How to Disclose AI Use in Your Privacy Policy (With Examples)

Reviewed September 28, 2026. An AI feature belongs in a privacy notice when it changes how the business collects, uses, shares, retains, or makes decisions with personal data. The notice should describe the real data flow, not merely state that the company “uses AI.”

A privacy policy is only one disclosure surface. A chatbot notice shown before or during an interaction, an automated decision notice, and a label on AI generated content can serve different legal and practical purposes. The correct combination depends on the data, system, role, jurisdiction, and effect on people.

This guide explains how to map an AI feature to an accurate privacy disclosure. It includes adaptable examples for AI assistants, third party model providers, model improvement, recommendations, and automated decisions. Replace every bracketed field with verified facts before publishing.

AI privacy disclosure checklist

Before drafting, answer these questions for each AI feature:

1. What does the feature do? Describe its purpose, users, outputs, and practical effect.
2. What personal data enters the system? Include prompts, files, account data, activity, inferred data, feedback, and metadata.
3. Where did the data come from? Distinguish data collected from the person, obtained from another source, generated by the system, and inferred through profiling.
4. Why is each data category processed? Separate service delivery, safety, analytics, product improvement, model evaluation, and model training.
5. What legal basis or permission applies? Do not treat consent or legitimate interests as a default answer.
6. Who receives the data? Identify internal recipients, model providers, hosting companies, reviewers, customers, and other third parties.
7. Does the provider retain or train on inputs? Verify the contract, settings, product tier, and current provider documentation.
8. Where is the data processed? Record international transfers, storage regions, subprocessors, and safeguards.
9. How long is it kept? Cover prompts, outputs, logs, feedback, evaluation sets, and derived profiles.
10. Does the system make or materially influence a decision? Record the decision, effect, role of people, explanation process, and challenge route.
11. What choices and rights are available? Confirm whether people can withdraw consent, object, opt out, delete data, correct data, or seek human review.
12. What separate notice is needed? Decide whether a point of interaction notice, content label, pre use notice, or other disclosure is required in addition to the privacy policy.

Start with a data map. The personal data guide helps identify information that may not look personal in isolation, while the controller and processor guide helps map responsibility across the provider chain.

Privacy policy disclosure and AI notice are not the same thing

Businesses often try to solve every transparency duty with one paragraph in a privacy policy. That can leave important information too far from the relevant interaction.

Disclosure surface	What it should explain	Typical placement
Privacy notice	Personal data categories, sources, purposes, legal bases, recipients, transfers, retention, rights, and qualifying automated decisions.	Privacy policy plus contextual notices where data is collected.
AI interaction notice	That a person is interacting with an AI system when the applicable rule requires it and the fact is not otherwise obvious.	At or before the chatbot, assistant, voice interface, or other interaction.
Automated decision notice	The use, logic or important factors, significance, effects, choices, and challenge route required by the applicable law.	Before the decision process and near the result or appeal mechanism.
Generated content label	That specified content was artificially generated or manipulated when a platform rule or law requires disclosure.	On or immediately next to the content, with machine readable marking where required.
Product limitation notice	Material limitations, prohibited uses, review expectations, and whether output is professional advice.	Product interface, terms, instructions, or feature documentation.

Article 50 of the EU AI Act applies to specified AI interactions, systems, and generated or manipulated content. It does not say that one paragraph in a privacy policy satisfies every transparency duty. For the current timetable and role analysis, use the EU AI Act startup guide. For notice placement examples, see the AI disclaimer decision guide.

What GDPR requires an AI privacy notice to cover

The GDPR does not require a heading called “Artificial Intelligence” for every controller. Articles 13 and 14 require information about the processing of personal data. If an AI feature changes that processing, the notice must remain accurate and sufficiently specific.

