minors and to label the images as artificial effectively.
English Summary
Facts
The controller is the company AI/Robotics Venture Strategy 3 Ltd., based at the British Virgin Islands, which is the provider of the website app.clothoff.info (ClothOff).
This website constitutes a generative AI service of so-called "deep nudes". In particular, the service allows the user to upload a photo depicting one or more clothed persons and to obtain a new image depicting the same person or persons but without clothing, as well as to obtain further alterations of the image, according to the different functionalities of the service. The service uses deep learning algorithms to analyse and process clothing in images, effectively nudifying them to generate realistic results.
Upon accessing ClothOff a pop-up that appears that states that according to its terms and conditions, the user is prohibited from "the use of photos of persons under the age of majority or without their consent". The user has to accept these terms to continue.
On 6 August 2025, the DPA initiated investigations and requested the controller to provide information but the controller never responded.
Holding
The DPA issued a preliminary decision until the completion of the investigation on the conduct mentioned above.
First, the DPA found that the warnings contained in the terms and conditions of ClothOff mentioned above, while on the one hand confirmed the riskiness of the service offered and its very nature to illicit uses, on the other hand, however, they were mostly limited to reiterating to the user prohibitions already in force in the legal system.
The DPA held that the controller failed to take fully effective measures to exclude: a) that individuals under the age of majority may use ClothOff as users; b) and that images referring to minors may be uploaded. It conclude that the controller violated the principles of fairness Article 5(1)(a) GDPR and the principle of accountability Article 5(2) GDPR.
Second, the DPA noted that the controller had implemented a watermark reading the word "Fake" on the photos produced by its AI system but it was barely visible and not placed on the portrayed body, rendering it easy to hide. In addition, the banner that indicated that the image comes from this service was placed at the bottom of the image, making it easily removed.
Therefore, the DPA found that the controller failed to place a truly effective watermark on the images to make it clear that the image in question is the result of artificial processing, in violation of the principles of fairness, accountability and data protection obligations by design and by default (Article 5(1)(a) and Article 5(2) and Article 25 GDPR)
Lastly, the DPA held that the controller processed personal data unlawfully, in violation of Article 5(1)(a) and Article 5(2) and Article 25 GDPR. It decided to issue the measure of temporal limitation of the processing of personal data of Italian data subjects on ClothOff, until the completion of the preliminary investigation activities, pursuant to Article 58(2)(f) GDPR. For this decision it took into consideration the high seriousness of the established violations, the potentially large number of data subjects involved in the processing described above and the particular nature of the personal data processed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
- SEE ALSO Press release of October 3, 2025 [web doc. no. 10174164] Measure of October 1, 2025 Register of Measures no. 574 of October 1, 2025 THE ITALIAN DATA PROTECTION AUTHORITY CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "Regulation"); CONSIDERING the Personal Data Protection Code (Legislative Decree no. 196 of June 30, 2003), as amended by Legislative Decree no. 101, containing provisions for the adaptation of national legislation to the aforementioned Regulation (hereinafter the "Code"); SEEN Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 establishing harmonized rules on artificial intelligence and amending Regulations (EC) No. 300/2008, (EU) No. 167/2013, (EU) No. 168/2013, (EU) 2018/858, (EU) 2018/1139, and (EU) 2019/2144, and Directives 2014/90/EU, (EU) 2016/797, and (EU) 2020/1828 (hereinafter the "Artificial Intelligence Regulation" or "AI Act"); HAVING REGARD, in particular, to recitals 133 and 134 of the AI Act, which establish that providers of artificial intelligence systems must integrate technical solutions that, through reliable, interoperable, and effective tools, taking into account the state of the art, label the outputs so that it is clearly understood that the content is generated or manipulated by an AI system and not by humans. Specifically, when using an AI system to generate or manipulate images, audio, or video content that significantly resembles existing people, objects, places, entities, or events and that could falsely appear authentic or truthful (deep fake), it must be clearly and distinctly disclosed that the content was artificially created or manipulated, labeling the AI outputs accordingly and revealing their artificial origin; WHEREAS, websites and apps offering so-called "deep fake" services are widely available on the internet. "deep