How to Disclose AI Use in Your Privacy Policy (With Examples and Templates) | PolicyForge

How to Disclose AI Use in Your Privacy Policy (With Examples)

Your product almost certainly uses AI. Maybe it's a recommendation engine, a chatbot, an auto-complete feature, or a content moderation filter. And if your privacy policy doesn't mention any of it, you have a gap that regulators, enterprise customers, and increasingly savvy consumers are starting to notice.

The EU AI Act, GDPR, and evolving FTC guidance all point in the same direction: if your product uses AI that touches user data or influences user experience, your privacy policy needs to say so explicitly. This guide gives you the exact sections to add, template language you can customize, and real examples from companies that are doing it well.

What Counts as AI Use That Needs Disclosure

AI disclosure isn't just for companies building large language models. If your product does any of the following, it qualifies.

Recommendation algorithms. If your product suggests content, products, connections, or actions based on user behavior or preferences, that's AI-driven personalization. This includes everything from "customers also bought" sections to personalized feeds, playlist generation, and smart notifications.

AI chatbots and virtual assistants. Any conversational interface powered by AI needs disclosure, whether it's a customer support bot, an in-app assistant, or a conversational search feature. Under the EU AI Act, you must also identify these as AI at the point of interaction, but your privacy policy should document the data practices behind them.

Content generation or summarization. If your product generates text, images, code, summaries, translations, or any other content using AI, users need to know. This covers features like AI writing assistants, automated report generation, smart compose, and AI-powered editing suggestions.

Automated moderation and filtering. Content moderation systems that use AI to flag, remove, or deprioritize user content are making decisions that affect users. Spam filters, comment moderation, content safety systems, and trust-and-safety tools all fall here.

Predictive analytics and profiling. If your product uses AI to score users, predict behavior, assess risk, segment audiences, or create user profiles for any purpose, that's profiling under GDPR and needs explicit disclosure. This includes lead scoring, churn prediction, fraud detection, and dynamic pricing.

AI-powered search. Semantic search, natural language queries, and AI-ranked results all use models that process user data. If your search is smarter than keyword matching, it's AI and it belongs in your privacy policy.

The general rule: if a feature would stop working without a machine learning model behind it, you should disclose it.

Five Sections to Add to Your Privacy Policy

Here are the five sections every AI-using product needs, along with template language you can adapt to your specific situation. Text in [brackets] is meant for you to customize.

1. What AI Systems You Use and Their Purpose

Users deserve a clear, plain-language explanation of what AI does in your product. Don't hide it in a paragraph about "service improvement." Give it its own section.

Template language:

Artificial Intelligence and Automated Systems

[Company Name] uses artificial intelligence and machine learning technologies to provide and improve certain features of our [product/service]. These include:

• [Feature name]: [Brief description of what it does and why]. For example, [specific example of the feature in action].

• [Feature name]: [Brief description of what it does and why].

• [Feature name]: [Brief description of what it does and why].

We use these technologies to [primary purpose, e.g., "improve the relevance of content you see," "provide faster customer support," "detect and prevent fraudulent activity"]. The following sections explain how data is used in these systems and the choices available to you.

Be specific. "We use AI to improve your experience" tells users nothing. "We use AI to recommend articles based on your reading history and stated interests" tells them exactly what's happening.

2. What Data Feeds Into AI Models

Users need to know what information your AI systems process about them. This section connects your AI features to specific data categories.

Template language:

Data Used in AI Systems

Our AI-powered features process the following categories of data:

• Usage data: [Specify: browsing history, search queries, feature interactions, time spent on content, click patterns].

• Content you provide: [Specify: text you enter, files you upload, messages you send, feedback you give].

• Account information: [Specify: profile details, preferences, settings, subscription tier].

• Device and technical data: [Specify: device type, browser, location data, language settings].

We process this data to [operate/improve] the AI features described above. The legal basis for this processing is [legitimate interest in providing and improving our service / your consent / performance of our contract with you]. For more information about our legal bases for processing, see [link to relevant section].

Don't make users guess which data points feed your models. If your recommendation engine uses purchase history but not browsing history, say so. Precision builds trust and satisfies regulators.

3. Whether User Data Trains Your Models

This is the question users increasingly care about most, and the one many privacy policies dodge entirely. Be direct about whether user data improves your AI models and give users a way to opt out.

Template language (if you do use data for training):

AI Model Training and Improvement

We may use [content you provide / usage patterns / de-identified interaction data] to train and improve our AI models. This helps us [improve accuracy, reduce errors, develop new features, etc.].

When we use data for model training, we [describe safeguards: apply de-identification techniques, aggregate data before training, remove personally identifiable information, etc.].

Your choices: You can opt out of having your data used for AI model training by [describe method: visiting your account settings, contacting us at [email], toggling the setting in [specific location]]. Opting out will not affect your ability to use [product/service], though [note any feature limitations, if applicable].

Template language (if you don't):

AI Model Training

[Company Name] does not use your personal data or content to train our AI models. Our AI features are powered by [third-party models / pre-trained models] and your data is processed only to deliver results to you in real time. It is not retained for model improvement purposes.

