The Regional Court of Cologne on September 17, 2026 barred Snap Group Limited, the London company that contracts with Snapchat users in Germany, from processing personal data gathered through the My AI chatbot for advertising without a legal basis, upholding a lawsuit the Federation of German Consumer Organisations filed in March 2024. The same judgment outlawed pre-ticked boxes in Snapchat's ad preferences and the default selection of alcohol and gambling as ad topics in the accounts of minors.

In Short

A German court told the company behind Snapchat in Europe that it cannot use what people type into its My AI chatbot to pick ads for them without a proper legal reason, and that it cannot tick permission boxes on people's behalf. This matters to anyone selling or buying ads around chatbot conversations, and to apps used by teenagers, because Snapchat had also switched on alcohol and gambling ad topics by default for users under 18. If Snap repeats any of the three practices, a court can make it pay a penalty every single time it happens.

What the Cologne court ordered

The 33rd Civil Chamber of the Landgericht Köln handed down its judgment in case 33 O 120/24 on September 17, 2026, following an oral hearing on July 16, 2026. According to the judgment, the claim succeeded in full. The plaintiff, the Verbraucherzentrale Bundesverband (vzbv), is the umbrella body of Germany's 16 regional consumer advice centres and 29 further consumer policy associations. The defendant is a wholly owned subsidiary of Snap Inc., its US parent, and distributes Snapchat in selected countries, Germany among them, acting as the contractual partner of German end users, according to the court's statement of facts.

Three separate prohibitions now bind the company in its dealings with consumers in relation to the Snapchat app. The first forbids processing, for advertising purposes and without a legal basis, personal data collected through My AI, the generative chatbot built into the app, where that processing takes place as described in the pop-up shown before the chatbot is used for the first time. The second forbids obtaining consent to the use of personal data for advertising through pre-ticked checkboxes. The third forbids preselecting "Alkohol" and "Glücksspiel" - alcohol and gambling - as ad topics in the accounts of minors while telling those users that the settings can be switched off to see fewer ads on those subjects.

Each order is anchored to a screenshot. Exhibit K1 shows the My AI pop-up, Exhibit K2 the ad preferences screen and Exhibit K3 the interests menu, and the operative wording limits each prohibition to conduct as depicted in the matching exhibit. The scope is narrow in form. The reasoning behind it is not.

Penalties, costs and enforcement

For each case of non-compliance, the court set a potential administrative fine capped at 250,000 euros or, alternatively, coercive detention of up to six months, the detention to be enforced against members of the company's board of directors, according to the judgment. Snap must also reimburse 242.99 euros the vzbv spent on a formal warning letter dated October 24, 2023, with interest at five percentage points above the base rate running from June 26, 2024 - the day after the lawsuit was served. It bears the costs of the proceedings. The court fixed the value in dispute at 22,500 euros.

The judgment is provisionally enforceable. The injunctions can be enforced against a security deposit of 20,000 euros, and the payment order against security of 110% of the amount being enforced. A court registry official certified the pronouncement on September 18, 2026. The documents published by the vzbv do not indicate whether Snap has appealed, and they contain no statement from the company on the outcome.

Three years from warning letter to judgment

The dispute began with that warning letter in October 2023. The vzbv filed its injunction action on March 22, 2024, and the complaint was served on the opposing party on June 25, 2024, according to the case record the organisation published. Its status page carries a date of September 21, 2026. The case is entered in the German register of representative actions, and consumers do not need to sign up to benefit from any outcome, according to the vzbv.

Two data protection authorities weighed in with written statements. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) submitted one dated September 8, 2025. The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) followed on January 14, 2026. The chamber expressly adopted reasoning from both.

Snap attempted a late intervention of its own. On September 13, 2026 - four days before the ruling - it filed a written submission the court had not authorised, citing interpretation aids published by the European Data Protection Board (EDPB). The chamber disregarded new factual material in it under section 296a of the Code of Civil Procedure and saw no ground to reopen the hearing under section 156.

Inside the My AI pop-up

My AI is, in the court's description, a chatbot based on ChatGPT that relies on generative artificial intelligence, answers users' questions and holds conversations with them. Before its first use, Snapchat displays a one-time notice - the court calls it a JIT, or just-in-time, notice - that users must confirm. Exhibit K1 shows a dark "Okay" button beneath the text.

