Part of the AI Regulation News hub.
Lower Saxony's data protection commissioner, in a non-binding advisory to ChatGPT users, says evaluating chats for advertising carries a significant data protection and personality-rights risk, as OpenAI plans personalised ads in the EU, according to the commissioner
The advisory binds nobody and decides nothing about legality. Its useful detail for counsel is the alternative to personalised ads: the LfD says OpenAI rests that variant on legitimate interest, and notes that even there the current chat thread is used for advertising.
Bottom line: This is a non-binding advisory from one German Land data protection authority, the LfD Niedersachsen, written for ChatGPT users. It is not an enforcement decision, not an order or fine against OpenAI, not a position of the German Data Protection Conference (DSK) and not a finding that any processing is unlawful.
Who this affects: EU privacy counsel and data protection officers whose staff use ChatGPT, adtech and media counsel advising brands that advertise or plan to advertise on AI chat platforms, and executives deciding which ChatGPT tier their organisation buys. The non-binding advisory itself is addressed to individual users.
Issue date: The LfD page is marked "erstellt am" (created on) 01.10.2026, that is October 1, 2026. The non-binding advisory sets no deadline and no compliance date.
What changed: In a non-binding advisory, the LfD describes OpenAI's plan, as the LfD reports it, to serve personalised ads in ChatGPT in the EU soon, for the free version and ChatGPT Go, which it describes as a subscription at 8 euros a month. It adds its own risk assessment and eight self-protection steps for users.
Analysis: On our reading, the detail counsel will want is in the non-binding advisory's account of the alternative to personalised ads. As the LfD describes it, OpenAI states Art. 6(1)(f) GDPR legitimate interest for that variant, and the LfD writes that it still uses the current chat thread and basic context such as general location or language for advertising. The LfD reports the legal basis without endorsing or rejecting it.
Primary sources: LfD Niedersachsen, "ChatGPT mit personalisierter Werbung künftig auch in Europa" (created October 1, 2026)
- Instrument (EN)
- Advisory web page: ChatGPT with personalised advertising in Europe too in future (our translation of "ChatGPT mit personalisierter Werbung künftig auch in Europa")
- Authority
- The data protection commissioner of Lower Saxony (LfD Niedersachsen), a German Land data protection authority
- Jurisdiction
- Lower Saxony, Germany. The advisory discusses OpenAI's plans for the European Union
- Status
- Published advisory on the LfD website, filed under Künstliche Intelligenz. Page marked created October 1, 2026
- Bindingness
- Non-binding advisory and user guidance. Not an enforcement decision, order, fine or finding of illegality, and not a DSK or EDPB position
- Issue date / next deadline
- Created October 1, 2026 ("erstellt am" 01.10.2026). No deadline or compliance date
- Legal bases mentioned
- Consent under data protection law for personalised ads; Art. 6(1)(f) GDPR legitimate interest, which the LfD says OpenAI relies on for the variant without personalised ads. Both are reported, not assessed
- Addressed to
- ChatGPT users, as advice on Selbstdatenschutz (self-protection of one's own data)
- Primary source
- https://www.lfd.niedersachsen.de/ki-werbung/chatgpt-mit-personalisierter-werbung-kunftig-auch-in-europa-254198.html
What does the LfD say OpenAI is planning?
The advisory, which binds nobody, opens with OpenAI's plans as the LfD describes them: "OpenAI plant, dass zeitnah in der Europäischen Union personalisierte Werbung bei der Nutzung von ChatGPT ausgespielt werden soll", in our translation OpenAI plans that personalised advertising is to be served soon in the European Union when ChatGPT is used. The LfD says this is already practised in other countries, in the US since February 2026, and points readers to OpenAI's own ads FAQ and EU privacy policy.
On the LfD's account in the non-binding advisory, OpenAI would decide in real time which ad appears in a chat, by evaluating users' earlier and current chats, device information and context information. Its example is a user who searches for recipes, or has done so in the past, and may then see ads for meal kits or grocery delivery.
