AI in your online shop and the GDPR, the AI Act and your terms: what to tell customers
Product recommendations, guided-selling quizzes, shopping assistants, AI-written descriptions – artificial intelligence is reaching online shops faster than their terms and privacy policies change. Since August 2, 2026, the AI Act’s transparency rules apply, and the GDPR covers every feature that analyses shopper behaviour. Here is a practical overview for EU shops: what really applies to an ordinary online store, what to put in the privacy policy and terms, and a sample clause to adapt.
This is a practical guide, not legal advice. Have your terms and privacy policy reviewed by a lawyer, especially if AI processes customer data.
Where shops use AI – and what follows from it
| Feature | AI Act | GDPR |
|---|---|---|
| Chat / shopping assistant | The shopper must know they are talking to AI (Art. 50(1)) | Conversation content is personal data when shoppers share it |
| Behaviour-based recommendations | Usually no specific obligations – not a high-risk system | Profiling: information duty, legal basis, right to object |
| Guided-selling quiz (e.g. gift finder) | No specific obligations when it is a question form; if it is a conversation with AI – as for chat | Answers stored and linked to a shopper are personal data |
| AI-generated descriptions and images | Marking synthetic content is mainly the tool provider’s duty; label realistic images that could pass as real photos | Usually not relevant |
The AI Act in a shop: less than you think
The AI Act classifies systems by risk. Recommendations, search or a quiz in a shop are not high-risk (that category covers areas such as recruitment, credit scoring or education). For a shop, the key part is Article 50 – transparency obligations:
- Chat and assistants: a person interacting with an AI system must be informed of it, unless it is obvious. In practice: a clear “AI assistant” notice at the start of the conversation, in every shop language.
- Generated content: providers of systems that generate text, images or video must mark them in a machine-readable way. That is primarily the tool maker’s duty, not the shop’s. A shop that publishes realistic AI-generated images that could pass as real photos should label them.
Dates: Article 50 applies from August 2, 2026. The Digital Omnibus package (published in July 2026) gave systems placed on the market before that date a transitional period for content marking until December 2, 2026.
Regardless of the AI Act, ordinary consumer law and Google’s rules apply: a product image must show the real product. An AI visualisation that makes the product look better than it is leads straight to complaints – and in Merchant Center, to disapprovals.
GDPR: recommendations are profiling
If a system remembers what a shopper viewed, skipped and bought, and picks products on that basis, that is profiling under the GDPR (Art. 4(4)). It is not forbidden, but it requires a few things:
- Information in the privacy policy: what is analysed, for what purpose, how long the data is kept and who receives it.
- A legal basis: for on-site recommendations, legitimate interest (Art. 6(1)(f)) is the usual choice. The shopper then has the right to object (Art. 21).
- Consent for cookies and similar technologies: if behaviour tracking relies on cookies, localStorage or browser identifiers that are not strictly necessary for the shop to work, consent is required (ePrivacy Directive, Art. 5(3), as implemented nationally). Recommendations that run without consent should only use the current session or data not linked to a person.
- An external AI provider: if customer data goes to a model provider’s API, that provider is a processor – you need a data processing agreement (Art. 28) and, for transfers outside the EEA, a valid transfer mechanism.
Article 22 GDPR (decisions based solely on automated processing) usually does not cover recommendations, because choosing which products to show has no legal effect on the shopper. It would be different if AI decided, for example, to refuse a sale or deferred payment.
Two things shops often mix up
- Personalised prices are not recommendations. The duty to inform that a price was personalised on the basis of automated decision-making concerns the price. Showing different products to different shoppers does not trigger it.
- The DSA’s rules on recommender systems (Art. 27) apply to online platforms such as marketplaces, not to a shop selling its own products.
A sample privacy policy clause
Adapt it to how your shop actually works:
Product recommendations and shopping assistant. Our shop uses tools based on artificial intelligence to help you choose products: a guided-selling quiz and recommendations. Based on your quiz answers and on the products you view, skip and add to the cart during your visit, we suggest products. We do this on the basis of our legitimate interest in making product choice easier (Art. 6(1)(f) GDPR). Recommendations do not affect prices or your ability to place an order. You can object to this processing at any time. [If applicable: To generate quiz content we use the services of [provider], which acts under a data processing agreement; we share only product catalog data / the following data: ….] We keep data about your behaviour in the shop for [period].
If the shop has an AI chat, add a short notice in the chat window itself: “You are talking to an AI assistant. Answers may contain mistakes – for order questions, please contact us.”
Checklist
- List every AI feature in the shop: modules, chat, generated descriptions and images.
- For each, establish what data it processes and where it sends it.
- AI chat: a notice at the first message, in every language.
- Privacy policy: profiling, legal basis, right to object, providers.
- Cookie banner: behaviour tracking only after consent, unless strictly necessary.
- Data processing agreements with AI providers that receive personal data.
- Product images: real ones, with realistic AI visualisations labelled.
AI in your shop that is easy to explain to customers
OmniSales AI is a guided-selling quiz and product recommendation module for PrestaShop 8 and 9. AI prepares the quiz from your product catalog – categories, features and prices – and recommendations react to what the shopper rejected. A clear split of features makes them easy to describe in your privacy policy and terms.