The notice, headed "Say hi to My AI", explains that the chatbot is generative and that, "unlike chats with friends, all content from My AI is retained unless you delete it." Its second paragraph carries the sentence at the heart of the case: "My AI can use information you provide to improve Snap Inc.'s products and to personalise your user experience, including ads." Quotations from the judgment and its exhibits in this article are PPC Land translations from the German original.

The vzbv argued that users share sensitive data with the chatbot, minors among them, and that processing such data requires explicit consent under Article 9(2) of the GDPR, which Snap never sought. Nor, in the association's view, could the processing be brought under any of the grounds in Article 6.

Snap's defence

Snap's position, as recorded in the judgment, had several layers. The company said it collects no data itself; only its parent does. It said any processing is covered by legitimate interests under Articles 5 and 6. No special category data is processed, it argued, only non-sensitive personal data. The ads displayed, it said, were contextual rather than personalised. Collecting sensitive data through My AI was never intended, and if users disclosed such information against Snap's advice, that amounted in the company's words to an "imposed collection".

Why Article 9 applied

The chamber rejected each point. Its starting position was structural. Article 9(1) prohibits processing of data disclosing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used to identify a person uniquely, health data and data on sex life or sexual orientation. Such processing is permitted only where one of the exceptions in Article 9(2)(a) to (j) applies. Because Article 9 operates as lex specialis, a controller cannot fall back on the general grounds in Article 6(1) when those exceptions are absent, according to the judgment - even where sensitive and non-sensitive data are collected together.

That last point rests on a Court of Justice judgment the chamber cites by its German law-report reference, GRUR 2023, 1131. The citation corresponds to the July 4, 2023 ruling in Case C-252/21, Meta Platforms v Bundeskartellamt, the same decision on which PPC Land's analysis of LinkedIn's BrowserGate relied to show that the Article 9 ban does not depend on intent. German courts have been reading the category widely: a Wiesbaden court has found that shopping cart data can qualify as sensitive when it comes from online pharmacies and sex shops.

Sending sensitive data to My AI is, the court found, not merely possible. Users are encouraged to do it. The chatbot's first message tells them: "You can ask me all sorts of questions..." Snap pointed to a product privacy page within its Privacy and Safety Hub that tells users not to share confidential or sensitive information. The court was unmoved. That warning is "only a non-binding piece of advice and not a prohibition," according to the judgment, and a large share of users can be assumed never to see the relevant subpage at all.

The audience compounded the problem. Snapchat is aimed at users aged 13 and over. Minors, the chamber wrote, are known to be less alert than adults to the risks of disclosing sensitive information, which makes it all the more likely that they will share such data with a chatbot. The court adopted the LDI NRW's analysis on that point.

Snap's own filings then undercut the contextual advertising argument. On page 28 of its statement of defence, describing how a user request flows through the system, the company conceded that "the text query of a user entered into the chat interface with My AI, but excluding all images" is among the data used to decide whether an ad is shown to a user in My AI, and which one, according to the judgment. What users type is therefore processed. The court added that Snap's terms of service reserve the right to use collected information for personalised advertising, and that the privacy policy says data may be used to personalise ads.

The "imposed collection" argument fared no better. Neither the wording of Article 9 nor the case law of the Court of Justice supports the idea that the prohibition applies only where a controller intends to derive sensitive information, according to the judgment; the ban applies whether or not the controller is aiming at such data. Sample queries the vzbv submitted from purportedly underage accounts, the court added, showed that sensitive personal data was in fact being processed.

With Article 9 engaged, the rest followed quickly. Snap did not even claim to have obtained explicit consent under Article 9(2)(a), and none of the other exceptions applied. The processing was unlawful.

A second route, also closed

The chamber went further. Even if Article 9 had not applied, it held, the processing would still have lacked a lawful basis under Article 6. Snap did not rely on consent, and the just-in-time notice confirmed with "OK" would not have amounted to valid consent in any case, a point on which the court referred to page 2 of the LDI NRW statement.

Legitimate interest under Article 6(1)(f) failed on disclosure. Relying on it requires the controller to tell users about its legitimate interests directly at the moment the data is collected, the court held, citing paragraph 52 of the Court of Justice's January 9, 2025 judgment in Case C-394/23 - the Mousse case, better known for its treatment of data minimisation. Snap supplied neither that information nor the legal basis for processing. The chamber therefore had no need to run the balancing test, but noted "purely as a precaution" that it doubted the outcome would favour Snap, particularly because the service is directed also, and above all, at children and minors.