Two groups of users are named: the free version and ChatGPT Go, which the LfD describes as a subscription model at 8 euros a month. Further down, the same non-binding advisory lists Plus, Pro, Business, Enterprise and Edu as ad-free variants.
The page speaks of a plan and does not say the ads are running in the EU. One later sentence mentions the "neu eingeführten Werbefunktion in ChatGPT", in our translation the newly introduced advertising function in ChatGPT, without saying where it was introduced. We do not read that phrase as a statement that ads have launched in Europe.
How does the advisory separate consent from legitimate interest?
According to the non-binding advisory, the personalised advertising is to take place "auf Basis einer datenschutzrechtlichen Einwilligung", in our translation on the basis of consent under data protection law. Use without personalised advertising is to be offered as an alternative.
For that alternative the LfD relays OpenAI's own description: limited data relevant to the current context, with neither the creation nor the use of user profiles. The LfD then writes that in this variant too, the context of the current chat thread and basic context information such as general location or language are used for advertising purposes. That sentence sits in an advisory without binding force, and it is the LfD's description, not a finding.
The non-binding advisory next reports the legal basis it attributes to OpenAI. "Die Verarbeitung von personenbezogenen Daten für diese Form der Werbung stützt OpenAI auf ein überwiegendes berechtigtes Interesse gemäß Art. 6 Abs. 1 lit. f DSGVO." In our translation, OpenAI bases the processing of personal data for this form of advertising on an overriding legitimate interest under Art. 6(1)(f) GDPR.
That sentence reports OpenAI's position. The non-binding advisory does not say whether the legitimate-interest basis holds, does not assess how consent for the personalised variant is collected, and does not compare the two routes in legal terms.
Why does the LfD see a significant risk?
The central sentence is the LfD's own: "Der LfD Niedersachsen sieht in der Auswertung der Chats zu Werbezwecken ein erhebliches datenschutz- und persönlichkeitsrechtliches Risiko." In our translation, the LfD Niedersachsen sees a significant data protection and personality-rights risk in the evaluation of chats for advertising purposes. It is a risk assessment in a non-binding advisory, not a finding that any processing is unlawful.
The reasoning starts from how widely ChatGPT is used. The LfD says it is used in all areas of life and on every conceivable topic, up to the most personal ones. It cites an OpenAI study as finding that about half of messages, 49 percent, fall into a category labelled "Fragen" (asking), and that people value ChatGPT mainly as an adviser.
The LfD then contrasts chat-based profiling with personalised advertising on websites or in search engines, which on its account draws on web behaviour and general search terms. It says users increasingly treat AI chatbots as personal conversation partners, and it expects the evaluation of chat content to raise the quality of personality profiles considerably and to reach "bis in die Intimsphäre", into the intimate sphere in our translation. It adds that users' moods could be identified in real time. These are the LfD's assessments in a non-binding advisory; we report them without adopting them.
The LfD also says, citing Statista, that ChatGPT is the most used AI chatbot in Germany, and gives that as the reason for alerting users.
What does the LfD tell ChatGPT users to do?
The advisory is self-protection advice, and nothing in it binds users, OpenAI or advertisers. It suggests looking at alternative AI chatbots and says that, from a data protection perspective, products with extensive privacy functions and European providers are preferable, because European users are more likely to be able to enforce their rights against them.
For people who keep using ChatGPT and want to limit profiling from their chats for advertising as far as possible, the non-binding advisory lists eight steps. Use the ad-free variants Plus, Pro, Business, Enterprise or Edu. Give no consent to personalised advertising. Check whether ad personalisation is switched on in the privacy settings and switch it off if so. Switch off the memories function and delete existing memories. Switch off the use of chats for model improvement. Use temporary chats for sensitive topics. Enter no confidential information. Delete the chat history regularly.
The non-binding advisory does not address employers. On our reading, its first step reads as a procurement point as much as a privacy one, since the LfD's own list places the free version and Go on the advertising side and the business and education tiers on the ad-free side. That tier split is the LfD's description; we did not check it against OpenAI's terms.
