Ready for the new Google Consent Mode v2? Learn more »

Can AI be GDPR compliant? What to look out for

A robotic hand reaching for a human hand

In early February, Italian data protection authority Garante asked AI chatbot Replica to stop processing citizens’ personal data. The purpose of the AI ​​software was to be a virtual “AI friend” for social interactions that did not require age verification. The DPA found that the AI ​​bot had processed children’s personal data without their consent.

As AI technologies advance, especially after the launch of ChatGPT and Google Bard, more similar cases might appear.

And before you unknowingly find yourself in such a situation, it would make a lot of sense to learn about the AI-related provisions of the GDPR :

Personal data:

AI systems are designed to collect large amounts of data, including personal data, which is then analyzed and processed. According to the GDPR, certain requirements must be met for this. The focus is on transparency, legality and security in the processing of personal data. AI systems must therefore be developed with these data protection requirements in mind. Users must be informed about what data is collected and how it is used. And they must be able to rely on AI systems to ensure the confidentiality, integrity and availability of their personal data.


According to the GDPR, individuals have the right not to have their data used for “profiling”. Profiling is an automated process designed to predict an individual’s behaviour, preferences or interests based on data collected from them. Therefore, AI systems should be designed in such a way that the user is clearly informed about how the profiling is used.


Similar to the processing of personal data, the consent aspect of the GDPR requires that the user give their express, conscious and voluntary consent to the processing of their personal data. Therefore, AI systems must be designed in such a way that they collect such consent and provide users with comprehensive information about the data collected, the disclosure of the data to third parties and the possibility to withdraw consent at any time.


AI developers must ensure that their systems are developed with privacy in mind and that users are fully informed about the processing of their personal data. GDPR compliance is critical to instilling trust in AI systems and ensuring they are used in a way that respects citizens’ rights to privacy and data protection.

more comments

Einhaltung der EU-Verordnung über künstliche Intelligenz consentmanager

EU Act on Artificial Intelligence

EU AI Act comes into force in August 2024 Following the European Commission’s initial proposal in April 2021, the European Parliament adopted the EU AI Act, which was published in the Official Journal of the European Union in July 2024 and is available in all member state languages. The Act will officially enter into force in August […]
Newsletter consentmanager Juni

Newsletter 06/2024

New Addon: Privacy-friendly Website Analytics With the June update, the new add-on “Website Analytics” is available in your account. Here we combine the two components that we are particularly good at: real data protection and great reporting. The advantage of our new privacy-friendly website analytics lies primarily in data protection and the simplicity of the […]