Anyone deploying an AI chatbot must expect users to enter health data, religious beliefs or details about their sex life. A judgement by the Cologne Regional Court dated 17 September 2026 (Case No. 33 O 120\/24, not yet final) in the legal dispute against Snapchat highlights the data protection risks: simply asking users not to enter sensitive data is not sufficient to prevent unlawful processing.<\/p>\n\n\n\n
The problem: sensitive data despite a lack of intent<\/strong><\/p>\n\n\n\n Snapchat\u2019s AI chatbot \u2018My AI\u2019 is also aimed at young people aged 13 and over and invites them to ask \u2018all sorts of questions\u2019. The Federation of German Consumer Organisations took legal action against this because the service processed special categories of personal data without explicit consent in accordance with Article 9 of the GDPR.<\/p>\n\n\n\n The Regional Court of Cologne upheld the claim. According to the court\u2019s assessment, with a chatbot that invites free-form input, it is to be expected that users will also disclose sensitive information. The fact that the provider did not specifically intend to collect this data, but that it is entered as part of the service\u2019s use, does not automatically exonerate it.<\/p>\n\n\n\n Legal classification: Article 9 of the GDPR as the key hurdle<\/strong><\/p>\n\n\n\n Article 9 of the GDPR generally prohibits the processing of special categories of personal data. These include, amongst other things, health data, information on religious or philosophical beliefs, and data relating to sexual life and sexual orientation. Processing is only permitted if an exemption under Article 9(2) of the GDPR applies.<\/p>\n\n\n\n A legitimate interest under Article 6(1)(f) of the GDPR is not sufficient on its own. Both provisions must be considered together: in addition to a legal basis under Article 6 of the GDPR, a relevant exemption to the prohibition in Article 9(1) of the GDPR is generally also required. For many commercial chatbot applications, explicit consent under Article 9(2)(a) of the GDPR is particularly relevant. However, whether this is required or whether another exemption applies depends on the specific processing operation.<\/p>\n\n\n\n Added to this is the broad interpretation of Article 9 of the GDPR by the ECJ, including in the Lindenapotheke case. Information from which sensitive characteristics can be indirectly inferred may also fall within the scope of the provision. This is particularly relevant for AI applications: even seemingly harmless inputs can allow conclusions to be drawn about a person\u2019s state of health, religious beliefs or sexual orientation.<\/p>\n\n\n\n The way consent is structured is also crucial. A mere \u2018OK\u2019 button or pre-ticked checkboxes do not, in themselves, constitute valid explicit consent. Consent must be given voluntarily, in an informed manner, specifically, and through a clear, active action.<\/p>\n\n\n\n What deployers of AI chatbots should bear in mind<\/strong><\/p>\n\n\n\n Conclusion<\/strong> Anyone deploying an AI chatbot must expect users to enter health data, religious beliefs or details about their sex life. A judgement<\/p>\n\n
From a data protection perspective, it is not merely a question of what data a provider specifically wishes to collect, but also of what processing their service actually enables and gives rise to expectations of. Deployers of AI chatbots should therefore begin by addressing the design of the input function, the technical processing and storage.<\/p>\n","protected":false},"excerpt":{"rendered":"