Artificial intelligence is no longer a futuristic concept reserved for tech giants. Today, AI tools are embedded in websites of all sizes: chatbots answering customer questions, personalisation engines tailoring content to individual visitors, recommendation algorithms suggesting products, and analytics platforms predicting user behaviour. With the EU's AI Act now in force alongside the GDPR, website operators face a dual regulatory framework that demands transparency, consent, and accountability. This guide explains what the AI Act means for your website, how it intersects with GDPR, what it implies for cookies and tracking, and the practical steps you need to take to stay compliant.

The AI Act: The world's first comprehensive AI regulation

The European Union's AI Act (Regulation 2024/1689 on Artificial Intelligence) is the world's first comprehensive legal framework governing the development and deployment of artificial intelligence systems. It was formally adopted in June 2024, entered into force in August 2024, and is being implemented in phases through to August 2027. The regulation takes a risk-based approach, classifying AI systems into four categories: unacceptable risk (banned), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (no specific requirements).

For the vast majority of websites, the relevant category is limited risk. This includes:

  • Chatbots and virtual assistants: any AI system that interacts directly with users must disclose that the user is communicating with an AI, not a human
  • AI-generated content: text, images, audio, or video produced by AI must be labelled as such, particularly when it could be mistaken for human-created content
  • Emotion recognition and biometric categorisation systems: if used on a website (e.g., sentiment analysis of user interactions), specific transparency obligations apply
  • Deepfakes and synthetic media: any AI-manipulated content must be clearly identified

The penalties for non-compliance are significant: up to EUR 35 million or 7% of global annual turnover for violations involving prohibited AI practices, and up to EUR 15 million or 3% of turnover for other infringements. These are separate from and additional to GDPR fines.

How the AI Act and GDPR work together

The AI Act explicitly states that it supplements: rather than replaces: existing EU legislation, including the GDPR. When an AI tool on your website processes personal data, both regulations apply simultaneously. This creates a layered compliance obligation:

  • GDPR governs the data: you need a valid legal basis for processing personal data (typically consent for marketing-related AI tools), must respect data subject rights (access, deletion, portability), and must implement appropriate security measures
  • The AI Act governs the system: you must ensure transparency about AI usage, maintain documentation about the AI systems you deploy, and comply with the risk-level-specific requirements

In practice, this means that deploying an AI chatbot on your website triggers obligations under both frameworks. The GDPR requires you to have a legal basis for any personal data the chatbot collects (names, email addresses, conversation content). The AI Act requires you to inform users that they are interacting with an AI system. Neither obligation substitutes for the other.

A chatbot that collects personal data must comply with both GDPR and the AI Act simultaneously. Dual compliance is not the exception: it is the baseline expectation for any website deploying AI tools in the European Union.

Real enforcement examples: AI and data protection

European data protection authorities have already begun enforcing rules at the intersection of AI and personal data protection, even before the AI Act's provisions are fully in force:

  • Italy vs. ChatGPT (2023): The Italian data protection authority (Garante) temporarily banned ChatGPT in Italy, citing a lack of legal basis for processing personal data used in training, insufficient age verification, and inadequate transparency. OpenAI was required to implement changes before the service could resume.
  • CNIL and AI guidelines (2024): France's CNIL published detailed guidance on GDPR compliance for AI systems, emphasising that AI training on personal data requires either consent or a compelling legitimate interest, and that data subjects must be able to exercise their rights even when their data has been incorporated into a machine learning model.
  • EDPB opinion on AI models (2024): The European Data Protection Board issued an opinion clarifying that AI models trained on unlawfully collected personal data may themselves be considered unlawful, potentially requiring deletion or retraining of the model.

These enforcement actions signal a clear direction: regulators expect website operators and AI deployers to take data protection seriously, not treat it as an afterthought.

Chatbots on websites: Cookies, data, and consent

Third-party chatbot services are among the most common AI tools found on websites today. Platforms like Intercom, Drift, Tidio, Crisp, LiveChat, and Zendesk Chat all embed JavaScript on your site that typically sets multiple cookies and collects personal data.