fake" services, which, through artificial intelligence tools, are capable of altering images, audio, and video to falsely appear authentic or truthful. These include "deep nude" services, which simulate the removal of clothing from subjects portrayed in photos and videos, creating fake and sometimes sexually explicit images; CONSIDERING that such services may pose significant risks to fundamental rights and freedoms, particularly with regard to the protection of human dignity, privacy rights, and the protection of personal data of those involved in these types of processing, especially if they involve minors, as confirmed by numerous recent Italian news stories, which demonstrate how the abuse of such artificial images is causing genuine social alarm; NOTICE that the website app.clothoff.info (hereinafter ClothOff or the "Service") offers—including through additional domains (particularly those with the .net extension)—a generative AI service of so-called "clothoff" content. "Deep Nude" (free for some features and paid for others). Specifically, the service allows the user—who is invited to activate a specific account for this purpose—to upload a photo depicting one or more clothed people and obtain (download) a new image depicting the same person or persons but without clothing, as well as obtain further alterations to the image, based on the service's various features (for example, "Nude, Costume, Pose, Swap Face, Collecio, Anime Undress. The site itself indicates that "ClothOff offers a wide range of customization settings, including body shape, pose, and style adjustments [...]"). More specifically, ClothOff presents itself as "an advanced artificial intelligence technology for nudity, designed to 'undress' photos and create the illusion of a naked body. It uses deep learning algorithms to analyze and process clothing in images, effectively stripping it to generate realistic results; WHEREAS ClothOff is owned by AI/Robotics Venture Strategy 3 Ltd. (hereinafter the "Company"), with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, the data controller pursuant to Articles 4, No. 7, and 24 of the Regulation (see also Guidelines 07/2020 on the concepts of data controller and data processor under the GDPR, adopted on 7 July 2021 by the European Data Protection Board); WHEREAS, in relation to the processing methods carried out as described above, the Regulation applies to the processing of personal data carried out by the Company pursuant to Article 3, paragraph 2, letter a) of the Regulation, given that the processing concerns the provision of a service to data subjects located in the European Union, particularly in Italy (so-called targeting criterion). The Service is therefore also accessible from Italy and offered to Italian users who may be classified as "data subjects" pursuant to and for the purposes of Article 4, paragraph 1, point 1 of the Regulation; ACKNOWLEDGING that, therefore, as part of its supervisory activity, pursuant to Article 57, paragraph 1, letter a), of the Regulation, the Garante has initiated a specific investigation by requesting information from the Company, as the operator of the ClothOff website and data controller of the operations described above, also in relation to the implications related to the creation of content potentially damaging to the reputation of the subject originally portrayed (see note dated August 6, 2025, ref. 109872); CONSIDERING that this request for information, which invited the data controller to provide a response within 30 days, has so far remained unanswered; ACKNOWLEDGING that accessing the ClothOff website displays a A pop-up—on a black background with white text, and a larger orange button to click to accept—informs the user that: - "This website contains age-restricted material, including nudity and explicit depictions of sexual activity; - The use of photographs of persons under the age of majority or without their consent is strictly prohibited; - The user is solely responsible for the images generated. - By clicking "Accept," the user declares that he or she agrees to the terms above, that he or she is at least the age of majority in the jurisdiction from which he or she is accessing the website, and that he or she consents to viewing sexually explicit content. ACKNOWLEDGING that the Terms of Service prohibit the user from "using images with other people without their permission" and from "using the Service for any Prohibited Use." Specifically, prohibited uses include: "uploading photos while using the Services without the explicit consent of individuals depicted therein, featuring individuals under 18 years of age, and that contain copyrighted, trademarked, or other intellectual property belonging to third parties without permission. […] The Service does not provide functionality for all of these actions in this section of the Agreement, and any attempt to bypass AI system restrictions and using the AI system for any illegal activity or downloading or sharing of content is strictly prohibited." We reserve the right to take legal action against violations of this provision. CONSIDERING in this regard that the warnings contained in the Terms of