10/20/2026

KI-Flash: What advertisers and agencies are responsible for when booking ads in AI assistants

Since 24 August 2026, ads have been shown in ChatGPT in Germany to users of the free version and the Go plan. Since 31 August 2026, companies based in Germany, Austria and Switzerland can also book them themselves through the provider’s ads manager, which is in beta. The existing routes through the provider’s ads solutions team and through agency and technology partners remain available. The two previous articles in this series dealt with the provider’s obligations. This article changes sides and asks what the booking party is responsible for itself.

There is hardly any literature on this question yet. That is due to the novelty of the channel and to the fact that public attention is focused on the provider. For companies, the booking side is nonetheless the more pressing one in practice. The provider’s obligations are met by the provider. In case of doubt, nobody else will meet the advertiser’s obligations.

At a glance

Anyone placing an ad in an AI assistant is, in principle, responsible for labelling it and should record how it is actually delivered.
Infringements by an agency could be attributed to the client without any possibility of exculpation. An approval process, documentation and the question of who holds the ad account should therefore be laid down in the contract.
Anyone who leaves a default setting for automatic adjustment of ad texts switched on will not be able to blame the machine when it comes to responsibility for the delivered text. In regulated sectors, the consequences can extend to criminal liability.
Anyone using the provider’s pixel for measurement could be a joint controller with the provider in that respect.
The provider’s category exclusions do not replace a review of the sector-specific advertising bans.

Does the advertiser have to label the ad itself?

Section 5a(4) of the German Act against Unfair Competition (UWG) applies to anyone who fails to disclose the commercial purpose of their own commercial practice. An advertiser placing an ad is therefore, in principle, subject to the provision in its own right and should not rely on the platform to label the ad correctly. The same applies to No. 11 of the Annex to Section 3(3) UWG. It covers editorial-looking content used for sales promotion, paid for by the trader and disguised as information. That use will usually be paid for by the advertiser, regardless of who implements the labelling technically.

In practice, this creates a documentation burden. How the ad is actually labelled in the delivery environment and set apart from the answer text should be recorded with a date. If the provider changes the format, the basis of the advertiser’s own assessment changes without the advertiser being informed.

Who is liable when the agency books?

In Germany, purchasing initially ran exclusively through agency and technology partners, and a large share is likely to continue doing so. This raises the question of whom the obligations apply to. The advertiser is the party whose sales are promoted. Infringements by the agency could therefore be attributed to the client under Section 8(2) UWG, without any possibility of exculpation by showing careful selection and supervision.

The agency is also liable for its own contributions under general principles. If it designs the ad or contributes to it, it is liable as a primary infringer. Checking the ad for compliance with competition law then also forms part of its contractual obligations towards the client. A media agency that merely places advertising without knowing its content, by contrast, is only liable for infringements that can be recognised with reasonable effort.

Against attribution, it can be argued that the agency is not an agent within the meaning of Section 8(2) UWG if it has no latitude over the content. Case law on affiliates requires decisive influence on the context, type and content of the advertising. If the agency runs the ad account in the client’s name and for the client’s account, that in principle points towards integration.

Whether Section 8(2) UWG also applies to the provider of the ad system is less clear than it first appears. The agent must be integrated into the business organisation, and the business owner must have decisive and enforceable influence over it. In ordinary advertising business, this should be lacking between the advertiser and the publisher. The publisher is, however, an agent if the advertiser has given it creative latitude. That is exactly the issue here. Leaving the default setting for automatic text adjustment switched on gives the provider creative latitude over the ad text. That speaks for treating this constellation differently from ordinary advertising business.

What should be agreed in the contract

When drafting the contract, the client should provide for an approval process for the text in the version that is actually delivered, documentation of this approval and a provision on who holds the ad account. The last point seems technical, but it also determines the allocation of roles under data protection law and access to the campaign data after the contract ends. Indemnity clauses only take effect between the parties. Externally, the client remains responsible, which is why the agreed labelling should also be monitored and, if necessary, enforced.

Who is liable for automatically rewritten ad text?

