Snapchat “My AI”: Cologne Court Bars Using Chat Data for Ads Without a Legal Basis

October 15, 2026 From Arno Lampmann

The Regional Court of Cologne has prohibited Snapchat from processing inputs into its AI chatbot “My AI” for advertising purposes without a legal basis. Pre-ticked advertising consents and preselected ad topics such as alcohol and gambling in minors’ accounts are also unlawful. The judgment concerns every business that uses a chatbot in an app, online shop or customer service and wants to analyse the chats for personalisation or advertising.

People who write to an AI chatbot often reveal more than they would in a search box: worries, illnesses, questions of faith or relationships. Snapchat wanted to use precisely this openness for advertising as well. Before “My AI” was used for the first time, a notice stated that the chatbot could use the information provided “to personalise your experience, including ads”. Users confirmed with “OK”. Snapchat is aimed at users aged 13 and over.

The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband, vzbv) sued and won in full before the Regional Court of Cologne (Landgericht Köln) (Regional Court of Cologne, judgment of 17 September 2026, case no. 33 O 120/24). The vzbv published the judgment on 15 October 2026. It is not yet final.

The key points of the decision:

Sensitive data: Art. 9 GDPR applies as soon as sensitive data actually enter the chat and are processed. The provider’s intention is irrelevant.
An “OK” is not consent: the notice before first use does not replace a legal basis, and legitimate interest is also ruled out.
No pre-ticked boxes: preselected ticks in the ad preferences are neither consent nor a “right to object”.
Protection of minors: alcohol and gambling must not be preselected as ad topics in minors’ accounts.
The subsidiary is liable: Snap Group Limited, based in London, is at least a joint controller, even though it attributes the data processing to its US parent company.

What were the proceedings against Snapchat about?

Three design features of the Snapchat app. The vzbv had sent a cease-and-desist letter on 24 October 2023 to Snap Group Limited, which offers Snapchat in Germany and is the contractual partner of German users, and then sued for an injunction.

The first point concerned the notice shown before “My AI”, a chatbot based on ChatGPT, is used for the first time. It stated, among other things, that “My AI” could use information provided by users to improve Snap Inc.’s products and to personalise the user experience, “including ads”. The second point concerned the ad preferences: the options “Audience-based”, “Activity-based” and “Third-party ad networks” were already ticked. The third point concerned the section “Interests and lifestyle”. There, the ad topics “Politics”, “Alcohol” and “Gambling” were preselected, including in the accounts of minor users. Above them was the text: “You can deactivate these settings to see fewer ads on these topics.”

Snap argued that only its US parent company was responsible. It said that no sensitive data were processed, that advertising was merely contextual, and that anyone who confided sensitive data to the chatbot against the provider’s advice was engaging in “imposed collection”. The pre-ticked boxes were said to serve the exercise of the right to object, and under internal policies minors were not shown alcohol or gambling ads. The Federal Commissioner for Data Protection (Bundesbeauftragte für den Datenschutz, BfDI) and the North Rhine-Westphalia Data Protection Commissioner submitted statements in the proceedings. The court largely followed them.

Why are chat inputs subject to the strict regime of Art. 9 GDPR?

Because sensitive data actually arise and are processed in the chat. Art. 9(1) GDPR prohibits in principle the processing of data concerning health, religion, political opinions, sexual orientation and other special categories. It is permitted only by way of exception, in practice usually only with explicit consent under Art. 9(2)(a) GDPR.

The court considers it obvious that users confide such data to a chatbot. With the sentence “You can ask me all kinds of questions…”, the chatbot even encourages users to “feed it with personal information”. Advice on a privacy sub-page not to disclose sensitive information did not help Snap: in the court’s words, it is “merely non-binding advice and not a prohibition”. Most users would not notice that page anyway. For minors, who are less aware of the risks, the disclosure of sensitive data is all the more likely.

The court rejected Snap’s objection that it did not want to obtain sensitive data at all, relying on the Court of Justice of the European Union (CJEU). The prohibition in Art. 9(1) GDPR applies regardless of whether the controller is specifically seeking to obtain sensitive information (CJEU, judgment of 4 July 2023, C-252/21). A concession in Snap’s defence was decisive: according to it, the text query entered in the chat is used to decide whether and which advertising is shown to the user in “My AI”. Snap did not obtain explicit consent. Because Art. 9 GDPR, as a special rule, precludes recourse to the general legal bases, the processing was unlawful for that reason alone.

