AI Chatbot: What Companies May Do with Customer Inputs
Data protection for AI chatbots: sensitive data, consent and transparency obligations in customer contact
The Regional Court of Cologne (Landgericht Köln) has prohibited the operator of a large social media platform, which is also used by young people, from processing inputs into its AI chatbot for advertising purposes without a legal basis (judgment of 17.09.2026 – 33 O 120/24, not yet final). The action was brought by a consumer association. The decision is not relevant only to large platforms: it shows what every company should bear in mind that lets customers be addressed through an AI chatbot.
Sensitive Data Arises Without Anyone Asking for It
The General Data Protection Regulation (GDPR, DSGVO) protects certain data particularly strictly. Under Art. 9 Abs. 1 DSGVO, the processing of data revealing, for example, religious beliefs, as well as data concerning health or sexual orientation, is in principle “prohibited”. It is permitted, among other cases, if the data subject has “given explicit consent” (Art. 9 Abs. 2 lit. a DSGVO).
According to the reasons for the judgment, it did not matter whether the chatbot specifically asks for such information. Users were encouraged to ask personal questions, such information was therefore to be expected, and the provider evaluated the inputs for advertising. A notice on a sub-page asking users not to enter sensitive data was not sufficient. For such data the provider cannot rely on a “legitimate interest” (Art. 6 Abs. 1 lit. f DSGVO); Art. 9 DSGVO requires a separate exception, here explicit consent.
For companies this means: anyone who uses a chatbot in customer service must expect that customers will, of their own accord, write about, for example, illnesses or family circumstances. Art. 9 DSGVO covers any processing, including the storage of chat histories. The court decided only on the use for advertising; whether merely answering an enquiry already requires a special justification remains open. Data minimisation, short deletion periods and excluding profiling and training on chat content reduce the risk.
Consent Cannot Be Pre-Set
The court also objected to pre-ticked advertising options and a notice window that allowed only “Okay”. This corresponds to settled case law: a pre-ticked box that the user must untick is not valid consent (CJEU, judgment of 01.10.2019 – C-673/17; BGH, judgment of 28.05.2020 – I ZR 7/16). The right to object (Art. 21 DSGVO) takes effect only subsequently and presupposes lawful processing; it cannot replace missing consent.
Associations Can Sue
Data protection infringements are pursued not only by supervisory authorities. The Court of Justice of the European Union has held that qualified consumer associations may bring actions against GDPR infringements even without a mandate from a specific data subject (CJEU, judgment of 28.04.2022 – C-319/20). Companies with consumer contact should therefore also expect warning letters and injunction proceedings from associations.
Transparency Obligation Under the AI Regulation
Under Art. 50 Abs. 1 of the European AI Regulation, providers of AI systems that interact with people must in principle ensure that users are informed that they are communicating with an AI – unless this is obvious. This obligation has applied since 2 August 2026; the “Digital Omnibus”, which entered into force in July 2026, postponed mainly obligations for high-risk systems, not this one. The obligation lies with the provider, that is, whoever develops the system or puts it into service under its own name. Anyone who merely deploys a third-party chatbot should check what role it has and secure the labelling contractually.
Practical Checklist for Companies
Record which data arise in the chat, what they are used for and when they are deleted.
Do not use chat content for advertising profiles or ad selection as long as there is no explicit consent.
Obtain consent only actively; no pre-ticked boxes, no mere “Okay”.
Provide specific and complete data protection information at the start of the chat.
Review contracts with the AI service provider: processing on behalf, use of the data for its own purposes, transfers to third countries.
Ensure labelling as an AI system.
For offers that are also used by minors, review youth protection and advertising restrictions separately.
Conclusion
An AI chatbot is not legally self-running. Those who handle inputs properly, obtain consent actively and make the use transparent reduce the risk of warning letters and association actions. Please do not hesitate to contact us if you have any questions.
Status: 17 October 2026
NIETZER Rechtsanwälte · Attorneys at Law (USA) · Heilbronn · www.unternehmensrecht.com
This article is for general information purposes and does not replace legal advice in an individual case.