Practitioners report that ad systems automatically adjust submitted ad texts, in some cases through an active default setting. Whether and to what extent this happens in the German market needs to be examined in each case.

The legal question can be asked independently of this. Where an ad system changes the submitted text before delivery, it has to be clarified whose commercial practice the delivered text is. The answer is likely to depend also on whether the advertiser triggered the change and whether it can approve the delivered version before it goes live.

Case law on keyword advertising already provides a standard for this, and it fits the case more closely than it first appears. According to the judgment of the Federal Court of Justice of 13 December 2012 (I ZR 217/10), anyone who chooses the standard option for broadly matching keywords has also selected the keywords added by the algorithm for their advertising purposes. An activated default setting that adjusts the submitted ad text is likely to be comparable.

The limit, in turn, is shown by a decision of the Higher Regional Court of Schleswig of 28 September 2017 (6 U 18/17): if the search engine operator’s algorithm independently links a third party’s trade mark, the party ordering the ad has not made an adequately causal contribution. From the point at which it is notified of the infringement, however, that party is liable as an interferer (Störer), because a check can reasonably be expected of it. The dividing line should therefore run along the foreseeability of the change and the point in time at which the advertiser becomes aware of it.

Case law on automatically generated content provides further support. In the contract document generator case, the Federal Court of Justice held in its judgment of 9 September 2021 (I ZR 113/20) that programming software and the results it produces cannot be split into separate processes but are dependent parts of a single activity. The decision concerns the generation of content, not the modification of a submitted text, so applying it to the present case remains our own assessment.

The change is at the same time a commercial practice of the provider. According to case law, anyone who initiates an automated evaluation acts within the scope of their own commercial communication, and the activity is not purely technical and passive if the content is generated by their own program. For the booking party, this means that it does not stand alone. In practice, the question thus shifts to the contract with the provider and whether it provides for recourse.

In areas where the wording determines whether advertising is permissible, this is not a theoretical consideration. Within the scope of the German Healthcare Advertising Act (HWG), a single reworded claim of efficacy can decide whether the entire advertisement is permissible. Section 3 sentence 2 no. 1 HWG prohibits attributing to a remedy a therapeutic effect that it does not have, and the advertiser must demonstrate and prove the scientific basis of the claim. How the text came about is irrelevant. Infringements of Section 3 HWG are also a criminal offence under Section 14 HWG. Where the automatic function can be switched off, there is therefore a good case for switching it off. Where it cannot, regular checks of the delivered version remain necessary.

Responsibility for measurement

If the advertiser uses one of the provider’s measurement tools on its own website, it is processing data itself. Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to access to information on terminal equipment, for the party that initiates the access. The fact that the provider’s pixel sets a cookie on the advertiser’s own domain does not change the need for consent, because the provision does not distinguish between first and third parties. Section 25 TDDDG does not, by contrast, apply to server-side transmission via the conversion interface, because there is no access to terminal equipment; the GDPR alone is the yardstick in this respect. This applies only insofar as no values are passed on that were previously read from the terminal device, such as the click identifier stored in the cookie.

The allocation of roles under the GDPR depends on who determines the purposes and means of processing. Anyone who merely selects a targeting logic specified by the provider decides less than someone who contributes their own data. According to OpenAI’s documentation, advertisers currently cannot upload their own customer lists for campaigns targeting the European Economic Area or Switzerland, because personalised advertising is not yet offered there. This speaks against joint controllership for audience building.

The opposite applies to measurement. In Fashion ID, according to the judgment of the CJEU of 29 July 2019 (C-40/17), integrating a third-party measurement tool is already enough to establish joint controllership for the collection and transmission of the data, because the website operator enables it and has its own economic interest in it. Joint controllership ends where the provider further processes the data, since the advertiser has no decisive influence over that. The allocation of roles must therefore be determined phase by phase and not for the campaign as a whole.

Case law on advertising in social networks is the starting point for the assessment, but it cannot simply be transferred, because there the target group was formed on the basis of characteristics determined by the advertiser itself.

One point is regularly underestimated in practice: measurement data is personal data, and hashed identifiers are pseudonymised and therefore still personal data. It is unresolved whether their transmission also constitutes processing of special categories of data under Art. 9 GDPR where conclusions about health or other sensitive characteristics can be drawn from the context.