Is a notice with an “OK” button or a legitimate interest sufficient?

No. In the alternative, the court also examined Art. 6 GDPR and reached the same result. Snap itself did not rely on consent. The notice before first use, which users have to confirm with “OK”, would not have been valid consent either.

Legitimate interest under Art. 6(1)(f) GDPR fails at the information stage. The controller must inform data subjects of the specific legitimate interests at the time the data are collected (CJEU, judgment of 9 January 2025, C-394/23). This was missing, as was any information on the legal basis. The court left open whether a balancing of interests would have come out in Snap’s favour. It did, however, indicate clear doubts, because the service is aimed in particular at children and young people.

Are pre-ticked boxes an “objection” under Art. 21 GDPR?

No. Germany’s Federal Court of Justice (Bundesgerichtshof, BGH) ruled back in 2020 that pre-ticked boxes do not constitute valid consent (BGH, judgment of 28 May 2020, I ZR 7/16 – Cookie Consent II). Consent requires an active act.

Snap therefore tried to reinterpret the ticks: rather than obtaining consent, they were meant to enable users to exercise their right to object under Art. 21 GDPR. The court did not accept this and adopted the reasoning of the BfDI. The right to object is a reactive right. It presupposes processing that is initially lawful on the basis of legitimate interests, which the data subject subsequently opposes. Pre-ticked checkboxes “reverse this logic and suggest preventive agreement before the processing begins”. Without information on the legal basis and the specific interests, users could not make a meaningful decision on an objection in any case.

Many apps and shops work with advertising options that are activated by default and can only be deselected. According to the judgment, this design is open to challenge.

Why are internal advertising policies not enough to protect minors?

Because what matters is the design the user sees. Under Section 6(5) of the German Interstate Treaty on the Protection of Minors in the Media (Jugendmedienschutz-Staatsvertrag, JMStV), advertising for alcoholic beverages must neither be directed at children or young people nor appeal to them in particular. For gambling advertising, a corresponding prohibition follows from Section 6(3) JMStV in conjunction with Section 5(2), fourth and fifth sentences, of the German Interstate Treaty on Gambling 2021 (Glücksspielstaatsvertrag 2021).

Snap had argued that, under Snap Inc.’s advertising policies, minors are not shown advertising for age-restricted products. The court left open whether this is true. By preselecting the topics “Alcohol” and “Gambling” in minors’ accounts, Snap was asserting towards its users the right to show them advertising on these topics. This alone created a risk of a first infringement (Erstbegehungsgefahr). According to the notice text, even deselecting them would only have led to “fewer” ads, not to none.

Who is liable if the parent company processes the data?

The company offering the service in Germany is liable as well. Snap Group Limited had argued that it did not collect any data itself; only the parent company Snap Inc. in the US did so. This was also stated in the privacy policy.

The court took a different view. Under its own terms of service, Snap Group Limited has itself granted a worldwide licence to host, store, analyse and distribute all content, and the terms provide for personalised advertising based on user data. It describes itself as a service provider within the meaning of the German act implementing the DSA (Digitale-Dienste-Gesetz, DDG). It must accept the consequences of this. It is therefore at least a joint controller under Art. 4(7) GDPR, and data subjects may exercise their rights against each controller under Art. 26(3) GDPR.

For jurisdiction, it was sufficient for the Regional Court that the app can be used anywhere in Germany and therefore also in Cologne (Section 32 of the German Code of Civil Procedure, ZPO). Because the United Kingdom is no longer a member of the EU, this provision also governed international jurisdiction. Under Section 2(2) No. 13 of the German Injunctions Act (Unterlassungsklagengesetz, UKlaG), the GDPR is a consumer protection law, so qualified associations can sue directly for infringements. The court left open whether the claims could also be based on the German Act against Unfair Competition (UWG).

This does not only affect Snap. Many providers from the US, the UK or Asia serve the German market through a European company and locate data processing with the parent company. The judgment shows that anyone who appears towards users as contractual partner and rights holder cannot present itself in court as a mere recipient of the data.

