I Filed a GDPR Complaint Against Viber's AI. Here's a Template.

I Filed a GDPR Complaint Against Viber's AI. Here's a Template.

I recently filed formal data-protection complaints against Viber with the Luxembourg National Commission for Data Protection (CNPD), where Viber's European legal entity is established, and my local data protection authority.

The issue? Viber's AI features can process messages I send when someone else in a conversation decides to use them - even though I never requested those features and explicitly objected to that processing.

After nearly two months of correspondence with Viber, including a formal privacy objection and responses reviewed by its Data Protection Officer, Viber maintained its refusal to exclude my messages.

Here's what happened, why I believe it raises serious privacy questions, and how you can raise the same concerns yourself.

What's the problem?

Imagine you're having a private conversation on Viber.

You share personal information: perhaps your address, family details, photographs, financial information, or simply something confidential.

Another participant decides to use a ChatGPT-powered Viber feature to summarize or otherwise process the conversation.

According to Viber's explanations to me, relevant conversational content may then be processed through that feature, potentially involving an external AI provider.

You didn't activate the feature. You didn't request AI processing. But your contributions can still be included.

Viber says this processing is not continuous, uses only necessary conversational context, and is not used to train AI models.

Those safeguards are relevant, but they don't resolve my fundamental concern: What happens when one participant explicitly objects to having their personal data processed through an optional AI feature?

I formally objected. Viber refused.

I contacted Viber in August 2026 and formally objected to this processing.

I wasn't asking Viber to disable AI features for everyone. I was asking that my own contributions be excluded when another participant used them.

Viber explained that it relies on legitimate interests under data-protection law, including its interest in providing AI functionality and the interests of participants who choose to use it.

It ultimately refused to exclude my contributions, arguing that doing so could undermine the usefulness and coherence of the AI-generated results.

I then asked two additional questions:

\- If my messages cannot be excluded, can I at least be notified when they're processed through another participant's AI request?

\- Can Viber tell me which of my messages have already been included in such requests?

Viber said it would not provide individual notifications because that would require additional monitoring and processing.

It also confirmed that it does not maintain records identifying which of my messages may have been included in another participant's AI request.

So, as things stand, I cannot prevent this processing through an account-level objection mechanism, receive individual notifications, or identify which of my messages may have been processed.

Why I filed complaints

Under Article 21(1) GDPR, an objection to processing based on legitimate interests can require a controller to stop processing unless it demonstrates compelling legitimate grounds overriding the individual's interests, rights and freedoms, subject to the Article's conditions.

My question is simple:

Is making an optional AI feature more useful for one participant a sufficiently compelling reason to override another participant's valid privacy objection?

I don't believe Viber has adequately demonstrated that in its responses to me.

That's why I submitted complaints asking the relevant authorities to examine Viber's legal basis, its handling of my objection, and the effectiveness of its privacy safeguards.

To be clear, no authority has ruled that Viber violated the law in my case. These are complaints requesting an independent investigation.

I also cannot establish that any particular message of mine was transmitted to OpenAI. The concern is about the processing Viber says its features permit and the lack of an effective exclusion mechanism.

Want to raise the same concern? Here's a template.

You can adapt the following message and send it to Viber's Data Protection Officer at [email protected].

Subject: Formal objection to AI processing of my personal data

Dear Viber Data Protection Officer,

I am a Viber user and wish to formally object to the processing of my personal data, including my contributions to private and group conversations, through AI-powered features initiated by other participants.

My concern is that my messages and other personal data may be processed through optional AI features, potentially involving third-party AI service providers, without my having initiated or requested such processing.

To the extent that this processing relies on legitimate interests, I object under Article 21(1) GDPR, where applicable, on grounds relating to my particular situation.

\[Describe your particular circumstances and why this processing affects your privacy, confidentiality, or other rights.\]

I request that Viber:

1. Exclude my contributions and personal data from AI processing initiated by other participants, where my objection applies.

2. If Viber refuses, explain the compelling legitimate grounds relied upon to override my interests, rights and freedoms.

3. Explain what personal data may be processed, which third parties or categories of recipients are involved, and what safeguards apply.

4. Explain whether I can determine which of my contributions have been processed through these features.

5. Provide a written response to my objection and requests.

My Viber account identifier is: \[Your registered phone number or other identifier\]

Kind regards,

\[Your name\]

What if Viber refuses?