Whichever applies, say it clearly. The ambiguity is what gets companies in trouble. Enterprise customers increasingly require contractual commitments on this point, and regulators view silence as a red flag.

4. Automated Decision-Making and Human Oversight

If your AI makes decisions that affect users, especially decisions with legal or significant consequences, GDPR Article 22 and the EU AI Act both require disclosure and, in many cases, the option for human review.

Template language:

Automated Decision-Making

Some features of [product/service] involve automated decision-making, where an AI system produces an output or recommendation without direct human involvement at the time of the decision. These include:

• [Feature]: [What it decides and what the impact is. E.g., "Our fraud detection system may automatically flag or block transactions it identifies as potentially fraudulent."]

• [Feature]: [What it decides and what the impact is.]

Human oversight: [Describe your oversight process. E.g., "Flagged transactions are reviewed by our security team within [timeframe]. No account is permanently restricted based solely on an automated decision without human review."]

Your rights: You have the right to [request human review of an automated decision / obtain an explanation of how a decision was reached / contest an automated decision]. To exercise these rights, contact us at [email/form link]. We will respond within [timeframe, e.g., 30 days].

Even if your automated decisions aren't "consequential" in the legal sense, disclosing them proactively shows maturity and prevents surprises. Users who understand how your system works are less likely to feel blindsided when something goes wrong.

5. AI Output Accuracy Limitations

AI outputs are probabilistic, not perfect. Your privacy policy should set realistic expectations, especially if users might rely on AI-generated content for important decisions.

Template language:

Accuracy and Limitations of AI Features

While we work to ensure our AI-powered features are helpful and accurate, AI-generated outputs may contain errors, inaccuracies, or incomplete information. Specifically:

• AI-generated [content/recommendations/analyses] should not be treated as [professional advice / verified facts / a substitute for human judgment].

• Results may vary based on the quality and completeness of input data.

• AI models may reflect biases present in training data despite our efforts to identify and mitigate them.

We recommend [verifying important information independently / consulting a qualified professional before acting on AI-generated content / reviewing AI outputs before sharing them externally].

If you believe an AI feature has produced an inaccurate or harmful output, please contact us at [email/form link] so we can investigate and improve.

This section protects you legally and respects your users at the same time. It's not a weakness to acknowledge limitations. It's a signal that you understand the technology you're deploying.

How Leading Companies Handle AI Disclosure

Several major companies have set strong precedents for AI transparency in their privacy policies.

OpenAI's privacy policy explicitly addresses what data is collected during conversations, how that data may be used for model training, and how users can opt out. They separate consumer and enterprise data handling clearly.

Notion discloses how their AI features process workspace content, specifies that enterprise customer data is not used for model training, and explains the role of third-party AI providers in their stack.

Zoom's AI Companion documentation details what meeting data the AI processes, makes clear that meeting content is not used to train Zoom's or any third-party AI models, and explains how administrators can control AI feature availability.

GitHub's Copilot disclosures address code snippet processing, differentiate between individual and business tier data handling, and explain their approach to filtering out personal information from training data.

For a curated collection of real-world examples you can reference, visit our AI privacy policy examples page.

Common Mistakes to Avoid

Even companies that attempt AI disclosure often get it wrong. Here are the patterns to watch for.

Burying it in boilerplate. If your AI disclosure is a single sentence nested inside a paragraph about cookies, users won't find it and regulators won't be impressed. Give AI its own clearly labeled section with a heading that's easy to scan.

Being vague on purpose. "We may use advanced technologies to enhance your experience" is not a disclosure. It's a deflection. Name the AI systems, describe what they do, and specify what data they use. Vagueness invites both regulatory scrutiny and user distrust.

No opt-out for model training. If you use customer data to train AI models and don't offer an opt-out, you're out of step with market expectations and likely out of compliance with GDPR's data minimization and purpose limitation principles. Even if you believe legitimate interest covers you, offering the choice demonstrates respect for user autonomy.

Ignoring third-party AI. If you integrate OpenAI's API, Google's Vertex AI, or any other third-party AI service, that data sharing needs disclosure. Users have a right to know when their data leaves your systems and enters another company's infrastructure, even through an API call.

Treating it as a one-time task. AI features evolve rapidly. A privacy policy written when you had one chatbot is outdated three months later when you've added AI search, content generation, and predictive analytics. Build quarterly reviews into your process.

Get Your AI Disclosure Right

Writing AI-specific privacy policy language from scratch takes time and legal knowledge that most teams don't have on hand. PolicyForge's privacy policy generator asks you about your specific AI use cases and produces customized, regulation-aware disclosure language in minutes.

Or browse our privacy policy examples for general templates and our AI privacy policy examples for AI-specific language you can adapt.

Need to understand the regulatory backdrop? Our GDPR explainer covers the foundational data protection framework that your AI disclosure builds on.

This article is for informational purposes and does not constitute legal advice. Consult a qualified attorney for guidance specific to your product and jurisdiction.