What does the judgment mean for businesses using AI chatbots?

The judgment concerns a large platform, but its standards apply to every chatbot whose inputs are used beyond merely answering the query. Businesses should now check the following:

Separate the purposes: processing chat inputs to answer the query is different from analysing them for advertising, profiling or product recommendations. The second purpose requires its own legal basis and, for sensitive data, explicit consent.
Free text is a risk: an open input field almost inevitably brings in data on health, religion or relationships. According to the judgment, a notice saying “Please do not enter sensitive data” does not change this.
No “OK” banner as a legal basis: a notice that users have to click away in order to use the chatbot is not consent.
Inform where the data arise: the legal basis and specific legitimate interests belong at the chatbot itself, not only in a long privacy policy.
Check default settings: advertising options must not be pre-ticked. This also follows from the principle of data protection by default in Art. 25(2) GDPR.
Think of minors: anyone addressing young people must not preselect age-restricted advertising topics. Under Art. 28(2) of the Digital Services Act (DSA), online platforms must not show profiling-based advertising to minors where they are aware with reasonable certainty that the user is a minor, and for users under 16, consent generally requires parental authorisation (Art. 8 GDPR).
Align group contracts with reality: the privacy policy, terms of use and agreements between parent and subsidiary should describe consistently who processes which data for which purposes.
Assess the AI Act and the GDPR separately: the transparency obligations for chatbots under Art. 50 of the EU AI Act require, among other things, a notice that users are interacting with an AI. They do not create a legal basis for data processing.

The standing of consumer associations to sue makes such mistakes expensive. The Regional Court threatened a coercive fine (Ordnungsgeld) of up to EUR 250,000 for each infringement. Anyone who receives a cease-and-desist letter should not sign the declaration to cease and desist without checking it, but should first clarify which data flows are actually affected and which design can be changed in a legally compliant way.

For users, the judgment is above all a signal. It does not award damages, because the vzbv only sought an injunction. Anyone who wants to know which chat content has been stored and used for advertising can request access under Art. 15 GDPR. Whether there is a claim for non-material damages under Art. 82 GDPR in an individual case depends on whether specific damage, such as a loss of control over one’s own data, can be demonstrated.

From LHR’s practice

Advertising profiles without consent also fail before the Regional Court of Cologne outside the chatbot context. In proceedings conducted by LHR, the court prohibited an online retailer from building user profiles from page views, shopping baskets and opened newsletters. A cookie banner did not help. You can read the details in our article “Tracking without consent – Regional Court of Cologne prohibits user profiles from website and e-mail data” (in German).

Frequently asked questions on AI chatbots, data protection and advertising

May businesses use inputs into an AI chatbot for advertising?+

Only with a valid legal basis. According to the judgment of the Regional Court of Cologne of 17 September 2026 (33 O 120/24), Art. 9 GDPR regularly applies to chat inputs, because users also disclose sensitive data there. Explicit consent is then generally required. A notice with an “OK” button is not sufficient.

Does a notice not to enter sensitive data in the chat help?+

No. The Regional Court of Cologne treats such a notice as non-binding advice and not as a prohibition. If sensitive data are actually entered and processed, Art. 9 GDPR applies, regardless of whether the provider intended to collect such data.

Are pre-ticked advertising options in app settings permissible?+

No, if they are meant to obtain consent. Consent requires an active act (BGH, I ZR 7/16). The Regional Court of Cologne rejected reinterpreting them as a right to object under Art. 21 GDPR, because an objection presupposes processing that was lawful in the first place.

Is the European subsidiary liable if the parent company processes the data?+

Yes, at least where it offers the service and has extensive rights to user data granted to itself in its terms. The Regional Court of Cologne regarded Snap Group Limited as at least a joint controller under Art. 4(7) and Art. 26 GDPR.

Is the judgment against Snapchat final?+

No. According to the vzbv, the judgment of the Regional Court of Cologne of 17 September 2026 is not final. An appeal to the Higher Regional Court of Cologne (Oberlandesgericht Köln) is possible.

Do you use an AI chatbot in Germany or have you received a cease-and-desist letter over data protection?

We review the data flows, notices and default settings of your chatbot and defend you against cease-and-desist letters from associations and competitors. You will usually receive an initial assessment within 24 hours.