Anyone deploying an AI chatbot must expect users to enter health data, religious beliefs or details about their sex life. A judgement by the Cologne Regional Court dated 17 September 2026 (Case No. 33 O 120/24, not yet final) in the legal dispute against Snapchat highlights the data protection risks: simply asking users not to enter sensitive data is not sufficient to prevent unlawful processing.
The problem: sensitive data despite a lack of intent
Snapchat’s AI chatbot ‘My AI’ is also aimed at young people aged 13 and over and invites them to ask ‘all sorts of questions’. The Federation of German Consumer Organisations took legal action against this because the service processed special categories of personal data without explicit consent in accordance with Article 9 of the GDPR.
The Regional Court of Cologne upheld the claim. According to the court’s assessment, with a chatbot that invites free-form input, it is to be expected that users will also disclose sensitive information. The fact that the provider did not specifically intend to collect this data, but that it is entered as part of the service’s use, does not automatically exonerate it.
Legal classification: Article 9 of the GDPR as the key hurdle
Article 9 of the GDPR generally prohibits the processing of special categories of personal data. These include, amongst other things, health data, information on religious or philosophical beliefs, and data relating to sexual life and sexual orientation. Processing is only permitted if an exemption under Article 9(2) of the GDPR applies.
A legitimate interest under Article 6(1)(f) of the GDPR is not sufficient on its own. Both provisions must be considered together: in addition to a legal basis under Article 6 of the GDPR, a relevant exemption to the prohibition in Article 9(1) of the GDPR is generally also required. For many commercial chatbot applications, explicit consent under Article 9(2)(a) of the GDPR is particularly relevant. However, whether this is required or whether another exemption applies depends on the specific processing operation.
Added to this is the broad interpretation of Article 9 of the GDPR by the ECJ, including in the Lindenapotheke case. Information from which sensitive characteristics can be indirectly inferred may also fall within the scope of the provision. This is particularly relevant for AI applications: even seemingly harmless inputs can allow conclusions to be drawn about a person’s state of health, religious beliefs or sexual orientation.
The way consent is structured is also crucial. A mere ‘OK’ button or pre-ticked checkboxes do not, in themselves, constitute valid explicit consent. Consent must be given voluntarily, in an informed manner, specifically, and through a clear, active action.
What deployers of AI chatbots should bear in mind
- Take unsolicited input into account: Bear in mind that users may disclose sensitive information even when this is not explicitly requested.
- Review technical safeguards: Investigate whether sensitive content can be detected as soon as it is entered, excluded from further processing or, where possible, handled in a manner that promotes data minimisation.
- Do not rely solely on warning messages: The message ‘Please do not enter any sensitive data’ is no substitute for a sound legal basis or appropriate technical and organisational measures.
- Document the legal basis and exemptions: For each relevant processing operation, check which legal basis under Article 6 of the GDPR and which exemption under Article 9(2) of the GDPR applies.
- Monitor chat histories and data flows: Scrutinise retention periods, access rights, transfers to external model providers, and any potential use for advertising, analysis or model training.
- Check for a data protection impact assessment: Clarify whether a DPIA under Article 35 of the GDPR is required, particularly when processing sensitive data.
Conclusion
From a data protection perspective, it is not merely a question of what data a provider specifically wishes to collect, but also of what processing their service actually enables and gives rise to expectations of. Deployers of AI chatbots should therefore begin by addressing the design of the input function, the technical processing and storage.