The GDPR text requires information that can include:

• The controller's identity and contact details.
• The purposes and legal basis for processing.
• Legitimate interests where Article 6(1)(f) is used.
• Categories of personal data when Article 14 applies.
• Recipients or categories of recipients.
• International transfers and applicable safeguards.
• The retention period or criteria used to determine it.
• Applicable data subject rights and the complaint route.
• Whether providing data is required and possible consequences of not providing it.
• The existence of qualifying automated decision making, including profiling, and meaningful information about the logic involved, significance, and envisaged consequences.

Do not copy the entire AI system inventory into a public notice. Translate it into information that lets a person understand what happens to their data. Use layered notices when a concise first layer can link to more detail without hiding important facts.

Step 1: describe the AI feature and its purpose

Name the user facing feature and explain what it does in plain language. A model name alone is rarely enough because the same model can support very different processing.

Example: AI assistant purpose

We provide an AI assistant that answers questions about [product or subject]. When you use the assistant, we process the text you submit and relevant [account, workspace, or document] information to generate a response, maintain the conversation, prevent misuse, and troubleshoot the feature.

If the feature has several purposes, separate them. Delivering an answer, monitoring abuse, measuring performance, improving prompts, training a model, and personalizing marketing are not interchangeable purposes.

Step 2: identify data inputs, sources, and inferences

Map direct inputs and less obvious data. An AI assistant may process more than the prompt displayed on screen.

• User content: prompts, messages, documents, images, audio, code, and feedback.
• Context data: account details, workspace content, prior messages, preferences, or selected records supplied to the model.
• Technical data: device, browser, IP address, timestamps, diagnostic logs, and safety signals.
• Derived data: scores, classifications, summaries, embeddings, inferred interests, risk indicators, or profiles.
• External data: public sources, licensed datasets, customer supplied datasets, or data supplied by another controller.

Example: data categories

The assistant processes your prompts, files you choose to attach, the conversation history needed to respond, and technical logs such as timestamps and error events. If you connect [workspace or data source], the assistant retrieves only the records selected or authorized for that request. The system may generate summaries and classifications from this information.

Avoid promising that data is anonymous merely because direct identifiers were removed. The EDPB opinion on AI models says anonymity requires a case specific assessment of whether people can be identified and whether personal data can be extracted from the model.

Step 3: document the legal basis without guessing

Under GDPR, choose a lawful basis for each distinct purpose before processing. Consent, contract, and legitimate interests have different conditions. Do not publish a template that lists several alternatives without stating which one actually applies.

Example: lawful basis structure

We process prompts and selected workspace content to provide the assistant you request. Our legal basis is [identify and explain the verified basis]. We process limited security logs to detect abuse and protect the service based on [identify the verified basis and, where relevant, the legitimate interests pursued]. We use conversation data for model training only as described under “Model training and improvement.”

Special category data needs an Article 9 condition in addition to an Article 6 basis. Biometric, health, employment, financial, and children's data can also trigger sector specific or local requirements. A general AI paragraph cannot resolve those issues.

Step 4: name AI providers and explain their role

If prompts or other personal data are sent to a model or infrastructure provider, explain the recipient or recipient category with enough specificity to be useful. Confirm whether the provider acts as a processor, independent controller, or something else for each activity. The contract label should match the facts.

Example: third party model provider

We send the prompt and the minimum context needed to [provider name or provider category] to generate a response. The provider processes this information on our behalf under our agreement for [service purpose]. Under our current configuration, [state the verified retention period and whether the provider may use the data to train or improve its models]. The provider and relevant subprocessors may process data in [locations], subject to [verified transfer mechanism or safeguard].

Review provider documentation by product tier and configuration. Consumer services, enterprise accounts, and API services can have different retention and training terms. Save the version and date reviewed.

Step 5: separate service delivery from model training

Using a prompt to generate a requested response is different from retaining that prompt in an evaluation set or using it to train or fine tune a model. State which activities occur and which do not.

Example: no customer content used for training

We do not use your prompts, uploaded files, or generated outputs to train our general purpose models. We retain [identify data] for [period or criteria] to provide the feature, maintain security, and resolve errors. We may use [clearly defined data, such as voluntary feedback] for improvement only when [verified condition or choice] applies.