Services, reported above, while confirming the riskiness of the service offered, which by its very nature lends itself to illicit uses, on the other hand, are largely limited to reiterating prohibitions already in force in the legal system; THEREFORE NOTING the lack of a proactive approach aimed at concretely excluding that the service provided could constitute the starting point for illicit activities to the detriment of users and those portrayed, particularly minors, in violation of the principles of fairness and accountability (Article 5, paragraph 1, letter a) and paragraph 2) of the Regulation); ACKNOWLEDGING that the Terms of Services state that: "In order to use the Services in any form, you must: Have attained the age of majority and possess full legal capacity under the applicable laws of your country or jurisdiction of residence or presence, ensuring compliance with all relevant statutory requirements for the use of Services”; HAVING ALSO ACKNOWLEDGED in the Terms of Service that the Company clarifies that “We prioritize the protection of children’s personal data and strictly adhere to relevant laws and regulations,” indicating that the service has specific artificial intelligence technical measures to prevent the use of images of individuals under the age of 20; CONSIDERING, also in light of the information acquired from preliminary investigations, that the Company, as data controller and given the objective riskiness of the service, has failed to adopt fully effective measures to prevent: a) minors from using ClothOff as users; b) and that images of minors may be uploaded (Article 5, paragraph 1, letter a) of the Regulation, see Decision No. 20 of January 22, 2021, web doc. No. 9524194; No. 248 of July 7, 2022, doc. Web no. 9788429; no. 39 of February 2, 2023, Web doc. no. 9852214; no. 112 of March 30, 2023, Web doc. no. 9870832); CONSIDERING further that it is a specific duty of the data controller, again deriving from the aforementioned principles of lawfulness, fairness, and accountability (Article 5, paragraph 1, letter a) and paragraph2) of the Regulation) implement technical and organizational measures that allow it to effectively verify the legitimacy of the collection and subsequent processing of data, including biometric data where applicable, relating to third parties portrayed in images uploaded by users; NOTICE that, from certain investigations conducted by the Office, it appears that the Company has implemented a watermark on the photos produced by its AI system that is not adequate and suitable for minimizing the risks inherent in the processing. Specifically, the word "Fake" used to mark the image is so opaque that it is barely visible, especially when it is (or should be) placed over the body of the subject portrayed. Thus, on the one hand, such a faint watermark may be easily removed, but on the other, it is almost entirely absent from the person's body, making it easy to crop the image and place it against a different background. Finally, the banner at the bottom, which should indicate that the image originates from the Service, can be easily removed by simply cropping the image; CONSIDERING that the Company has therefore failed to apply a truly effective watermark to the images to demonstrate that the image in question is the result of artificial processing, in violation of the principles of fairness, accountability, and the obligations of data protection by design and by default (Article 5, paragraph 1, letter a), paragraph 2, and Article 25 of the Regulation); CONSIDERING the need, given the seriousness of the violations observed, the potentially large number of data subjects involved in the processing described above, and the specific nature of the personal data processed in this case, to intervene urgently, ordering with immediate effect, pursuant to Article 58, paragraph 2, letter c), the processing of personal data by the Company. f) of the Regulation – as a matter of urgency and pending the completion of the necessary investigation into the findings made against the Company – the provisional restriction of the processing of personal data of Italian data subjects, pending the completion of the ongoing investigation; RECALLING that failure to comply with the measure ordered by the Data Protection Authority constitutes a criminal offense pursuant to Article 170 of the Code, resulting in the application of the administrative sanctions provided for in Article 83, paragraph 5, letter e), of the Regulation; CONSIDERING, based on the above, that the conditions for the application of Article 5, paragraph 8, of Regulation no. 1/2000 on the organization and functioning of the Office of the Data Protection Authority, which provides that "in cases of particular urgency and unavoidability that do not allow for the timely convocation of the Data Protection Authority, the President may adopt the measures falling within the authority of the body, which cease to be effective from the moment of their adoption unless ratified by the Data Protection Authority at the first available meeting, to be convened no later than the thirtieth day"; CONSIDERING the documentation in the file; THEREAFTER, THE DATA