Snap's European company is a controller

Snap Group Limited's most fundamental argument was that the vzbv had sued the wrong entity. Only Snap Inc. processes the data, it said, which is also what the privacy policy for the European Economic Area and the United Kingdom (Exhibit B3) states.

The court looked at the contracts instead. Snap Inc.'s own terms of use (Exhibit K17) make clear that, for users in Germany, Snap Group Limited provides the services and its terms apply (Exhibit K18). Those terms define the company as "Snap". Users grant Snap and its affiliates a worldwide, royalty-free, sublicensable and transferable licence to host, store, cache, use, display, reproduce, modify, adapt, edit, publish, analyse, transmit and distribute content they send to the services. Page 4 adds: "We, Snap Inc., our affiliates and our third-party partners may serve advertising, including personalised advertising, in the Services based on the information you provide, that we collect or that we obtain, and obtain your consent for this where applicable."

On that wording, the company is not a mere recipient of data but acts, by its own terms, as a processor and user of it, the chamber wrote, and it has to be held to that. The company also describes itself on its website as a service provider within the meaning of section 5 of the DDG, Germany's Digital Services Act implementing law. The London entity is at least a joint controller within the meaning of Article 4(7) GDPR, the court concluded. Snap Inc.'s involvement changes nothing: under Article 26(3), data subjects can exercise their rights against each of the controllers. The judgment at one point cites the definition as "§ 4 Abs. 1 Nr. 7 DSGVO", an apparent slip for Article 4(7), which it names correctly elsewhere.

The late brief's reliance on EDPB guidance did not shift that view. The board stresses that controllership has to be established through an analysis of the facts and circumstances of the case, according to the judgment, and the chamber said that is precisely what it had done - weighing, among other things, the extensive rights the company grants itself as operator of the service in Germany.

German courts have been drawing controller lines around US platforms with some regularity. A Dresden court found Meta a joint controller with third-party website operators in a ruling reported in April, while the Higher Regional Court of Düsseldorf has asked the Court of Justice whether joint controllers must publish their arrangements online in Case C-287/26.

Pre-ticked boxes in the ad preferences

The second prohibition concerns a menu most users reach only by digging. In the app's settings, under "Ads", a subsection called "Ad preferences" lists three options, according to the judgment. All three were ticked by default.

Exhibit K2 describes each. The audience-based option uses audience lists received from advertisers and other partners; the example given is an advertiser that already holds a user's email address and wants to reach that person on Snapchat. The activity-based option tailors ads to activity outside Snapchat, such as searching for a film on a website that shares data with Snap. The third-party ad networks option lets Snap send networks data including a user's IP address, mobile advertising ID and whether the user saw or interacted with an ad, so that the networks can supply audience-based ads, statistics and optimisations. The screen opens with the line: "You can choose how Snap and its advertising partners use your data for advertising purposes in and outside Snapchat."

Pre-ticked boxes do not produce valid consent, the chamber held, citing the Federal Court of Justice's 2020 Cookie-Einwilligung II decision (BGH NJW 2020, 2540); the GDPR requires consent to be given through an active act or statement. That line of case law runs back to Planet49, a case the vzbv itself took to the Court of Justice, which held in October 2019 that pre-ticked boxes cannot amount to consent. Regulators have enforced it since. The Dutch authority fined Kruidvat 600,000 euros in 2024 in a case involving pre-ticked cookie boxes, a penalty later cut to 50,000 euros, and Spain's data protection authority fined Yoti 200,000 euros of a 950,000-euro total for research consent obtained through a pre-ticked checkbox.

Snap argued the boxes were never meant to collect consent. They gave users a way to exercise their right to object under Article 21 GDPR, the company said. The court disagreed on systematic grounds, adopting the BfDI's statement of September 8, 2025. The right to object is reactive: it presupposes lawful processing based on legitimate interests under Article 6(1)(f), to which the person later objects. Pre-ticked checkboxes "reverse this logic and suggest a preventive consent before data processing begins," according to the judgment.