Example: data used for model improvement

We use [specific data categories] to evaluate and improve [identified model or feature] for [specific purpose]. Before doing so, we [describe verified filtering, access, minimisation, or de identification controls]. Our legal basis or permission is [verified basis]. You can [describe the actual choice or right] by [method]. This choice takes effect [timing] and has [verified consequence, if any].

Do not promise an opt out unless the product can honor it across logs, datasets, vendors, and future training runs. Do not state that an opt out is universally required by GDPR. The result depends on the processing, legal basis, rights invoked, jurisdiction, and any applicable exception.

The US Federal Trade Commission has warned AI companies to honor privacy and confidentiality commitments and not quietly expand data uses through buried policy changes. Its AI privacy commitments guidance emphasizes clear notice and the risk of misrepresentation or material omission. The Everalbum matter also illustrates that an order can require deletion of models developed from improperly used data.

Step 6: explain automated decisions precisely

Not every recommendation, score, or AI output is an Article 22 decision. Under GDPR, Article 22 focuses on a decision based solely on automated processing that produces legal effects or similarly significantly affects a person. The EDPB automated decision guidance explains profiling, significant effects, safeguards, and meaningful human involvement.

Document the decision and the real role of people. A human who automatically accepts the output without authority, information, or time to change it may not provide meaningful human involvement.

Example: significant automated decision

We use [system] to [make or support] decisions about [employment, credit, housing, access, pricing, or other outcome]. The system considers [main data categories and important factors] to [describe the output]. The decision may affect you by [significance and envisaged consequences]. [Describe whether the decision is solely automated and any human review.] Where applicable, you may request human intervention, express your point of view, and contest the decision by [method].

Example: recommendation that is not presented as a significant decision

We use your [activity and preferences] to rank and recommend [content or products]. The recommendation changes the order of items shown to you, but it does not determine your eligibility for a service or produce a legal or similarly significant effect. You can [reset personalization, change preferences, or use a non personalized view] by [method].

California's finalized automated decisionmaking technology regulations took effect in 2026, with the specific significant decision requirements scheduled for compliance beginning January 1, 2027. The California Privacy Protection Agency FAQ describes notice, access to meaningful information, and opt out rights for covered uses. Colorado's revised automated decision law is also scheduled for January 1, 2027, according to the Colorado Attorney General. Check current scope and implementation dates before publishing a multistate statement.

Step 7: explain rights, choices, retention, and security

Connect each choice to a working control. Common examples include deleting conversation history, disabling training use, changing personalization settings, objecting to processing, correcting account data, and requesting human review. Do not combine a legal right and an optional product preference as though they are the same.

Example: choices and retention

You can delete an assistant conversation from [location]. We remove it from your active account within [verified timing] and retain [specified records] for [period or criteria] where needed for [security, legal, or other purpose]. You can change [training, personalization, or history] settings at [location]. To exercise an applicable privacy right, contact [method]. We may need to verify your request.

Describe security in a way the company can support. Statements such as “fully secure,” “anonymous,” or “never stored” are risky when logs, backups, vendor systems, or human review create exceptions.

Step 8: place point of interaction notices where people see them

If a person must be told that they are interacting with AI, place the notice in the interface before or at the beginning of that interaction. A privacy-policy link in the footer may be too remote. If a separate rule requires a pre use automated decision notice or a generated content label, implement it in the relevant flow.

Example: short AI assistant notice

You are interacting with an AI assistant. Your messages and the selected account context are processed to generate responses. Do not submit information you are not authorized to share. Learn how data is handled in our [AI and privacy notice].

Keep the short notice consistent with the full privacy disclosure. If the interface says conversations are not used for training, the provider settings, contract, retention, and internal workflow must support that statement.

