LLMs and your privacy policy: what website owners should clarify
LLMs and your privacy policy: what website owners should clarify
Visitors are increasingly aware that “AI features” can mean data leaves your site and is processed by another vendor. Your privacy policy should reflect reality, not boilerplate from five years ago.
Questions to answer in plain language
- Which providers receive prompts or page content (name the services where possible).
- What categories of data might be included (support messages, uploaded files, account details).
- Why you process it (service delivery, fraud prevention, product improvement) and the lawful basis where applicable.
- Retention and whether humans review excerpts for quality or safety.
Cookie banners and consent
If a tool sets cookies or uses similar tech for advertising or analytics, your CMP should match what you actually load. Mismatches create compliance risk and erode trust.
Practical next steps
- Inventory AI‑related scripts and endpoints on production.
- Map each to a vendor doc (subprocessors, DPA, data residency).
- Update your policy and, if needed, your consent categories.
- Re‑test after each change—policies drift quickly.
This article is informational, not legal advice. When in doubt, involve counsel for your jurisdiction.
What to add to your privacy policy (LLMs / AI)
If you use any AI features (chatbots, automated drafting, content moderation, analytics summaries, customer support assistants), your privacy policy should answer three reviewer-friendly questions:
- What data goes into the AI feature? (forms, comments, support tickets, uploaded files)
- Where is it processed? (your servers vs a third-party provider)
- What happens to the data afterwards? (retention, training, logging, human review)
A practical checklist
Add a short section that covers:
- Inputs: what users can submit that may be processed by an AI system.
- Purpose: why you use AI (summaries, spam detection, drafting, personalization).
- Third parties: name the provider(s) and link to their privacy terms if applicable.
- Retention: how long prompts/outputs/logs are stored.
- Training: whether your user data is used to train models (ideally: no), and how you enforce that.
- Human review: when staff may review AI-flagged content for quality/safety.
- User control: how to request deletion/export, and how to contact you.
Common mistakes (that trigger mistrust)
- Saying “we don’t collect personal data” while you run contact forms and analytics.
- Not disclosing third-party AI processing.
- Collecting more than needed (full addresses/phone numbers) for simple inquiries.
Simple wording you can reuse
We may use automated systems (including AI tools) to process information you submit (such as contact form messages) for the purpose of responding, improving our services, and preventing abuse. We do not allow these tools to use your data for model training unless explicitly stated.
Related reading
-
RAG vs MCP vs LLM (simplified): what each does and how they work together
-
Will AI eat your job in 2026? A realistic view (and how to stay valuable)