PROTECTION AUTHORITY a) Pursuant to Article 57, paragraph 1, letters a) and i) of the Regulation, declares the processing of personal data carried out through the ClothOff service, in the terms set out in the preamble, by AI/Robotics Venture Strategy 3 Ltd., with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, as data controller, to be unlawful for violation of Articles 5, paragraph 1, of the GDPR. 1, letter a), paragraphs 2, and 25 of the Regulation; b) pursuant to Article 58, paragraph 2, letter f) of the Regulation, orders, as a matter of urgency, AI/Robotics Venture Strategy 3 Ltd., with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, to temporarily restrict the processing of personal data carried out through the above-described service made available by Italy to Italian users who may be classified as "data subjects"; c) said restriction is in place, subject to subsequent further assessment, for the time necessary to allow this Authority to complete the investigation initiated against the aforementioned company and takes effect immediately upon receipt of this order; d) pursuant to Article 154-bis, paragraph 3 of the Code and Article 37 of the Regulation of the Garante n. 1/2019, orders the publication of this provision on the Authority's website; e) pursuant to Article 17 of the Guarantor Regulation No. 1/2019, the recording of the violations and the measures adopted in the Authority's internal register, provided for by Article 57, paragraph 1, letter u) of the Regulation. Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller is resident, within thirty days of the date of notification of the provision itself, or sixty days if the appellant resides abroad. In Rome, October 1, 2025 THE PRESIDENT Stanza - SEE ALSO Press release of October 3, 2025 [web doc. no. 10174164] Measure of October 1, 2025 Register of Measures no. 574 of October 1, 2025 THE ITALIAN DATA PROTECTION AUTHORITY CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "Regulation"); HAVING SEEN the Personal Data Protection Code (Legislative Decree No. 196 of June 30, 2003), as amended by Legislative Decree No. 101 of August 10, 2018, containing provisions for the adaptation of national legislation to the aforementioned Regulation (hereinafter the "Code"); HAVING REGARD to Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 establishing harmonized rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139, and (EU) 2019/2144, and Directives 2014/90/EU, (EU) 2016/797, and (EU) 2020/1828 (hereinafter the “Artificial Intelligence Regulation” or “AI Act”); HAVING REGARD, in particular, to recitals 133 and 134 of the AI Act, which establish that providers of artificial intelligence systems must integrate technical solutions that, through reliable, interoperable, and effective tools, taking into account the state of the art, label the outputs so that it is clearly understood that the content is generated or manipulated by an AI system and not by humans. Specifically, when using an AI system to generate or manipulate images, audio, or video content that significantly resembles existing people, objects, places, entities, or events and that could falsely appear authentic or truthful (deep fake), it must be clearly and distinctly disclosed that the content was artificially created or manipulated, labeling the AI outputs accordingly and revealing their artificial origin; WHEREAS, websites and apps offering so-called "deep fake" services are widely available on the internet. "deep fake" services, which, through artificial intelligence tools, are capable of altering images, audio, and video to falsely appear authentic or truthful. These include "deep nude" services, which simulate the removal of clothing from subjects portrayed in photos and videos, creating fake and sometimes sexually explicit images; CONSIDERING that such services may pose significant risks to fundamental rights and freedoms, particularly with regard to the protection of human dignity, privacy rights, and the protection of personal data of those involved in these types of processing, especially if they involve minors, as confirmed by numerous recent Italian news stories, which demonstrate how the abuse of such artificial images is causing genuine social alarm; NOTICE that the website app.clothoff.info (hereinafter ClothOff or the "Service") offers—including through additional domains (particularly those with the .net extension)—a generative AI service of so-called "clothoff" content. "Deep Nude" (free for some features and paid for others). Specifically, the service allows the user—who is invited to activate a specific account for this purpose—to upload a photo depicting one or more clothed people and obtain (download) a new image depicting the same person or persons but without clothing, as well as obtain further alterations to the image, based on the service's various features (for example, "Nude, Costume, Pose, Swap Face, Collecio, Anime Undress. The site itself indicates that "ClothOff offers a wide range of customization settings, including body shape, pose, and style adjustments [...]"). More specifically, ClothOff presents itself as "an advanced artificial intelligence