Common AI disclosure mistakes

• Calling every algorithm AI without explaining the processing. The label does not tell people what happens to their data.
• Claiming every AI feature legally requires the same notice. Scope and placement differ across privacy, AI, consumer, employment, and sector rules.
• Listing several possible legal bases. A published notice should reflect the basis actually selected for each purpose.
• Ignoring retrieved context. A prompt may cause the system to access workspace records, emails, files, or customer data that also need to be disclosed.
• Omitting provider reuse. State the verified training, evaluation, retention, and human review treatment for the applicable product tier.
• Promising anonymisation too easily. Pseudonymisation, removal of direct identifiers, and aggregation do not automatically make a model or dataset anonymous.
• Using “human in the loop” as a slogan. Describe the person's authority, information, timing, and actual ability to change the outcome.
• Putting output limitations in place of a privacy disclosure. Accuracy and professional advice warnings can be useful, but they do not explain personal data processing.
• Updating the policy without updating the product. Notices, settings, vendor contracts, deletion paths, and operational practices must agree.

Implementation workflow for product teams

1. Create one record per AI feature with an owner and next review date.
2. Diagram the path from user input through retrieval, model provider, output, logs, review, and deletion.
3. Separate purposes and choose the verified legal basis or permission for each.
4. Review processor roles, contracts, subprocessors, regions, retention, and training settings.
5. Assess automated decisions, profiling, children, sensitive data, biometrics, employment, and other higher risk contexts.
6. Draft the full privacy disclosure and any shorter contextual notices.
7. Test every setting, opt out, deletion method, and contact route named in the text.
8. Obtain product, privacy, security, and legal review appropriate to the risk.
9. Capture evidence of the published version and the facts it was based on.
10. Review when the model, provider, purpose, dataset, retention, geography, or user group changes.

Use the AI company privacy policy workflow to organize a draft from verified product facts. The AI privacy policy examples provide additional structures, and the privacy policy generator can help assemble the broader notice. Treat every generated clause as a draft for factual and legal review.

Frequently asked questions

Does every use of AI need to appear in a privacy policy?

No. A privacy policy explains personal data processing. If an AI feature does not change how personal data is collected, used, shared, retained, or used for decisions, it may not require an AI specific privacy section. Other product, consumer, platform, or AI transparency duties can still apply.

Is an AI privacy policy disclosure enough for the EU AI Act?

No. The EU AI Act includes role and risk based duties, and Article 50 requires specified notices and content marking in relevant contexts. A privacy policy does not replace an interaction notice, generated content label, technical documentation, risk control, or conformity work.

Must a company offer an opt out of AI model training?

Not as a universal rule for every company and dataset. The answer depends on the law, legal basis, data, role, promises, rights invoked, and processing design. If an opt out is offered, the company must be able to honor it accurately.

Should a privacy policy name the AI provider?

GDPR requires recipients or categories of recipients, and other laws or contracts can require more. Naming a material provider can improve clarity, but the right level of detail depends on the context. Keep any provider list current and explain the provider's actual role.

What if the AI provider says it does not train on customer data?

Verify that statement for the exact service, tier, configuration, and agreement. Also check abuse monitoring, human review, diagnostic logs, retention, subprocessors, and optional feedback programs. “No training” does not necessarily mean “no retention” or “no processing.”

How often should an AI disclosure be reviewed?

Review it whenever a material fact changes and set a periodic review based on the rate of product change. Common triggers include a new provider, model, purpose, data source, connected system, user group, geography, retention rule, or automated decision.

Can I copy these examples directly?

Use them as drafting structures only. Remove statements that do not apply, replace brackets with verified facts, and add information required by the laws and contracts relevant to the product. A polished but inaccurate template can be worse than a shorter truthful notice.

Publish only what the product can prove

A strong AI privacy disclosure starts with evidence. It names the feature, describes the data and purpose, explains providers and training treatment, distinguishes significant automated decisions, and connects people to controls that actually work.

PolicyForge can help turn that evidence into a structured draft. Use the AI privacy policy workflow, then review the result against the live product, provider terms, current official guidance, and qualified professional advice where the facts require it.