What cookies do chatbots set?

Most chatbot platforms use cookies for the following purposes:

  • User identification: a persistent cookie that recognises returning visitors so the chatbot can continue previous conversations
  • Session management: cookies that maintain the chat session state as the user navigates between pages
  • Analytics and performance: cookies that track chatbot engagement metrics such as conversation start rates, response times, and resolution rates
  • Marketing and attribution: some chatbot platforms integrate with CRM and marketing automation tools, setting additional cookies for lead scoring and campaign attribution

Under the ePrivacy Directive (and GDPR where cookies contain personal data), all non-essential cookies require prior consent. Since chatbot identification, analytics, and marketing cookies are clearly non-essential, you must obtain consent before loading the chatbot script. This means the chatbot widget should not appear on the page: and no chatbot cookies should be set: until the visitor has actively opted in through your cookie banner.

The transparency obligation under the AI Act

Beyond cookie consent, the AI Act adds a separate requirement: if your chatbot uses artificial intelligence (which most modern chatbots do, at least for suggested responses, intent classification, or natural language understanding), you must clearly inform users that they are interacting with an AI system. This disclosure must be made at the point of interaction: typically as a notice within the chat interface itself, such as "This chat is powered by artificial intelligence" or "You are chatting with an AI assistant."

Note that this transparency obligation applies regardless of whether the chatbot sets cookies. Even a chatbot that functions without cookies must still disclose its AI nature under the AI Act.

AI-powered analytics and personalisation

Beyond chatbots, many websites deploy AI for analytics and personalisation purposes. These tools often operate behind the scenes, making them easy to overlook from a compliance perspective.

Common AI analytics and personalisation tools

  • Predictive analytics: tools that use machine learning to forecast user behaviour, such as likelihood to convert, churn risk, or lifetime value predictions
  • Content personalisation engines: systems that dynamically adjust website content, product recommendations, or pricing based on user behaviour and inferred preferences
  • Heatmap and session recording tools with AI analysis: platforms that use AI to automatically identify UX issues, friction points, or anomalous behaviour patterns
  • AI-powered A/B testing: tools that use machine learning to allocate traffic dynamically to better-performing variants (multi-armed bandit approaches)

GDPR implications of AI profiling

Under the GDPR, profiling is defined as any form of automated processing of personal data to evaluate certain personal aspects, including analysing or predicting behaviour, preferences, interests, or movements (Article 4(4)). AI-powered personalisation falls squarely within this definition.

The GDPR imposes specific requirements on profiling activities:

  • Explicit consent for marketing profiling: under Article 22, individuals have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. While most website personalisation does not reach the "legal or significant effects" threshold, using AI profiling for targeted marketing or dynamic pricing requires a strong legal basis: typically explicit consent.
  • Right to information: Article 13(2)(f) requires you to inform data subjects about the existence of automated decision-making, including profiling, and to provide meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing.
  • Right to object: Article 21 gives individuals the right to object to profiling for direct marketing purposes at any time, and this right must be presented clearly and separately from other information.
  • Data Protection Impact Assessment: large-scale profiling using AI typically requires a DPIA under Article 35, particularly when it involves systematic monitoring of publicly accessible areas or large-scale processing of special categories of data.

AI-generated content on websites

An increasing number of websites use AI to generate content: product descriptions, blog posts, FAQ answers, meta descriptions, and even entire landing pages. The AI Act introduces specific transparency obligations for such content.

Under Article 50 of the AI Act, deployers of AI systems that generate synthetic text, audio, image, or video content must disclose that the content has been artificially generated or manipulated. For website operators, this means:

  • If you use AI tools (such as ChatGPT, Claude, Jasper, or similar) to generate website content, you should consider labelling it appropriately: particularly if it could be mistaken for human-authored journalism, expert analysis, or personal testimony
  • Product reviews or testimonials generated by AI must be clearly labelled as such
  • AI-generated images used on your website should include metadata or visible labels indicating their synthetic nature

The practical implementation details are still being developed through standards and codes of practice, but the direction is clear: transparency about AI involvement in content creation is becoming a legal requirement, not just a best practice.