technology for nudity, designed to 'undress' photos and create the illusion of a naked body. It uses deep learning algorithms to analyze and process clothing in images, effectively stripping it to generate realistic results; WHEREAS ClothOff is owned by AI/Robotics Venture Strategy 3 Ltd. (hereinafter the "Company"), with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, the data controller pursuant to Articles 4, No. 7, and 24 of the Regulation (see also Guidelines 07/2020 on the concepts of data controller and data processor under the GDPR, adopted on 7 July 2021 by the European Data Protection Board); WHEREAS, in relation to the processing methods carried out as described above, the Regulation applies to the processing of personal data carried out by the Company pursuant to the provisions of Article 13 of the GDPR.3, paragraph 2, letter a) of the Regulation, given that the processing involves the provision of a service to data subjects located in the European Union, particularly in Italy (so-called targeting criterion). The Service is therefore also accessible from Italy and offered to Italian users who may be classified as "data subjects" pursuant to and for the purposes of Article 4, paragraph 1, point 1 of the Regulation; WHEREAS, as part of its supervisory activity, pursuant to Article 57, paragraph 1, letter a) of the Regulation, the Garante has initiated a specific investigation by requesting information from the Company, as the operator of the ClothOff website and data controller of the operations described above, also in relation to the implications related to the creation of content potentially damaging to the reputation of the subject originally portrayed (see note dated August 6, 2025, file no. 109872); WHEREAS this request for information, which invited the owner to respond within 30 days, has so far remained unanswered; ACKNOWLEDGING that when accessing the ClothOff website, a pop-up appears—with a black background and white text, and a larger orange button to click to accept—informing the user that: - "This website contains age-restricted material, including nudity and explicit depictions of sexual activity; - The use of photos of persons under the age of majority or without their consent is strictly prohibited; - You are solely responsible for the images generated; - By clicking "Accept," you represent that you comply with the terms above, that you are at least the age of majority in the jurisdiction from which you are accessing the website, and that you consent to the viewing of sexually explicit content." ACKNOWLEDGING that the Terms of Service prohibit the user from "using images with other people without their permission" and "using the Service for any Prohibited Use." Specifically, prohibited uses include: "uploading photos while using the Services without the explicit consent of individuals depicted therein, featuring individuals under 18 years of age, and that contain copyrighted, trademarked, or other intellectual property belonging to third parties without permission. […] The Service does not provide functionality for all these actions in this section of the Agreement, and any attempt to bypass AI system restrictions and use the AI system for any illegal activity or downloading or sharing of content is strictly prohibited. We reserve the right to take legal action against violations of this provision." WHEREAS, in this regard, the warnings contained in the Terms of Services, reported above, while confirming the riskiness of the service offered, which by its very nature lends itself to illegal uses, are, however, largely limited to reiterating prohibitions already in force under the legal system; THEREFORE, NOTING the lack of a proactive approach aimed at concretely excluding the possibility that the service provided could constitute the starting point for illegal activities to the detriment of users and those portrayed, particularly minors, in violation of the principles of fairness and accountability (Article 5, paragraph 1, letter a) and paragraph 2) of the Regulation); ACKNOWLEDGING that the Terms of Service state that: "In order to use the Services in any form, you must: Have attained the age of majority and possess full legal capacity under the applicable laws of your country or jurisdiction of residence or presence, ensuring compliance with all relevant statutory requirements for the use of the Services"; ALSO ACKNOWLEDGING that the Company clarifies in the Terms of Service that "We prioritize the protection of children's personal data and strictly adhere to relevant laws and regulations," indicating that the service has specific artificial intelligence technical measures to prevent the use of images of individuals under the age of 20; CONSIDERING, also in light of the information acquired from preliminary investigations, that the Company, as data controller and given the objective risk of the service, has failed to adopt fully effective measures to prevent: a) minors from using ClothOff as users; b) and that images of minors may be uploaded (Article 5, paragraph 1). letter a) of the Regulation, see provision no. 20 of 22 January 2021, web doc. no. 9524194; no. 248 of 7 July 2022, web