EU Data Protection Board Launches Formal Investigation into AI Startup Instinct Following $350M Fundraise

The investigation marks the most significant regulatory challenge yet for Instinct, which has become a poster child for AI hype in 2026. The startup's AI assistant, known for its uncanny ability to mimic human conversation and predict user needs, has amassed over 50 million monthly active users since its launch. Investors, including prominent venture capital firms, were drawn to its explosive growth, culminating in the $350 million Series A round that valued the company at $2.5 billion.

However, the speed of Instinct's ascent has attracted scrutiny from privacy advocates and regulators alike. The EDPB's investigation will examine whether the company's data collection practices—specifically its use of personal conversations, browsing history, and location data to train its models—complies with GDPR requirements for explicit consent, data minimization, and purpose limitation.

"We have received multiple complaints from users and civil society organizations regarding Instinct's data handling," said an EDPB spokesperson. "The board has decided that a coordinated EU-wide investigation is necessary to ensure uniform enforcement of data protection law."

Instinct responded with a statement affirming its commitment to user privacy. "We are confident that our practices comply fully with GDPR and all applicable laws. We look forward to cooperating with the EDPB and demonstrating our rigorous data governance framework," the company said. It did not comment on whether it would pause any data collection activities during the investigation.

The probe adds a layer of uncertainty to Instinct's growth trajectory. The company had been in talks to launch an enterprise version of its AI assistant and had announced plans to expand into European markets next quarter. Regulatory action could delay those plans or force changes to its core product.

The EDPB investigation is in its early stages and could take months to conclude. Potential outcomes range from a clean bill of health to orders requiring data deletion, fines of up to 4% of global revenue, or even restrictions on offering the service in Europe.

Why This Matters

Direct impact on users: If the probe finds violations, Instinct may be required to change how it collects and uses data, affecting privacy for millions of European users and potentially setting a precedent for other AI companies.
Broader significance for AI regulation: This is one of the first coordinated EU-wide investigations targeting a fast-growing AI startup, signaling that regulators will not give a free pass to companies riding the AI hype wave.
Investor confidence at risk: The regulatory cloud could spook current and future investors, potentially dampening valuations in the AI startup sector and forcing a reckoning between growth-at-all-costs and compliance.

Background

Instinct was founded in mid-2025 and quickly became a viral sensation for its AI assistant that users described as eerily intuitive. The product learned from every interaction, leading to rapid user growth but also raising immediate red flags among privacy experts. In early 2026, the company faced criticism for a terms-of-service update that some argued gave it sweeping rights to user data.

The $350 million funding round, announced on August 26, 2026, was led by Sequoia Capital and Andreessen Horowitz, bringing the company's total funding to $400 million. The round made headlines as one of the largest ever for a startup of its age. Critics, however, warned that the valuation was inflated by hype and masked fundamental risks around data privacy.

The EDPB has grown increasingly aggressive in enforcing GDPR against tech companies. In the past year, it has levied fines against Meta, Google, and several smaller AI firms. The investigation into Instinct continues this trend, but its focus on a pre-revenue startup is notable.

Key Perspectives

Instinct (company): Argues that its data practices are compliant and that user consent is obtained transparently. It views the investigation as a misunderstanding that will be resolved through cooperation. Emphasizes the benefits of personalized AI and the importance of data for model improvement.

Privacy advocates and consumer groups: Contend that Instinct's business model is inherently incompatible with GDPR, as it relies on collecting vast amounts of user data with insufficient transparency. They point to the startup's rapid growth as evidence that enforcement has been too slow to curb potentially exploitative practices.

EDPB (regulators): Seek to uphold GDPR standards and send a signal that no company, regardless of hype, is above the law. They may use this case to clarify how data protection rules apply to AI training data, especially the distinction between necessary processing and data hoarding.

Investors and industry observers: Concerned about the chilling effect on AI investment if regulatory risk becomes a standard feature of the landscape. Some argue that the investigation is overreach and could stifle innovation, while others see it as a necessary correction to a market that has ignored privacy compliance.

What to Watch

Instinct's response to the investigation: Whether it voluntarily halts data collection or uses the probe to challenge GDPR interpretations. A combative stance could escalate into a legal fight.
Timeline of the EDPB's findings: The board's preliminary assessment could come within 60–90 days. If it finds early indications of serious violations, it could issue interim measures such as a suspension of data processing.
Market reaction: Watch for movements in Instinct's private secondary market valuations and whether the investigation impacts the company's ability to close its planned enterprise deals.
Broader regulatory ripple effects: Other EU data protection authorities are monitoring the case. Their subsequent actions against similar AI chatbot companies could follow, depending on the outcome.

ZOTPAPER