Ready for the new Google Consent Mode v2?Jetzt mehr erfahren »

Can AI be GDPR compliant? What to look out for

A robotic hand reaching for a human hand

In early February, Italian data protection authority Garante asked AI chatbot Replica to stop processing citizens’ personal data. The purpose of the AI ​​software was to be a virtual “AI friend” for social interactions that did not require age verification. The DPA found that the AI ​​bot had processed children’s personal data without their consent.

As AI technologies advance, especially after the launch of ChatGPT and Google Bard, more similar cases might appear.

And before you unknowingly find yourself in such a situation, it would make a lot of sense to learn about the AI-related provisions of the GDPR :

Personal data:

AI systems are designed to collect large amounts of data, including personal data, which is then analyzed and processed. According to the GDPR, certain requirements must be met for this. The focus is on transparency, legality and security in the processing of personal data. AI systems must therefore be developed with these data protection requirements in mind. Users must be informed about what data is collected and how it is used. And they must be able to rely on AI systems to ensure the confidentiality, integrity and availability of their personal data.


According to the GDPR, individuals have the right not to have their data used for “profiling”. Profiling is an automated process designed to predict an individual’s behaviour, preferences or interests based on data collected from them. Therefore, AI systems should be designed in such a way that the user is clearly informed about how the profiling is used.


Similar to the processing of personal data, the consent aspect of the GDPR requires that the user give their express, conscious and voluntary consent to the processing of their personal data. Therefore, AI systems must be designed in such a way that they collect such consent and provide users with comprehensive information about the data collected, the disclosure of the data to third parties and the possibility to withdraw consent at any time.


AI developers must ensure that their systems are developed with privacy in mind and that users are fully informed about the processing of their personal data. GDPR compliance is critical to instilling trust in AI systems and ensuring they are used in a way that respects citizens’ rights to privacy and data protection.

more comments


Newsletter 02/2024

DSA came into force: Does the Digital Services Act apply to your company?  In our latest article, we look at the critical updates and expanded obligations for more online sites brought about by the Digital Services Act (DSA), a key component of the EU Commission’s ‘Europe fit for the digital age’ initiative. The DSA has […]
Digital Services Act

Does the Digital Services Act (DSA) also apply to your company? Online platforms have additional obligations

The Digital Services Act sets additional transparency requirements for online platforms. The definition of an online platform under the DSA may apply to your business. As a result, you may be required to comply with the additional transparency requirements of the DSA. Read on to find out if your business falls into this category and […]