AI tracking and cookies: what to disclose?
Do you use AI for tracking or personalisation? The rules for this do not come from the AI Act but from the GDPR and the cookie rules (ePrivacy). They already apply.
The AI Act contains no separate obligation for AI-driven tracking or personalisation. The rules come from the GDPR (information duties and profiling) and the ePrivacy rules on cookies.
You need prior consent for tracking cookies. Explain clearly in your cookie banner what you use the data for. If AI profiles your visitors for personalisation, say so explicitly: a vague category such as 'marketing' is quickly not enough.
State in your privacy policy which systems you use for personalisation, which data they process and how long you keep it. Also state that people can object to profiling (GDPR Art. 13-14 and 21).
If your search function has an AI assistant that visitors converse with, the AI Act does apply: tell them they are interacting with AI (Art. 50(1)).
Want to know if this applies to your website?
Our scanner automatically checks whether your website meets these AI Act requirements and gives concrete recommendations.
Scan your website