How much weight does the advisory carry?
The advisory has no binding force. It is a page on one German Land authority's website, written for users, and it imposes no obligation on OpenAI, advertisers or anyone else. It names no proceedings, order or fine, and it does not say the LfD has opened an investigation.
It is also one authority's view. The page does not present itself as a position of the DSK, the conference of the independent federal and Land data protection authorities, or of the European Data Protection Board, and we do not treat it as one.
For EU privacy and adtech counsel, its use is as a public record of how one supervisor frames the evaluation of chats for advertising, and of what OpenAI's EU ad plans involved on October 1, 2026, as the LfD describes them.
What we did not verify
What we opened: the LfD Niedersachsen page "ChatGPT mit personalisierter Werbung künftig auch in Europa" as captured in our evidence file, including its four body paragraphs, the paragraph on alternatives, the eight-item list of self-protection steps and the "erstellt am" (created on) date of 01.10.2026 under Artikel-Informationen.
What we did not open: OpenAI's ads FAQ and EU privacy policy, which the LfD links; the OpenAI study on how people use ChatGPT and the Statista chart the LfD cites; any OpenAI statement on EU timing, pricing or tiers; and any statement on the subject by the DSK, the European Data Protection Board or another supervisory authority.
What we refuse to claim: we do not say personalised ads have launched in ChatGPT in the EU, give any EU rollout date, or present the 8 euro Go price and the tier list as OpenAI's current terms, since all of these come to us only through the LfD's description. We do not say the consent route or the Art. 6(1)(f) basis is valid or invalid, that the LfD found any infringement or intends to act, that it is the competent supervisory authority for OpenAI, or that the page speaks for any other German authority. We do not treat the page's creation date as a separately confirmed publication date.
Translations from German are our own and are labelled as such. Quotations are reproduced from the LfD page in the original German.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
The LfD Niedersachsen advisory binds nobody and finds no infringement, but it puts on record how one German supervisor frames ChatGPT advertising: evaluating chats for ads is a significant risk, whether the personalised variant runs on consent or the alternative on the legitimate-interest basis the LfD says OpenAI states. Organisations whose staff use free or Go accounts can review those accounts' ad and memory settings against the LfD's eight steps.
Source File
Open the LfD Niedersachsen page and confirm four things: the plan sentence and the ChatGPT Go description in the first paragraph, the consent and Art. 6 Abs. 1 lit. f DSGVO sentences in the second, the risk sentence that opens the third, and the "erstellt am" (created on) date of 01.10.2026 under Artikel-Informationen.
Der LfD Niedersachsen sieht in der Auswertung der Chats zu Werbezwecken ein erhebliches datenschutz- und persönlichkeitsrechtliches Risiko. · LfD Niedersachsen, "ChatGPT mit personalisierter Werbung künftig auch in Europa", created October 1, 2026
FAQ
Has the Lower Saxony authority banned or fined ChatGPT advertising?
No. The page is a non-binding advisory to users. It names no order, fine, proceedings or finding of illegality, and it is one Land authority's view, not a position of the German Data Protection Conference.
Are personalised ChatGPT ads live in the EU?
The non-binding advisory does not say so. It describes OpenAI's plan to serve personalised ads in the EU soon, and says the practice has run in the US since February 2026. We did not check OpenAI's own materials for EU timing.
Which legal bases does the advisory mention?
As the non-binding advisory describes it, personalised ads are to run on consent under data protection law, and the alternative without personalised ads rests, according to OpenAI, on overriding legitimate interest under Art. 6(1)(f) GDPR. The LfD reports both positions without approving or rejecting either.
Which ChatGPT plans does the LfD say carry ads?
The non-binding advisory names the free version and ChatGPT Go, which it describes as a subscription at 8 euros a month, and lists Plus, Pro, Business, Enterprise and Edu as ad-free. That is the LfD's description; we did not verify it against OpenAI's terms.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.