A second defect settled the matter. A valid objection would require users to have been told the legal basis for collection and the specific legitimate interests at the moment of collection, the court held, again citing Case C-394/23. Snap had not provided that information, so it could not rely on Article 6(1)(f), and the boxes could not be an objection mechanism either. The problem is hardly unique to Snap. The EDPB's own case digest on legitimate interest, covering 62 One-Stop-Shop decisions, recorded controllers that could not even state which interest they were relying on when asked.

Alcohol and gambling as default topics for teenagers

The third claim moved from data protection into youth protection law. Under "Ads", a second submenu called "Interests and lifestyle" presents a long list of suggested interests. The screenshot in Exhibit K3 shows unticked categories such as comic and animation fans, bookworms, beauty experts, students, clubgoers and partygoers, and photographers. Below them, under the heading "Ad topics", three items carried ticks by default: politics, alcohol and gambling. The accompanying text read: "These topics are based on feedback on our ads. You can deactivate these settings to see fewer ads on these topics."

Those presets existed in minors' accounts too, according to the court's statement of facts. Registration requires a first name, a surname and a date of birth.

Snap's answer was that it shows minors no ads for gambling or alcohol. Even where users under 18 appear to have the interest categories switched on, age-restricted ads are excluded by Snap Inc.'s advertising policies, the company said, and any chatbot answers on those subjects were responses to users' requests for information, not ads.

The chamber applied section 6(5) of the Interstate Treaty on the Protection of Minors in the Media (JMStV), under which advertising for alcoholic drinks may not be aimed at children or adolescents, may not particularly appeal to them through its presentation and may not show them drinking. For gambling, the prohibition follows from section 6(3) JMStV together with section 5(2), sentences 4 and 5, of the 2021 Interstate Treaty on Gambling (GlüStV 2021). By presetting the boxes, Snap was obtaining consent to serve information, ads included, on both topics, the court found. And according to the in-app notices the vzbv documented, unticking would only reduce such content - "less, but not none".

The court then sidestepped the evidential fight. It left open whether My AI's answers to the vzbv's test queries, sent from a teenager's account, counted as advertising. It left open, too, whether Snap had technically excluded age-restricted ads for minors. Even assuming it had, the settings design meant the company was asserting, towards its own users, a right to show minors ads in those categories, the chamber reasoned. That assertion alone creates the risk of a first infringement - Erstbegehungsgefahr in German law - which is enough to ground an injunction. Snap's defence described a form of age gating enforced inside ad policy; the court treated the interface, not the policy, as decisive. The claim, it noted, targeted the presentation in the "Interests and lifestyle" settings, not particular chatbot answers.

Politics was also ticked by default in the screenshot. It formed no part of the claim, and the judgment does not address it.

Jurisdiction over a London company

Brexit shaped the procedural route. Because Snap Group Limited is based in London and the United Kingdom is no longer a member of the European Union, international jurisdiction came from section 32 of the Code of Civil Procedure, the rule for torts, applied by analogy, according to the judgment. The app can be used anywhere in Germany, the Cologne district included, and the notion of a tort extends, through section 823(2) of the Civil Code, to breaches of consumer protection statutes and to unfair competition.

Choosing a regional court over a higher regional court needed justification. Section 6 of the Injunctions Act (UKlaG) gives the higher regional courts exclusive jurisdiction over claims under that act. But where a single subject matter is pursued under both the UKlaG and the Unfair Competition Act (UWG), the claimant may choose, following a Higher Regional Court of Cologne precedent reported as GRUR 2025, 1848, "Niederländische Champions". The vzbv chose the regional court, which then had to examine every legal ground in play, UKlaG included. Its standing rests on its entry in the list of qualified consumer associations under section 4 UKlaG, and section 2(2) no. 13 UKlaG classifies the GDPR as a consumer protection law. Snap did not dispute the association's standing.

In the end, the injunctions stand on the UKlaG alone. Whether the UWG supports them as well, the court said, could be left open.

Why this matters for the marketing community

The ruling comes from a court of first instance and binds only the parties. Its reasoning, though, reaches the commercial model that several platforms are building on chatbot conversations.

Snap has placed AI conversation near the centre of its advertising pitch. When it unveiled AI Sponsored Snaps in April, the company said more than half a billion Snapchatters had messaged My AI since its debut, and offered brand-operated agents that converse with users in the same chat surface. Meta began feeding interactions with its AI features into ad personalisation from December 16, 2025. OpenAI matches ChatGPT ads to conversations through advertiser-supplied context hints, a model PPC Land described when the format went live in the UK.

