Anyone operating an AI chatbot must expect that users may entrust the system with particularly sensitive information. The processing of such data is then governed by Article 9 of the General Data Protection Regulation (GDPR) and generally requires explicit consent. This is clear from a judgement by the Cologne Regional Court (Case No. 33 O 120/24 of 17 September 2026).

In this case, the Federation of German Consumer Organisations (vzbv) had brought an action for an injunction against Snap Group Limited, which offers the „Snapchat“ app in Germany. Since mid-2023, the app has featured a free AI chatbot called „My AI“, which is based on a customised version of ChatGPT. Before using the chatbot for the first time, a notice appeared which users had to confirm by selecting „OK“. In doing so, they gave their consent for their information to be used, amongst other things, to personalise adverts.

The Regional Court has now prohibited the processing of chatbot inputs for advertising purposes. The chatbot explicitly encourages users to ask it all sorts of questions. This would predictably lead to the disclosure of sensitive data, particularly as the app is also aimed at minors, who are less aware of these risks. However, under Article 9 of the GDPR, specific data processing requirements apply to special categories of personal data. Whether the operator specifically intended to collect sensitive information is also irrelevant. The mere advice not to enter any confidential data is a non-binding recommendation and not a prohibition. The defendant did not obtain explicit consent in accordance with Article 9(2)(a) of the GDPR. Nor does the notice confirmed with „OK“ constitute sufficient consent. Furthermore, the court ruled that the company must not include pre-ticked boxes for advertising consent or the pre-selection of the advertising topics „alcohol“ and „gambling“ in the accounts of minors within its app.

For local authorities and other public bodies, it is not so much the advertising issues as the Regional Court’s comments on the processing of special categories of personal data that are of significance: „Any public authority using an AI chatbot for citizen services or general enquiries must expect that information relating to health, religion or similarly sensitive topics within the meaning of Article 9 of the GDPR may also be provided,“ explains Rechtsanwalt’s Michael Jessen-Lieberum. „A general notice that users simply click away is generally not sufficient: if the processing of the data entered is to be based on consent, that consent must be given explicitly and must clearly cover the sensitive data as well.“

The judgement is not yet final.