What happened
The 33rd Civil Chamber of the Regional Court of Cologne ruled that Snap Group Limited, the German subsidiary that contracts with Snapchat users, may not process personal data collected through the My AI chatbot for advertising without a lawful basis. The judgment also prohibited the use of pre‑ticked consent boxes for ad preferences and the default selection of alcohol and gambling as ad topics in accounts of users under 18. For each breach, the court can impose an administrative fine of up to €250,000 or, alternatively, a six‑month detention of board members. Snap must also reimburse €242.99 in costs incurred by the Verbraucherzentrale Bundesverband (vzbv) and bear the court’s costs. The orders are provisionally enforceable, with a security deposit of €20,000 required for each injunction.
On 17 September 2026, the Cologne Regional Court (Landgericht Köln) issued a judgment in case 33 O 120/24, upholding a lawsuit filed by the Verbraucherzentrale Bundesverband (vzbv) in March 2024. The court found that Snap Group Limited had unlawfully processed personal data gathered via the My AI chatbot for advertising purposes without a valid legal basis under the GDPR.
Three specific prohibitions were ordered: (1) processing My AI data for ads without consent; (2) using pre‑ticked checkboxes to obtain consent for ad‑data processing; and (3) pre‑selecting "Alkohol" and "Glücksspiel" as ad topics for minors, even though users could later disable them. Each prohibition is illustrated by court‑exhibited screenshots (Exhibits K1‑K3).
For each instance of non‑compliance, the court may levy an administrative fine of up to €250,000 or impose up to six months of detention on board members. Snap must also reimburse €242.99 in costs to the vzbv and cover the court’s procedural expenses. The injunctions are provisionally enforceable, requiring a €20,000 security deposit per order.
Snap attempted a late submission on 13 September 2026, citing European Data Protection Board guidance, but the court rejected the brief, finding no new factual basis to reopen the hearing. No statement from Snap regarding an appeal was included in the publicly released documents.
Why it matters
The ruling directly targets the way a major social‑media platform leverages generative‑AI chat data for targeted advertising, highlighting that GDPR’s special‑category data protections apply even when users voluntarily share sensitive information with a chatbot. By invalidating pre‑ticked consent mechanisms and default ad‑topic settings for minors, the decision reinforces strict consent standards for any AI‑driven personalization. The case sets a precedent for other EU‑based services that use conversational AI to inform ad delivery, especially where minors are involved, and signals that regulators will enforce substantial penalties for non‑compliance. It also clarifies the legal responsibilities of subsidiaries versus parent companies under joint‑controller rules, potentially reshaping data‑processing contracts across the tech industry.
The decision underscores that GDPR’s Article 9 special‑category data rules apply to AI‑driven services, even when users voluntarily disclose sensitive information to a chatbot. The court rejected Snap’s argument that it only processed non‑sensitive data or that consent could be inferred from a simple "OK" button.
By banning pre‑ticked consent boxes, the ruling reaffirms EU case law that consent must be an active, informed act, not a default setting. This has immediate implications for any platform that relies on similar UI patterns for data collection, especially in the context of personalized advertising.
The judgment clarifies joint‑controller responsibilities, holding the German subsidiary accountable despite Snap Inc.’s claim that the parent company processes the data. This interpretation may affect how multinational tech firms structure their European operations and data‑processing agreements.
For minors, the court’s application of youth‑protection statutes (JMStV) to AI‑driven ad settings signals stricter scrutiny of how platforms present age‑restricted content, potentially prompting broader industry changes to default ad configurations.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
Impossibility results in algorithmic fairness (e.g. Kleinberg et al., Chouldechova) show what?
What to watch next
Key developments to monitor include whether Snap appeals the decision, how quickly the court enforces the fines, and whether other EU regulators issue similar rulings against AI‑driven ad personalization. The judgment may revisions to privacy notices and consent flows across platforms that embed generative chatbots. Additionally, the case could influence upcoming EU legislation on AI and data protection, as well as corporate strategies for handling sensitive user data in AI services.
Whether Snap files an appeal and how the appellate process may affect enforcement timelines.
Potential follow‑up actions by German data‑protection authorities or the European Data Protection Board, which could issue further guidance or fines.
Reactions from other EU‑based platforms that embed generative‑AI chatbots, which may pre‑emptively adjust consent mechanisms and default ad settings to avoid similar penalties.
Legislative developments in the EU’s upcoming and possible amendments to GDPR that could codify stricter rules for AI‑driven data processing.