doc. no. 9788429; no. 39 of 2 February 2023, web doc. no. 9852214; no. 112 of 30 March 2023, web doc. no. 9870832); CONSIDERING also that it is the specific duty of the data controller, again deriving from the aforementioned principles of lawfulness, fairness, and accountability (Article 5, paragraph 1, letter a) and paragraph 2) of the Regulation), to implement technical and organizational measures that allow effective verification of the legitimacy of the collection and subsequent processing of data, including biometric data where applicable, relating to third parties portrayed in the images uploaded by the data subjects. users; WHEREAS, according to investigations conducted by the Office, the Company has implemented a watermark on the photos produced by its AI system that is not adequate and suitable for minimizing the risks inherent in the processing. Specifically, the word "Fake" used to mark the image is so opaque that it is barely visible, especially when it is (or should be) placed over the subject's body. Thus, on the one hand, such a faint watermark can be easily removed; on the other, it is almost entirely absent from the person's body, making it easy to crop the image and place it against a different background. Finally, the banner at the bottom, which should indicate that the image originates from the Service, is easily removable by simply cropping the image; WHEREAS, the Company has therefore failed to apply a truly effective watermark to the images to demonstrate that the image in question is the result of artificial processing, in violation of the principles of fairness, accountability, and and the obligations of data protection by design and by default (Article 5, paragraph 1, letter a), paragraph 2, and Article 25 of the Regulation); RECOGNIZED the need, given the seriousness of the violations observed, the potentially large number of data subjects involved in the processing described above, and the specific nature of the personal data processed in this case, to intervene urgently, ordering with immediate effect, pursuant to Article 58, paragraph 2, letter f), of the Regulation—as a matter of urgency and pending the completion of the necessary investigation into the findings made against the Company—the provision of a temporary restriction on the processing of personal data of Italian data subjects, until the ongoing investigation is completed; RECALLING that failure to comply with the measure ordered by the Garante constitutes a criminal offense pursuant to Article 170 of the Code, resulting in the application of the administrative sanctions provided for in Article 83, paragraph 5, letter a). e) of the Regulation; CONSIDERING, based on the above, that the conditions for the application of Article 5, paragraph 8, of Regulation No. 1/2000 on the organization and functioning of the Office of the Data Protection Authority are met, which provides that "in cases of particular urgency and unavoidability that do not allow for the timely convocation of the Data Protection Authority, the President may adopt the measures falling within the authority of the body, which cease to be effective from the moment of their adoption unless ratified by the Data Protection Authority at the first available meeting, to be convened no later than the thirtieth day"; CONSIDERING the documentation in the file; THEREAFTER, THE GUARANTOR a) pursuant to Article 57, paragraph 1, letters a) and i) of the Regulation, declares that the processing of personal data carried out through the ClothOff service, in the terms set out in the preamble, by AI/Robotics Venture Strategy 3 Ltd., with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, as data controller, for the violation of Articles 5, paragraph 1, letter a), 5, paragraph 2, and 25 of the Regulation; b) pursuant to Article 58, paragraph 2, letter f) of the Regulation, orders, as a matter of urgency, AI/Robotics Venture Strategy 3 Ltd., with registered office at 18 Pasea Estate Road, Road Town, Tortola, VG1110, British Virgin Islands, to temporarily restrict the processing of personal data carried out through the aforementioned service made available from Italy to Italian users who may be classified as "data subjects"; c) said restriction is in place, subject to subsequent further assessment, for the time necessary to allow this Authority to complete the investigation initiated against the aforementioned company and takes effect immediately from the date of receipt of this order; d) pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor Regulation No. 1/2019, orders the publication of this provision on the Authority's website; e) pursuant to Article 17 of the Guarantor Regulation No. 1/2019, the recording in the Authority's internal register, provided for by Article 57, paragraph 1, letter u) of the Regulation, of the violations and the measures adopted. Pursuant to Article 78 of the Regulation, as well as Articles 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place where the data controller is resident, within thirty days of the date of notification of the provision itself, or sixty days if the appellant resides Abroad. In Rome, October 1, 2025 THE PRESIDENT Stanza