Practical compliance checklist for website operators

Here is a structured approach to ensuring your website complies with both the GDPR and the AI Act when using AI tools:

1. Conduct an AI audit of your website

Map every AI-powered service running on your website. This includes chatbots, personalisation engines, recommendation systems, AI analytics tools, content generation platforms, and any third-party scripts that use machine learning. For each service, document what data it collects, what cookies it sets, where data is processed (EU or third country), and what AI capabilities it uses.

2. Classify each AI tool by risk level

Under the AI Act's risk-based framework, determine whether each tool falls into the limited risk category (most common for websites) or potentially the high risk category (less common, but possible for AI systems that significantly affect individuals). Document your classification and reasoning.

3. Update your privacy policy

Your privacy policy must disclose the use of AI tools, the data they process, the purposes of processing, and the legal basis relied upon. If any tool involves automated decision-making or profiling, include the specific information required by GDPR Article 13(2)(f).

4. Update your cookie policy and consent banner

Ensure every cookie set by AI tools is listed in your cookie declaration with an accurate description. Assign AI tool cookies to the appropriate categories (typically "Functionality" for essential chatbot features or "Marketing" for personalisation and analytics). Configure your consent management platform to block these scripts until consent is granted.

5. Implement AI transparency notices

Add clear disclosures where visitors interact with AI systems. For chatbots, include a notice in the chat interface. For AI-generated content, add appropriate labels. For personalisation, disclose in your privacy policy that content may be personalised using automated processing.

6. Review data processing agreements

For every third-party AI service, ensure you have a GDPR-compliant Data Processing Agreement (DPA) in place. Verify that the provider offers adequate safeguards for international data transfers if data leaves the EU.

7. Conduct a DPIA if necessary

If your use of AI involves large-scale profiling, systematic monitoring of user behaviour, or processing of special categories of data, carry out a Data Protection Impact Assessment as required by GDPR Article 35.

The timeline: When do you need to comply?

The AI Act is being rolled out in phases:

  • February 2025: prohibitions on unacceptable-risk AI practices take effect
  • August 2025: rules for general-purpose AI models apply; governance structures must be established
  • August 2026: the majority of the regulation applies, including transparency obligations for limited-risk AI systems (chatbots, content generation)
  • August 2027: rules for high-risk AI systems embedded in regulated products take full effect

For most website operators, the key date is August 2026, when transparency obligations for chatbots and AI-generated content become enforceable. However, the GDPR obligations regarding consent, profiling, and data protection apply right now. There is no grace period for GDPR compliance: it has been fully enforceable since May 2018.

How to handle AI compliance with Consentio

Managing the cookie consent dimension of AI compliance does not have to be complex. Consentio gives you the tools to handle it systematically:

  • Automatic cookie scanning: our scanner detects all cookies set by AI tools on your website, including chatbot identification cookies, personalisation tracking, and analytics scripts. You always know exactly what is running on your site.
  • Granular category management: assign AI tool cookies to the correct consent categories. Chatbot functionality cookies, marketing personalisation cookies, and AI analytics cookies can each be placed in their appropriate category with clear descriptions.
  • Prior-consent script blocking: Consentio blocks all non-essential scripts, including AI tools, from loading until the visitor explicitly consents. No cookies are set and no data is collected until consent is granted.
  • Google Consent Mode v2 integration: for AI analytics tools that integrate with Google services, Consentio passes consent signals correctly through Consent Mode v2, ensuring your entire measurement stack respects user choices.
  • Consent records: every consent decision is logged with a timestamp, making it easy to demonstrate compliance if a data protection authority requests evidence.

Want to ensure your website's AI tools are fully compliant? Start with Consentio for free: scan your site in minutes, identify every cookie set by your AI tools, and configure a consent banner that keeps you on the right side of both the GDPR and the AI Act.