Privacy Notice for AI Chatbot Customer Service: What to Tell Customers

Privacy Notice for AI Chatbot Customer Service: What to Tell Customers

A privacy notice for AI chatbot customer service should say, in plain language, who the responsible company is, that the customer is talking to an artificial intelligence, which data is used and why, who it is shared with, how long it is kept and how to reach a person. The most useful format is a short message at the start of the conversation, with a link to the full notice. This article gives you the checklist and a step-by-step publishing process. It does not replace review by your legal counsel or data protection officer. The legal references come from Brazil's LGPD (the General Data Protection Law), but the structure applies to most privacy regimes.

Key takeaways

• Customers need to know they are talking to an AI, and which company is responsible for the service, before they send personal data.
• The notice should explain purpose, categories of data, sharing with vendors, retention and data subject rights, in language a non-specialist understands.
• A layered notice works best: a short message inside the conversation and a full page for people who want detail.
• The path to a human agent is part of the notice and must actually work, not just be written down.
• The notice is only honest if it mirrors what the system does. Map the data flow before you draft.

Why the chatbot notice cannot be the same as the website notice

Many companies already have a generic privacy policy on their website. It usually covers cookies, forms and marketing emails. When an AI agent enters customer service, the nature of the data processing changes, and the old text stops describing reality.

First, the conversation is open-ended. Customers write whatever they want: a name, an address, an order number, health details, a complaint that includes third-party data. In a form, you control the fields. In a conversation, you do not. Second, the text passes through a language model, which is almost always operated by an outside vendor, sometimes in another country. Third, the conversation may be stored for audit, service improvement or case continuity.

The LGPD rests on a transparency principle: the data subject has the right to clear, accurate and easily accessible information about the processing and about who carries it out. Applied to a chatbot, this means a customer should not find out afterward that they spoke with a machine, or that the conversation ended up with another vendor. To understand the broader frame, follow the discussion in Brazil AI regulation: what companies should watch and do now, although today's notice rests mainly on the LGPD and on guidance from Brazil's data protection authority (ANPD).

What the notice should include: the checklist

Use this list as a drafting outline. Each item should have a direct answer, without unnecessary legal jargon.

• Identification of the service: say the conversation is run by artificial intelligence and name the responsible company (the controller), with its legal name and a contact channel.
• Purpose: explain what the data is used for, for example answering questions, looking up an order, scheduling a service or routing a problem. Vague purposes such as improving our services say very little on their own.
• Data processed: describe the categories, such as name, phone number, conversation history, order number and files or voice messages sent. If the agent can receive sensitive data, say how that is handled or tell the customer not to send it.
• Legal basis: in the full notice, state what supports the processing (contract performance, preliminary procedures, legitimate interest, consent or another basis). This choice should come from legal counsel, not from the customer service team.
• Sharing: list the categories of recipients, such as the AI model provider, messaging platform, CRM and hosting. Say whether there is an international transfer.
• Retention: say how long conversations are stored and what happens afterward (deletion or anonymization).
• Automated decisions: if the AI influences something significant for the customer, such as approving, denying or prioritizing, explain the criteria in general terms and how to ask for review by a person.
• Agent limits: say what the AI does not do, for example it gives no legal or medical advice and does not change charges without human confirmation.
• Data subject rights: access, correction, deletion, information about sharing and review of automated decisions, with the channel to exercise them.
• Data protection officer contact: the name or channel of the person in charge of personal data processing, as the LGPD requires.
• Human channel: how to reach an agent, in which situations that happens and during which hours.
• Updates: the notice version date and how customers will be told about relevant changes.

Not every item needs to appear in the first message. The list describes the full notice. The short message carries only what the customer needs to know before typing.

How to say this inside the conversation without driving customers away

A notice nobody reads does not do its job. The practical answer is to work in layers.

The first layer is the opening message of the service. It should fit in a few lines and contain four things: who is speaking (an AI), on whose behalf, how the data will be used in one sentence, and how to call a person. Here is an example of the wording:

Hi! I am Company X's virtual assistant, and I use artificial intelligence. I use what you write only to handle this request, and you can talk to a person at any time by typing AGENT. Full privacy notice: link.

The second layer is the full page, with the items from the checklist above. It should open well on a phone, because many customers arrive through WhatsApp. Avoid heavy PDFs and single blocks of text.

A third layer appears at specific moments. If the customer is about to send a document, a photo or a voice message, the agent can remind them in one sentence how that material will be handled. This matters especially for voice messages, a topic we cover in transcribe WhatsApp voice messages with AI: accuracy, cost, privacy.

If the company starts conversations, the notice also has to fit the rules on permission and message templates. That point is covered in WhatsApp outbound messages: templates, opt-in and best practices.

Sharing with AI vendors: what to declare

This is the part where most notices go stale. The text says data is not shared, but the real flow involves several processors.

To write it accurately, draw the path of a typical message: the customer sends it on WhatsApp, the messaging platform delivers it to your system, the system builds the context, calls the language model, queries the CRM or ERP, records the exchange and replies. Every step involving a third party is a sharing point to declare, at least by category.

A few drafting precautions:

• Declare categories of recipients, and keep an internal, up-to-date list with vendor names, to provide when a data subject asks.
• Check each vendor's terms to see whether submitted data can be used to train models, and write the notice according to what the contract says, not what you assume.
• State any international transfer, and confirm with legal counsel the mechanism that supports it.
• Distinguish who decides about the data (controller) from who merely processes it on the company's behalf (processor). This split is explained in data controller vs processor in an AI vendor contract (LGPD).

It is also worth acknowledging technical risks that affect what you promise. Leakage of sensitive information by a model is one of the risks cataloged in the OWASP Top 10 for LLM applications. If the notice promises that the agent only accesses the data it needs, the system has to enforce that with permissions and filters, not just with instructions in the prompt.

Human channel and data subject rights

The human channel is the part of the notice customers use most in practice. It has two roles: solving what the AI cannot solve and letting data subjects exercise their rights.

To work, the channel needs four characteristics:

• It is easy to trigger, with a simple word or a button, at any point in the conversation.
• It has declared hours and a response time. If human service only exists during business hours, the notice says so and the agent explains what happens outside them. See how to handle that case in after-hours customer service with AI: what to answer and what to defer.
• It carries context along, so the customer does not repeat everything. This requires the handoff to pass the summary and history.
• It logs the request, so that requests for access, correction or deletion of data do not get lost in the middle of an ordinary conversation.

Data subject requests deserve their own flow. The agent can recognize the intent (for example, I want to delete my data), but execution and the reply should go through a person or a defined process, with identity verification. Handing over conversation data to someone who merely says they are the data subject is a risk in itself.

Step by step: publishing the notice

The method we use in customer service projects follows a few moves: map, limit, draft, pilot and transfer. Applied to the privacy notice, they look like this.

• Map: list the data the agent receives, where it is stored, who processes it and for how long it stays. Include attachments, voice messages and logs, which are often forgotten.
• Limit: reduce what the agent collects and accesses to what the purpose requires. Define what it should refuse, such as asking for full documents without need. The less data, the shorter and truer the notice.
• Draft: write the short message and the full page based on the checklist, and ask legal counsel or the data protection officer to review.
• Pilot: publish the notice in a real, restricted flow, with conversation logging and an agreed success metric. Watch whether customers ask for a human, whether they complain about privacy and whether the agent respects the stated limits.
• Transfer: give the team an owner for the notice, a review calendar and a rule that every change of vendor, model or purpose updates the text before it goes into production.

If the project involves sensitive data, large volume or decisions with significant effect, also consider an impact assessment. The content is in Data Protection Impact Assessment for AI projects (LGPD RIPD). For a broader way to structure risk, the NIST AI Risk Management Framework offers a governance reference that can be scaled to the size of the company.

Illustrative scenario: an aesthetics clinic with a WhatsApp agent

Imagine a small clinic that uses an AI agent on WhatsApp to answer questions about procedures and book consultations. This is an illustrative scenario, not a real case.

During mapping, the clinic realizes that customers send photos of their faces and describe health conditions to ask whether they can have a procedure. That is sensitive data. The clinic decides to limit: the agent does not analyze photos or assess clinical suitability, it only explains procedures in general terms and books the consultation with a practitioner.

The opening notice says the service is run by AI, that the clinic is the responsible party, that the agent does not receive or analyze photos and that health topics are passed to a person. The full notice lists the model provider and the messaging platform as recipients, states how long conversations are kept and gives the data protection officer's contact.

During the pilot, the team notices that some customers send photos anyway. Instead of ignoring it, they adjust the agent's reply to ask that the material be brought to the in-person consultation, and they revise the notice to reflect how those received files are discarded. The text now describes what actually happens.

Common mistakes when drafting the notice

• Copying the website policy and adding a line about AI, without reviewing purposes and sharing.
• Promising that no data leaves the company when a model vendor, hosting and messaging provider are in the path.
• Hiding that it is an AI, or giving the agent a name and persona that lead the customer to believe they are speaking with a person.
• Advertising a human channel that replies days later, without stating the response time.
• Not versioning the text, so nobody knows which notice applied when a conversation took place.
• Letting the agent prompt contradict the notice, for example asking for documents the notice says are not collected. The agent instructions and the notice should be reviewed together, which connects to how to write instructions for an AI support agent: 5 blocks.

Frequently asked questions

Do I need to tell customers they are talking to an AI?

Yes. It is the safest practice and consistent with the LGPD's transparency principle. Customers should know at the start that the other party is an artificial intelligence and who answers for it. Hiding this tends to create distrust and can become a problem in complaints.

Does the notice need to be inside WhatsApp, or is the website policy enough?

The website policy is necessary, but it is not enough as the only way to inform. The ideal is a short message at the start of the conversation with a link to the full text, because that is where the customer decides which data to send. Confirm the right format for your case with legal counsel.

When is consent required to use an AI chatbot?

Not always. The LGPD provides several legal bases, and handling a request from the customer themselves may rest on other bases, depending on the case. Sensitive data, secondary uses and purposes different from those disclosed require more careful analysis, which should be done by legal counsel or the data protection officer.

How often should I review the notice?

Whenever something it describes changes: the AI vendor, the model, the type of data collected, the purpose or the retention period. Beyond that, set a periodic review and keep earlier versions, so you know which text applied in each period of service.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications