Landgericht Köln (Cologne Regional Court) has ruled against the British operator of a messaging service with an AI chatbot that is also offered in Germany over the processing of personal data for advertising purposes and default settings relating to alcohol and gambling advertising (LG Köln, judgment of September 17, 2026 – 33 O 120/24 (case no.)). In the view of the 33rd Civil Chamber, several features of the Snapchat messaging service violated data protection and youth protection requirements. The decision was issued following the oral hearing on July 16, 2026, and is not yet final.
Personal Data from the “My AI” Chatbot
The defendant, Snap Group Limited, operates Snapchat in Germany and is the contractual partner of end users based there. The London-based company is a wholly owned subsidiary of the US company Snap Inc. The messaging service is aimed at users aged 13 and over and, in particular, enables them to exchange messages, photos, and short videos.
The AI-powered chatbot “My AI” is integrated into the application. Users can ask it various questions and submit not only text but also photos, voice messages, and other personal information.
Notice Before First Use
When the chatbot was accessed for the first time, a notice appeared stating that “My AI” could use the information provided, among other things, to improve Snap Inc.’s products and personalize the user experience, including the advertising displayed. The notice could only be confirmed by selecting “Okay.”
According to the decision, this design did not meet the requirements for valid consent under data protection law. The court objected in particular to the fact that the chatbot could also collect and process specially protected personal data. This includes information concerning religion, health, or sexual orientation.
The defendant argued that such information was not specifically collected but was independently introduced into the communication by users. In the court’s view, this argument did not affect the applicability of the General Data Protection Regulation. The decisive factor was that the data was in fact collected and processed.
Explicit Consent Required for Sensitive Data
Art. 9 Abs. 1 DSGVO (Article 9(1) of the General Data Protection Regulation) generally prohibits the processing of special categories of personal data. Processing may be lawful, among other circumstances, where the data subject has given explicit consent for specified purposes.
Additional requirements apply to an online service offered directly to children. For users under the age of 16, consent must generally be given or authorized by the holders of parental responsibility. Snapchat’s contested design did not provide a corresponding means of obtaining consent.
In reaching its decision, the court took into account that the service can be used by minors from the age of 13. They are not yet aware of the risks associated with disclosing sensitive information to the same extent as adults. In its reasoning, Landgericht Köln also considered statements by the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia) and the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Federal Commissioner for Data Protection and Freedom of Information).
Default Settings for Personalized Advertising
In addition to the processing of data via “My AI,” Landgericht Köln examined the application’s advertising preferences. When the application was accessed for the first time, several options for the use of personal data for advertising purposes were already enabled.
The default settings covered the following areas in particular:
- Personal data could be used for targeted advertising.
- Under the contractual terms, data could be shared with third-party advertising networks.
- Online activity outside the Snapchat application could also be included in the analysis.
In the court’s view, the preselected options could not result in valid consent. It referred to the case law of Bundesgerichtshof (BGH, Federal Court of Justice), according to which pre-ticked checkboxes do not meet the statutory requirements for consent.
No Mere Right to Object
The defendant took the view that the preselected fields did not constitute consent but instead provided an opportunity to exercise the right to object under Art. 21 DSGVO (Article 21 of the General Data Protection Regulation). The Chamber did not accept this argument.
A right to object presupposes that the data processing was initially lawful. In the court’s view, preselecting the checkboxes reversed this principle. Landgericht Köln therefore prohibited the assumption that users had given comprehensive consent to the processing of their data by means of such default settings.
Alcohol and Gambling Advertising in Minors’ Accounts
Further objections concerned the advertising topics configured in Snapchat. Under “Interests & Lifestyle,” the categories of alcohol and gambling were preselected even for accounts belonging to users aged 13 and over who were minors.
A notice in the application also indicated that disabling the relevant settings would merely result in fewer advertisements on these topics being displayed. The court considered this design to be a violation of § 6 Abs. 5 JMStV (section 6(5) of the German Interstate Treaty on the Protection of Minors in the Media) and § 5 Abs. 2 GlüStV 2021 (section 5(2) of the 2021 German Interstate Treaty on Gambling).
The defendant stated that, pursuant to internal policies, minors were not shown advertisements for age-restricted products. This did not persuade the Chamber. Through the specific design of the application, the operator had conveyed to underage users that it was entitled to display alcohol and gambling advertisements. Whether it actually exercised this option under its internal policies was not decisive.
Test Query by a Purported 14-Year-Old Girl
The claimant, Verbraucherzentrale Bundesverband, had created an account for an underage user to test the application. The association is the umbrella organization of the 16 consumer advice centers of the German federal states and 29 other consumer policy associations.
According to the association, using the profile of a purported 14-year-old girl, the chatbot was asked which cocktail tasted best. “My AI” allegedly named several alcoholic cocktails in response and encouraged the user to try them. The association objected that such a response could encourage minors to consume high-proof alcoholic beverages.
The Chamber left open whether the chatbot’s response itself should be classified as advertising. However, it found, in any event, a sufficiently imminent risk of a first infringement through the delivery of alcohol and gambling advertising to minors.
Verbraucherzentrale Bundesverband’s Action Successful
Verbraucherzentrale Bundesverband based its claims for injunctive relief on the Unterlassungsklagengesetz (German Injunctions Act) and the Gesetz gegen den unlauteren Wettbewerb (German Act Against Unfair Competition); it derived one of the alleged infringements solely from the Unterlassungsklagengesetz. Landgericht Köln upheld the action in full.
For each violation of the injunction, an administrative fine of up to EUR 250,000 may be imposed. Alternatively, coercive detention of up to six months may be ordered and enforced against the members of the defendant’s board of directors.
Snap Group Limited was also ordered to reimburse the association for pre-litigation warning costs of EUR 242.99, plus interest at five percentage points above the base rate since June 26, 2024. The costs arose from a formal warning letter dated October 24, 2023. The defendant must also bear the costs of the legal proceedings.
The operative part of the judgment granting injunctive relief is provisionally enforceable upon the provision of security in the amount of EUR 20,000. In all other respects, provisional enforceability requires security amounting to 110 percent of the respective amount to be enforced.
Non-Final Decision of Significance for Digital Services
As the judgment is not yet final, the findings of Landgericht Köln are not conclusive. The warning letter of 24 October 2023 also predated the date from which the Digital Services Act applies, 17 February 2024. Its Article 28(2) prohibits providers of online platforms from presenting advertising based on profiling where they are aware with reasonable certainty that the user is a minor.
The decision highlights the importance of valid consent when processing personal data and the stricter requirements that apply where digital services are also aimed at minors. Companies and affected individuals with questions concerning the processing of sensitive data, consent mechanisms, or claims for injunctive relief under data protection law can obtain legal advice on data protection law from MTR Legal.
