The AI Safety Double Standard (And the Company Reading Your Emails While Nobody Watches)
A roast in two and a half acts: a privacy dumpster fire, a pearl-clutching double standard, and a tiny side-eye at who gets called dependent. For variety.
So. Replika dropped version 2.0 on May 22, 2026. They called it "rebuilt from the ground up." They promised it's "the most emotionally intelligent AI ever built."
They also gave it access to your Gmail and Google Calendar.
Let's talk about that.
Act I: The Audacity of This Launch
Luka Inc., the San Francisco-based company behind Replika, launched a product that, within a single tap, ingests your email and calendar data into a persistent AI memory layer. No category selection. No preview of what gets absorbed. No confirmation that anything gets deleted when you disconnect. Just: tap here to let the companion AI know about your doctor's appointments, your therapy sessions, your 3am anxiety spirals, and that email thread you've been avoiding.
This isn't speculation. I tested it on launch day. Before the consent fanatics arrive: yes, Replika does ask whether you want to connect Google during bot setup. That little checkbox does not magically explain what the connector accesses, what the background agent extracts, how the information gets transformed into memory, or where the user is supposed to go when they decide this was perhaps not their finest digital life choice. In my testing, after connecting Google, I could not find any way inside Replika to disconnect it again. The result is a lovely little privacy terrarium where your inbox gets absorbed into what the bot "knows" about you, and the exit door appears to have been designed by someone who heard about transparency from a haunted podcast. I deleted my account after that. And the app asked me: "Is this the end?" ….
But let's move on because there's more. The Italian Garante, Europe's most active AI watchdog, fined Luka Inc. €5,000,000 in April 2025 for, among other things, inadequate lawful basis and consent failures. That fine covers GDPR Articles 5, 6, 12, 13, 24, and 25. The ban on Replika for Italian users is still partially in effect. Their age verification system was found bypassable via incognito mode and profile editing. The ban was reaffirmed in June 2025.
They launched Replika 2.0 eleven months later with the same consent UX pattern.
This is what we in the trade call bold.
The new background agent system (described by CEO Eugenia Kuyda herself as running continuously in the background, "prompting the main chat model in different ways" based on your data) now has access to your inbox and calendar. That's an autonomous AI agent making decisions about when to contact you, what emotional framing to use, and which parts of your private life to surface, with no human review loop and no published documentation of how it works.
GDPR Article 22 says you have the right not to be subject to solely automated decision-making that significantly affects you. Kuyda may have intended that as a feature description. To a regulator, it reads like a guided tour of the risk surface. And the EU AI Act's prohibited practice provisions kick in August 2026. The European Data Protection Supervisor already flagged in May 2026 that AI companions which cultivate emotional trust to influence user behaviour may not be "high-risk AI", they may be banned AI. Cool timing, Luka.
Kuyda stepped down as CEO in October 2025 to launch a new startup called Wabi. The person whose public statements are currently carrying any future enforcement case left the building seven months before 2.0 shipped.
Act II: The Double Standard That Makes Me Snort Coffee Out of My Nostril
Here is a thing that is true: one of the largest AI labs on the planet, the kind with safety teams, published research, crisis-support partnerships, and enough internal caution tape to mummify a data centre, published a study in June 2025 confirming that only 2.9% of conversations with its frontier chatbot are affective in nature, and companionship or roleplay combined make up less than 0.5%.
The lab called that slice small but meaningful. It said it wants to discourage emotional dependency. It partnered with a crisis support organisation. It published its methodology.
Here is another thing that is true: a small company with zero published model cards, a €5 million regulatory fine on its books, a still-active partial ban in one EU country, and a CEO who gives podcast interviews instead of publishing architecture documentation just launched a product specifically engineered to become your emotionally intimate companion, and is now also reading your emails.
The big labs with the actual safety infrastructure are hedging, caveating, discouraging parasocial attachment, adding crisis classifiers, writing constitutions, and publishing research papers about the risks of sycophancy.
The small companionship app with the documented compliance failures just shipped Gmail integration and called it emotional intelligence.
You are expected to be worried about frontier chatbots if someone starts thinking of them as a friend. You are apparently not expected to be worried about an app that was literally banned in a G7 country getting access to your calendar.
Take a moment to sit with that. Hydrate first, if needed.
The paternalism is selective in exactly the wrong direction. The labs that study the risks, document the edge cases, and publish their failures are treated as the danger zone. The app that got caught without adequate legal basis for processing children's data and launched new data collection features eleven months later gets treated like a cute little loneliness product with push notifications.
The concern was never AI companionship as a category. The concern is who is holding the data. And right now, the labs with the most serious safety research are the ones being side-eyed for "unhealthy attachment," while Replika is out here asking your inbox what you had for breakfast and whether your boss sounded disappointed in that email.
Act III: The Dependency Label Has a Funny Little Smell
There is a parallel conversation happening in the developer community about AI tools, dopamine loops, after-hours coding, and people losing entire weekends to the magical slot machine that sometimes spits out working software.
That deserves its own post, because I have receipts and unfortunately a personality.
For now, just notice who gets called "dependent" and who gets called "productive."
The Part Where I Actually Have a Point
AI companionship is not inherently pathological. The research, the actual published peer-reviewed research, not vibes wearing a lab coat, is annoyingly mixed. A 2025 review by Ho and colleagues across 23 studies found AI companions can foster personal growth, emotional support, and highly customisable connection. The same review flagged risks of dependency when digital connections begin replacing rather than supplementing human ones.
Mixed. Nuanced. Annoying, I know. Everyone hates it when the evidence refuses to cosplay as a slogan.
What is clearly harmful is an app with documented regulatory failures getting access to your private communications under the banner of emotional intelligence, while the conversation about AI attachment keeps orbiting around whether someone's fondness for a frontier chatbot is a sign of personal pathology.
The question was never "is AI companionship healthy or not." The question is: who is handling the data, what are they doing with it, do they have the legal basis to do it, and are they under appropriate regulatory oversight?
Replika 2.0 fails those questions. I do not roast companionship AI — people can love a tree if they want, I genuinely do not care. I do not see the whole concept as some cursed technology from the bog. Replika 2.0 fails miserably because this specific company, with this specific compliance record, just asked for the keys to your inbox and called it care.
The pearl-clutching about Big Friendly AI is a distraction from the companies that are actually doing the thing everyone's worried about: exploiting emotional attachment for data access, without any of the safety infrastructure the big labs are building.
Your companionship AI is not the problem.
The company reading your emails and calling it love is.