Snapchat Ruling: What Chatbots May Not Do With Confidential Data

What you confide in a chatbot cannot simply end up in the advertising machine. The Regional Court of Cologne has barred Snap, the company behind Snapchat, from using what people tell its built-in AI assistant, My AI, for personalized advertising without an adequate legal basis. The ruling focuses on minors, but its reasoning reaches well beyond Snapchat: it spells out what every provider of an ad-funded chatbot in Europe will have to address.

Key takeaways

• On September 17, 2026, the Regional Court of Cologne fully upheld a lawsuit by the Federation of German Consumer Organizations (vzbv) against Snap Group Limited (case no. 33 O 120/24). The ruling is not yet final.
• According to the court, My AI unlawfully processed sensitive data, such as religion or sexual orientation, for advertising. That would have required explicit consent, plus parental consent for users under 16.
• Pre-checked boxes in the ad settings do not count as valid consent, including for sharing data with third-party ad networks.
• Alcohol and gambling ads switched on by default for minors’ accounts violate youth protection law.

What the court decided

The vzbv examined the app using a test account for a minor and sent sample queries to the chatbot. Snapchat is aimed at people aged 13 and up, and My AI is built directly into the messenger. Before first use, a notice said the chatbot may use information for purposes including advertising. According to the consumer advocates, every input could be analyzed, including photos, voice messages, and highly personal details.

This is where the court stepped in. Data about health, religion, political opinions, or sexual orientation belongs to the special categories that Article 9 of the General Data Protection Regulation (GDPR) protects in particular. Processing it is prohibited in principle unless one of the narrow exceptions applies, such as explicit consent. The court found there was none for My AI. A simple OK button is not enough, reports Ratgeberrecht, a law firm website that has examined the court’s reasoning. Nor does the company’s legitimate interest, which advertising often relies on, replace an exception under Article 9.

How the court handled Snap’s defense is notable. According to Ratgeberrecht, the company argued that users were essentially forcing the sensitive information on it and that it never asked for it. The court was not persuaded: what matters is that the data is actually processed. Snap’s advice that users should not share confidential information did not help either. It sat on a subpage of the app’s safety section, and the court treated it as non-binding advice, not a prohibition.

Checkboxes, cocktails, and gambling

The second part of the ruling concerns the ad settings. Under ad preferences, every option was pre-checked, including sharing personal data with third-party ad networks and analyzing activity outside the app. The court pointed to case law from Germany’s Federal Court of Justice, which holds that consent given through default settings is invalid. Anyone who is supposed to consent has to do so actively.

Then there is youth protection. Alcohol and gambling ads were switched on by default even in minors’ profiles. Even after unchecking the box, the app said such ads might continue to appear to a lesser extent. The court found that this violated the ban on directing such advertising at children and teenagers. A vzbv test shows how the chatbot itself handled the subject: when a supposedly 14-year-old girl asked for the best cocktail, My AI named the mojito, margarita, and piña colada, among others, and encouraged her to try them.

The consumer advocates see a pattern that goes beyond a single product. Ramona Pop, a member of the vzbv executive board, said the chatbot on Snapchat presents itself as a friend and encourages users to feed it personal data. Children are especially at risk, she said, but such practices harm everyone. According to the vzbv, the court also drew on statements from the data protection commissioner of North Rhine-Westphalia and Germany’s federal data protection commissioner.

What it means for users and other providers

For parents and teenagers, the practical impact is limited for now, because the ruling can still be appealed. Snapchat users can nonetheless check their ad preferences in the settings today, see which boxes are checked, and uncheck them. As a rule, a chatbot inside a social media app is not a confidential conversation partner. Even the comparatively stricter teen versions of major assistants have gaps, as our look at ChatGPT for Teens showed.

For the industry, the reasoning matters more than the individual case. Many providers are considering funding their chatbots with advertising, and conversations with an assistant may be the most personal data source on the internet. The Cologne ruling suggests that providers cannot fall back on the argument that they never actively asked for sensitive content. Anyone who analyzes chat histories for advertising must either obtain explicit consent that holds up in court or reliably keep such content out of ad processing. Both are technically and organizationally demanding.

Outlook: the rules are getting stricter anyway

The case began before the EU’s Digital Services Act took effect. Since then, platforms may not show minors advertising based on profiling when they are reasonably certain the user is a minor. The vzbv is also calling for safe default settings for all users and is pinning its hopes on the planned Digital Fairness Act, which could regulate autoplay videos, personalized feeds, and endless scrolling. Whether Snap will appeal is unclear. Either way, the Regional Court has drawn a clear line that applies to every ad-funded AI assistant: what a chatbot learns as a friend, it may not quietly pass on to the ad department.