An environment without a results list

Anyone advertising in a classic search environment appears next to results that the operator conveys. In an AI assistant, the ad appears in between text that the Munich Regional Court I and the Commission on Licensing and Supervision of the German media authorities (ZAK) have attributed to the provider as its own statement. Neither decision is final; the previous article in this series discusses them. For the advertiser, this shifts the risk profile. The text next to its ad may be incorrect and is at the same time attributable to a provider that has to answer for it.

In addition, according to the provider’s information, placement in a specific conversation is not guaranteed. Delivery is apparently steered through context hints that describe conversational situations, topics or keywords; they do not guarantee delivery in specific conversations. Traditional placement exclusions can therefore only be reproduced to a limited extent. What remains to be clarified contractually is which response channels exist if an answer next to the ad is incorrect or damaging to reputation, and whether the advertiser can demand that delivery be suspended.

Sector-specific advertising bans and the provider’s category exclusions

Sector-specific advertising bans continue to apply unchanged in the AI environment, in particular:

the HWG for remedies,
Section 5 of the Interstate Treaty on Gambling (GlüStV) for gambling,
the Securities Trading Act (WpHG) and MiFID II for financial instruments,
the Tobacco Products Act (TabakerzG) for tobacco products,
the Food Information to Consumers Regulation and the Health Claims Regulation for food, and
the Price Indication Ordinance (PAngV) for price indications.

Their application in the AI environment does, however, have one particular feature. Ad selection depends on the topic of the ongoing conversation. A user describing symptoms is therefore the normal case of audience building, not an edge case. What would be wasted coverage in a traditional environment is how the system works here.

The provider’s category exclusions are contractual requirements. They do not cover the statutory limits.

Four examples show how different the requirements are. Section 5(2) GlüStV prohibits advertising that gives the impression of being editorial content, which is an obvious risk next to an AI answer. Section 19(3) TabakerzG prohibits advertising for tobacco products in information society services and therefore also in an AI assistant service. The Health Claims Regulation works with positive lists, so any health claim that has not been authorised is inadmissible, even if it only arises through automated adjustment. And under Section 1 PAngV, the price must remain clearly allocated to the offer and easily recognisable, which has to be checked specifically where the ad text has been changed.

Elsewhere, the exclusions go further than the law: according to the advertising policies (as of 10 September 2026), regulated industries outside the United States are in part completely excluded from booking. Advertising for legal services is currently completely excluded outside the United States; the same applies to health and financial services, with individual exceptions that apply only in the United States. For companies in these sectors, the assessment therefore begins with the question of access.

Brands in the ad environment

By judgment of 1 June 2026 (52 O 62/26), the Berlin Regional Court II rejected an application by a perfume group. The court held that there was no use as a trade mark under Art. 9 EUTMR, because the search engine operator was creating a new format for search results and was not engaging in its own commercial communication. These are interim injunction proceedings, and the decision is not final.

The reasoning does not, however, support an application to advertising. The court relied on the fact that the texts reflected the actual search results, that every statement was backed by a link to a search result, and that no targeted selection or steering in favour of individual providers was apparent. These three features are missing in paid ad selection. Paying for placement brings about steering in favour of a single provider, and the ad text is not backed by any organic search result.

The Berlin line cannot be relied on for attribution to the advertiser in any event. It concerns whether the operator creates its own format, not whether a booked ad is the advertiser’s commercial communication. There is still no ruling from the highest courts on the operator’s own liability.

What remains open

Above all, what remains unresolved for this channel is the attribution of the delivered ad text. German competition law regulates the attribution of agents’ conduct to the business owner in Section 8(2) UWG. It has no specific rule for the case where an ad system changes the advertiser’s text. Until this is resolved, the practical rule is: Anyone who leaves the automatic function switched on and does not check the delivered version will not be able to blame the machine.

We would be pleased to support you in reviewing your campaigns in the AI environment, in designing agency agreements and approval processes, and in assessing the allocation of roles under data protection law.

Further reading: