AI assistants on marketing sites store conversations, capture leads, and follow up, and regulators and visitors both expect you to say so before the first message. Here's the consent pattern we use.
If your website has an AI assistant, it's collecting data. Every conversation gets stored somewhere, the contact details a visitor types land in a table, and if the assistant captures leads, which almost any assistant on a marketing site does, that information feeds a follow-up process the visitor may not realize they've joined.
There's nothing sinister in any of that, since it's simply how these tools work. The trouble starts when a company collects the data without telling anyone.
What people now expect
Enforcement attention on chatbots that collect data quietly has been rising, and the cases that reach the news follow a consistent pattern. The AI itself is rarely the issue. The issue is that visitors weren't told they were talking to software, weren't told the conversation was being recorded and kept, or weren't told what they shared would be used to contact them.
Those are old obligations in new clothes. Wiretap and session-recording laws, state privacy statutes, and the long-standing rules against unfair practices all existed before chatbots, and a chat window that silently logs conversations looks to a regulator a lot like an undisclosed recording. Nobody needs a novel legal theory to end up a defendant, a chat bubble without a disclosure is enough.
What honest disclosure looks like
Set the legal detail aside and the requirements are plain.
Say it's an AI, before the conversation starts and somewhere more visible than a footer. Nobody should find out halfway through that the helpful person was software.
Say what you collect and why: the messages, the contact details, and what you'll do with them. One honest paragraph does more than a linked 4,000-word policy, though you should link the policy as well.
Ask for a clear yes. A visible "I agree" button the visitor clicks is worth more than consent implied by continuing to type, both legally and as a signal of trust.
Leave another door open. Someone who'd rather not share details with an AI should have a way to reach a person, like a booking link or an email address, without being penalized for choosing it.
Keep a record. Consent you can't prove is consent you don't have, so store when the visitor agreed alongside what they shared.
How we do it
We run an AI assistant named Gloria on our own pages, so we built the consent flow we'd recommend to a client, in three steps.
The notice. Before the chat opens, the visitor sees a plain-English note: Gloria is an AI assistant, messages and contact details are collected and stored, they're used only to respond to the inquiry, and continuing means agreeing to follow-up. The privacy policy is linked in the same paragraph, there's one button to agree and continue, and there's a clear alternative for anyone who'd rather reach a person through the contact form or by email.
Identification. After agreeing, the visitor gives their name, phone, and company in a labeled form, filled in knowingly, instead of having those details teased out mid-conversation where consent gets blurry.
The conversation, and the record. The time of consent is saved with the contact record, and the agreement is remembered, so returning visitors don't have to agree again on every page.
The whole thing adds maybe fifteen seconds, and what it buys lasts: every conversation in the log belongs to someone who was told what the system is and said yes.
The usual worry
The objection is always about conversion, and yes, a consent screen will turn a few people away, mostly the ones who were never going to give you real contact details anyway. The visitors who continue have qualified themselves twice, by agreeing to follow-up and by sharing a phone number knowing why you asked, so you end up with fewer leads and better ones, and a list made entirely of people who knew they were on it.
If you're adding one
Whether you build it with us or on your own, the recipe is short: disclosure before the first message, consent as a click, the timestamp saved, the policy linked, and a path to a human left open, about an afternoon of engineering that spares you the much harder conversation, with a regulator or with your own customers, about why you didn't think they needed to know.
Set up your own operating environment.
Starter is $299, bought online, with no sales call.