Children are already using AI chatbots, and European regulators now expect those products to protect them in practice, not just in the privacy policy. If your business runs a chatbot, an AI assistant or any AI feature that young people can reach, this applies to you, even if children are not your target audience.
Three developments in 2026 set the tone. In July, Italy's data protection authority fined the company behind Character.AI over weak age checks and public-by-default profiles for minors, among other failures. In September, a German court ruled against the way Snapchat's AI chatbot used chat data for advertising. And on 17 September the European Commission proposed the EU KIDS Act, which would put AI companions and general chatbots under child-safety rules for the first time. The common thread: if minors can reach your chatbot, privacy by design has to work in practice. This article is for general information only and is not legal advice.
What regulators and courts have done
Italy has now fined two companion chatbots, a German court has weighed in, and Brussels wants dedicated rules.
- Italy's Garante, May 2025: Luka Inc. (Replika). A €5 million fine. The company had no age verification until February 2023, even though minors were said to be excluded.
- Italy's Garante, 3 July 2026: Character Technologies (Character.AI). A €158,000 fine (Decision No. 487, announced 9 July). The findings included weak age checks, public-by-default minor profiles, a late DPIA and transparency gaps.
- Cologne Regional Court, 17 September 2026: Snap (My AI chatbot). The court ruled against Snap in a case brought by the Federation of German Consumer Organisations (vzbv), file number 33 O 120/24, made public on 15 October. The judgment is not yet final, and Snap is reported to be appealing.
- European Commission, 17 September 2026: the EU KIDS Act. A proposal, not yet law. It covers social media, video platforms, online games, app stores, AI companions and general chatbots.
- Ofcom (UK), January 2026: Novi Ltd (AI companion service). An investigation into age checks under the Online Safety Act, opened on 15 January and closed on 31 July after the company introduced age assurance, with no findings made. UK law, but a useful signal.
Four lessons for anyone running a chatbot
1. A date-of-birth box is not age assurance
Character.AI argued that the GDPR requires no particular age-verification technology. The Garante accepted that, but said Articles 24 and 25 still require measures that are appropriate and effective given the risks, including the vulnerability of minors.
Character.AI's gate relied on users typing their own date of birth. A technical test on 8 April 2025 showed that a user who declared an age of 15 could still register, and accounts of self-declared minors were public by default. The Garante ordered the company to make its age checks work, make the cooling-off period for rejected minors effective, and set minors' profiles to private by default. The company has 120 days to report back.
The Garante later considered the company's new system adequate. It combines age assurance with restricted experiences for minors and was introduced from November 2025.
2. The DPIA comes before launch
Character.AI's first data protection impact assessment (DPIA) is dated 14 November 2024. The service launched in September 2022. The Garante said it should have been done before launch, and named three factors that would each have been enough to require one: generative AI, large-scale processing and the involvement of minors. It also said informal, undocumented internal risk reviews cannot replace a formal DPIA under Article 35.
Practical takeaway: if your chatbot uses generative AI and children could plausibly use it, assume a DPIA is required, and finish it before release. See our guide to DPIAs for AI chatbots.
3. Tell people clearly what happens to their chats and to training data
These findings apply to any AI product, not just those aimed at young users.
- Language matters. The privacy notice was English-only for more than a year after the Italian-language service launched.
- Vague training statements mislead. One line saying user data “may be used to train and improve” the models did not separate pre-training from training on live conversations, so users could believe their chats were already being used when they were not.
- One purpose, one legal basis. Citing both consent and legitimate interest for the same purpose left users unable to tell whether the right to object or to withdraw consent applied.
- Non-users have rights too. The model was pre-trained largely on data scraped from the internet. Under Article 14, people whose data was used, including people who never used the service, had to be informed.
- EU representative. The company appointed its Article 27 representative only in May 2025, and the Garante rejected its argument that its processing was merely “occasional”.
4. Chat data is not free fuel for advertising
The Snapchat case points the same way. According to reports on the judgment, the Cologne court found that Snap's terms for its AI chatbot fell short of basic requirements for lawful processing. Users were asked to consent through pre-ticked boxes, including for targeted advertising, and Snap said it uses all data in chats to generate relevant ads. The court said the processing would stay unlawful even with a data notice before first use, and that legitimate interest could not justify it. Commentators also report that it treated sensitive data as a real possibility, since users can type almost anything into a chatbot, and objected to alcohol and gambling ads aimed at minors.
Pre-ticked boxes have not been valid consent under EU law for years. What is new is seeing the principle applied to a chatbot, where users may share far more than they would in a search box.
What the law already requires, and what the KIDS Act would add
None of these decisions relies on new law: the GDPR has covered children's data from the start.
- Recital 38: children merit specific protection, particularly in marketing and profiling.
- Article 8: when an online service relies on consent and is offered directly to a child, parental consent is needed below 16. Member States may lower that age to as low as 13.
- Article 25: data protection by design and by default. The Garante used it for public-by-default profiles.
- AI Act, Article 5(1)(b): since 2 February 2025, AI systems that exploit vulnerabilities linked to age, among other factors, in ways that materially distort behaviour and cause or are likely to cause significant harm are prohibited.
Age checks carry their own privacy risk. The EDPB's Statement 1/2025 on age assurance (February 2025) sets out ten principles: the method should be risk-based, proportionate and the least intrusive that is still effective, and should avoid unnecessary data collection, profiling and tracking. The EDPB notes that age assurance will often pose a high risk in itself, so a DPIA should come first.
The proposed KIDS Act
The KIDS Act is a proposal, so it may change before it becomes law. According to the Commission's FAQ, AI companions and chatbots accessible to minors would:
- not use designs that simulate human relationships in ways likely to create emotional dependency;
- by default, not carry a child's earlier conversations into later ones;
- be tested for risks to children before launch and monitored for harm afterwards;
- be available to under-13s only through parental control tools;
- when built into a social network, video platform or game, not switch on automatically, not be pushed at children and be easy to turn off.
The Commission's impact assessment says the testing and monitoring duties would not apply to systems provided by micro or small enterprises. The wider proposal says self-declared age would not be enough: age would be checked through certified tools, such as an EU age verification app, that tell the service only whether the user is above or below a given age. Enforcement for AI companions and chatbots would build on the AI Act's structures, with fines of up to 6% of worldwide annual turnover.
What this means for a small business
The fines so far hit companion apps, but the reasoning applies to any company that puts a chatbot in front of the public. A customer-support bot, a booking assistant or an AI feature inside your app can all be reached by teenagers.
- You are judged on who can reach the product, not only who you target. Ask honestly whether minors could use your chatbot.
- Your vendor's defaults become your problem. If you embed a third-party chatbot, check what it does with chat history, whether it uses conversations for training, and whether it shares chat data for advertising.
- Your privacy notice has to match reality. Say in the user's language what happens to chats, separate pre-training from training on live conversations, and give one legal basis per purpose.
- Small size helps, but only partly. The Commission's impact assessment would exempt micro and small enterprises from the KIDS Act's testing and monitoring duties. The GDPR duties above, such as the DPIA and privacy by default, are not covered by that exemption.
- Outside the EU? If you offer the service here, check whether you need an EU representative under Article 27.
Checklist for teams running chatbots
- Decide honestly whether minors can reach your product, not just whether they are your target audience.
- Run a DPIA before launch, covering minors, training data and age assurance.
- Replace self-declared age with a proportionate age-assurance method, and test that it works, including against repeat attempts.
- Make minors' profiles and chats private by default.
- Turn off persistent chat memory for minors by default and set clear retention limits.
- Keep chat data out of advertising and profiling for minors, and never rely on pre-ticked boxes.
- Write a privacy notice in the user's language that separates pre-training from training on live conversations and gives one legal basis per purpose.
- Inform non-users whose scraped data was used for training, as Article 14 requires.
- Appoint an EU representative under Article 27 if you are based outside the EU and offer the service here.
- Review design features that encourage emotional dependency or compulsive use.
- Follow the KIDS Act, and send feedback if it affects you. The Commission's page gives 26 November 2026 as the closing date and also mentions 3 December, so aim for the earlier one. If you use agents too, see what regulators expect from AI agents.
The bottom line
Many chatbots were built on the assumption that users are adults who can read a privacy policy and look after themselves. Regulators and courts are testing that assumption and finding it wanting. The steps are clear: assess risks before launch, check ages in a way that works without over-collecting, keep minors' data private by default, keep chats out of advertising and be honest about training. Teams that do this now will be ready for the KIDS Act and will earn the trust of the parents who decide which apps stay on their children's phones. Not sure where your AI tools stand? GDPRGard's AI audit tool is a good place to start. For the Article 50 disclosure side, see our guide to AI Act Article 50.
Sources
- Garante: Character.AI measure, press release and decision No. 487 of 3 July 2026 (9 Jul 2026)
- regulations.ai: Garante v Character Technologies, enforcement entry (3 Jul 2026)
- EDPB: Italian authority fines company behind chatbot Replika
- vzbv: Urteil, Snapchat-KI nutzt rechtswidrig Daten von Minderjährigen für Werbung (15 Oct 2026)
- MTR Legal: Landgericht Köln prohibits Snapchat's unlawful data processing
- beck-aktuell: LG Köln, 33 O 120/24, Snapchat AI chatbot and personalised advertising (15 Oct 2026)
- European Commission: Commission seeks feedback on the EU KIDS Act
- European Commission: Proposal for the EU KIDS Act, COM(2026) 681 final (17 Sep 2026)
- McCann FitzGerald: KIDS Act proposal
- Davis Wright Tremaine: European Commission proposes EU KIDS Act (Sep 2026)
- Ofcom: Ofcom investigates AI companion chatbot service (15 Jan 2026)
- Ofcom: Investigation into Novi Ltd, closed 31 Jul 2026
- EDPB: Statement 1/2025 on Age Assurance (11 Feb 2025)
- GDPR, Regulation (EU) 2016/679, EUR-Lex
- AI Act, Regulation (EU) 2024/1689, EUR-Lex
The positions above are summarised from the sources listed; reports on court judgments and the KIDS Act proposal are secondary and should be checked against the judgment and the proposal itself. Analysis of how they fit together is ours.
Also read:
- Your AI chatbot isn't anonymising anything
- AI Act Article 50: What the Final Guidelines Mean for Your Chatbot and AI Content
- Your AI Agent Can Act on Its Own. Privacy Law Still Expects You to Be in Charge