As a privacy professional, I’ve watched artificial intelligence (AI) technology become accessible and effective for businesses and consumers to streamline tasks, which is wonderful.
But I’ve also observed how these AI platforms use large data sets to function and sometimes prompt users to input personal details, a form of processing personal information, a type of data protected by consumer privacy laws.
If your business uses AI, it must be mentioned in your privacy policy to ensure legal compliance and keep your consumers adequately informed.
Below, I explain how you can make an AI privacy policy that appropriately communicates to your consumers if and how you collect, process, or share their data with AI platforms.
Create A Privacy Policy That Addresses AI Using Termly
You can make a privacy policy that addresses AI using Termly’s Privacy Policy Generator!
Use a Privacy Policy Generator
You can create a comprehensive AI privacy policy for your business with Termly’s free privacy policy generator.
Our automatic solution is a great way to make a customized privacy policy that complies with privacy laws and takes just minutes to complete.
You answer straightforward questions about your use of AI and your data processing activities, and the generator makes a unique privacy policy based on your answers.
View an example of what it looks like below.
Addressing AI In Your Privacy Policy
It’s essential to address how your business uses AI and how it relates to your processing of consumer personal data in your privacy policy because AI and data privacy go hand-in-hand.
When it comes to AI model training, their algorithms require massive datasets that may include categories of personal information protected by data privacy laws like the following:
- California Consumer Privacy Act (CCPA)
- General Data Protection Regulation (GDPR)
- Brazil’s General Data Protection Law (LGPD)
- South Africa’s Protection of Personal Information Act (POPIA)
- Virginia Consumer Data Protection Act (VCDPA)
Additionally, AI services often prompt users to input data when in use, in which case the user could input legally protected personal details.
To ensure legal compliance and keep users adequately informed about what’s happening to their personal information, mention how your business uses AI in your privacy policy.
What Are the Privacy Considerations of AI?
To help make writing your AI privacy policy clause easier, I’ve summarized several privacy considerations for you to contemplate regarding your business’s use of AI.
- Are you using AI in a way that complies with all applicable data privacy laws? It’s worth restating that consumer data privacy laws like the GDPR and the CCPA are written with broad enough language that they can apply to if and how you share personal data with AI algorithms or platforms. Ensure you’re following all requirements of any of these laws that impact your business.
- Are you sharing consumer personal data with a third-party AI platform or service? One example would be using a third-party AI Customer Relationship Management (CRM) platform. Disclose in a privacy policy clause that you’re sharing data in this way and why you’re doing so and inform users of their rights over that information.
- Are you using consumer data to make or train your own AI service? One example would be using customer data to train a customer support Chatbot you make and host independently. Be transparent in your privacy policy about if you use data to train your own AI algorithm. If a third party hosts the algorithm, understand that this may be considered sharing personal data.
- Can you adequately delete, correct, or amend data fed to your AI service or platform? Consumers in certain parts of the world are protected by data privacy laws that give them the right to delete, correct, access, and amend the data you collect about them. It could have legal implications if you cannot do this with data you’re feeding an AI.
- Are you providing users with adequate opt-in and opt-out consent choices? Privacy laws require you to allow users to opt into or out of certain types of data processing activities, including the selling or sharing of their information to an AI platform. You must allow users to follow through on their opt-in and opt-out rights for legal compliance.
- Is the AI platform you share data with regularly vetted for safety and security risks? AI technology is exciting but can also expose data to cybersecurity risks. Ensure any AI you’re using is adequately vetted for safety and security risks to avoid unauthorized access to personal information.
How To Talk About AI in Your Privacy Policy
I’ll now walk you through how you should talk about AI in your privacy policy and provide tips on what to address, why, and how.
Disclose What AI Services You Use
Your privacy policy should have a specific clause that clearly discloses what AI services your business uses, including:
- AI tools and resources made by third-party platforms
- AI you’ve created yourself using a no-code platform or hosted by an external entity
- AI you’ve created on a platform you own yourself
You might consider listing them by name, so your users know specifically what features AI and what doesn’t.
Explain How and Why User Personal Data is Shared with AI Platforms
Your privacy policy should explain how user data is shared with AI platforms and define your purpose for processing their data in this way.
Adding this information to your privacy policy can help you comply with privacy laws because most require you to disclose to users why you’re collecting their information.
On the other hand, explaining how you share their data with an AI service or feature helps keep them properly informed.
They can then choose if they want their data used for such purposes and will know how to avoid providing it if they decide not to.
Inform Users of Their Data Privacy Rights
Ensure you’re explaining to users how they can follow through on their privacy rights in your privacy policy, including how to make requests about data shared with an AI.
Providing this information is required by data privacy laws, but it also helps you implement more organized, secure data processing procedures.
How Termly Can Help with AI Privacy Policy
Termly’s Privacy Policy Generator makes adding an AI clause to your privacy policy extra easy.
One section asks questions about what AI platforms your business uses and allows you to select from a checklist or input your own answers.
It then makes a comprehensive AI clause that discloses all necessary information your users need to know about your use of AI and your data processing activities.
Backed by our legal team and data privacy experts, it also features clauses to comply with 26 laws and counting.
Summary
AI is fun, new, and exciting — but for it to remain a sustainable, safe technology for consumers and businesses, we need to use it responsibly and in a legally sound manner.
In the world of data privacy, this includes transparently informing consumers if and when AI is in use on your website through a comprehensive, well-written privacy policy.
It should explain what AI services you’re using, if consumer data is shared with those services, the rights users have over that information, and how they can act on them.
Luckily, adding an AI privacy policy clause with Termly’s Privacy Policy Generator is as easy as answering a few multiple-choice questions.
More about the author
Written by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Masha is an Information Security and Data Privacy Specialist and a Certified Data Protection Officer. She has been a Data Protection Officer for the past six years, helping small and medium-sized enterprises achieve legal compliance. She has also been a privacy compliance mentor to many international business accelerators. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD). Masha studied Law at Belgrade University, and she passed the Bar examination in 2016. More about the author