Cologne's analysis cuts against the most common reassurance in that market: that ads matched to the current conversation are contextual rather than personalised. Snap made exactly that argument, and lost. Using the text of a prompt to choose an ad is processing of whatever the prompt contains, the court found, and where prompts can carry health, sexuality, religion or politics, Article 9 attaches whether or not the platform wanted that information. On that reading, the question for a chatbot operator stops being whether it profiles users. It becomes whether it holds explicit consent for sensitive data it cannot stop users from typing. How often do users type it? A DuckDuckGo survey found 56% of AI enthusiasts confide secrets to chatbots - the behaviour the chamber assumed.

On ad settings design, the message is less novel but sharper. Planet49 closed the pre-ticked box question for consent in 2019. What Snap attempted was a reclassification, presenting pre-enabled toggles as an objection interface sitting on top of legitimate interest. The court accepted the BfDI's view that this inverts the structure of the GDPR, and added a disclosure requirement drawn from Case C-394/23 that many legitimate interest implementations would have difficulty meeting.

Minors are the third pressure point, and for Snap the timing is awkward. The European Commission opened Digital Services Act proceedings on March 26, 2026 covering systemic risk assessments and the protection of minors, a matter Snap listed alongside second-quarter results that showed European revenue up 33% to $353.8 million on 98 million daily users - the company's fastest-growing region. Other platforms have moved on their own; Reddit switched off ad personalisation for EU teen accounts when its age checks began on June 24, 2026. In the United States, Snap was among the seven companies the Federal Trade Commission ordered to report on child safety and monetisation of AI chatbots in September 2025.

The identity of the plaintiff matters as well. The vzbv does not need a harmed consumer to bring a case; it needs a breach of a consumer protection law, and German law treats the GDPR as one. Germany's Digital Services Coordinator also certified the vzbv as a trusted flagger in 2025. Consumer groups do not always prevail in Cologne. In May 2025 the city's Higher Regional Court rejected an emergency bid to stop Meta training AI on public data, brought by the North Rhine-Westphalia consumer centre. Different court, different procedure, different question - but the same city.

The controller finding reaches beyond Snap. The structure the company described - a European entity named as the contracting party, with processing attributed to the US parent in the privacy notice - was not enough to put the London company out of reach. In Cologne, the rights that entity reserved for itself in its terms of service weighed more heavily than the allocation set out in its privacy policy. For platforms organised the same way, the subsidiary named in the contract can be the defendant.

Timeline

Summary

Who: The Verbraucherzentrale Bundesverband (vzbv), the federation of Germany's 16 regional consumer advice centres and 29 other consumer associations, sued Snap Group Limited, the London-based wholly owned subsidiary of Snap Inc. that contracts with Snapchat users in Germany. The 33rd Civil Chamber of the Regional Court of Cologne decided the case, with written statements from the BfDI and the LDI NRW.

What: The court barred Snap from processing personal data collected through the My AI chatbot for advertising without a legal basis, from obtaining ad consent through pre-ticked checkboxes, and from preselecting alcohol and gambling as ad topics in minors' accounts. Each violation can draw an administrative fine of as much as 250,000 euros or coercive detention of up to six months enforced against board members. Snap must pay 242.99 euros in warning letter costs plus interest and bear the costs of the case, valued at 22,500 euros.

When: Judgment was pronounced on September 17, 2026, after a hearing on July 16, 2026. The action was filed on March 22, 2024 and served on June 25, 2024, following a warning letter of October 24, 2023. The vzbv's case record carries a status date of September 21, 2026.

Where: The Regional Court of Cologne in Germany, case 33 O 120/24, with jurisdiction over the UK company founded on the place where the conduct took effect - anywhere in Germany the Snapchat app is used.

Why: The court found that My AI prompts can contain special category data, that Article 9 applies regardless of Snap's intent, and that Snap had neither explicit consent nor a disclosed legitimate interest. Pre-ticked boxes cannot constitute consent and cannot be recast as an objection mechanism. Preset alcohol and gambling topics for minors breach German youth protection and gambling treaties even if Snap's ad policies block such ads in practice. The reasoning challenges the argument that ads matched to chatbot conversations are merely contextual.