Chatbots on your website: what the ICO says and what to check first

A chatbot on your website looks like a cheap way to answer customers at midnight. It can be. But the moment it answers a question about prices, refunds or opening times, it is speaking for your business. This post covers what the ICO's published guidance says about AI and personal data, one widely reported ruling on chatbot mistakes, and a practical checklist you can work through this week.

A chatbot's answers are your answers

The best-known example is a 2024 case from British Columbia, Canada. A customer asked an airline's website chatbot about bereavement fares. The chatbot said he could apply for a reduced fare within 90 days of ticket issue, but the airline's own policy page said bereavement fares did not apply after travel was completed. The airline refused the refund. According to a law firm's write-up of the case, the Civil Resolution Tribunal found the airline liable on 14 February 2024.

The airline argued that the correct information was elsewhere on its website, and that the chatbot was a separate legal entity responsible for its own actions. The tribunal rejected both points. The write-up quotes it as saying the airline "could not separate itself from the AI chatbot that was integrated in its own website", and that "a consumer cannot be expected to double-check information it finds on one part of the website with another." The award was roughly $650 plus interest and fees.

Two honest caveats. This was a small-claims tribunal in Canada, so it does not bind a UK court. And the sum was small. But the reasoning is easy to understand and a useful warning: if your site says it, you own it, whether a person, a template or an AI wrote it.

What the ICO says about AI and personal data

If your chatbot collects names, email addresses, order details or anything else about a person, UK data protection law applies. The ICO publishes a set of guidance on AI and data protection, with chapters on lawfulness, transparency, fairness, accuracy and accountability. The ICO notes that this guidance is under review and may change because of the Data (Use and Access) Act, so check the current version before relying on any summary, including this one.

The transparency chapter is the most useful starting point for a small business. It says privacy information should cover your purposes for processing, how long you keep the data and who you share it with. When you collect data directly from people, you should give them that information at the point you collect it, and before you train a model on it or apply a model to them. For data collected indirectly, the guidance says to provide it within a reasonable period and no later than one month.

In plain terms: if a chat window asks for an email address, a short notice beside it should say what you will do with it. Your main privacy notice should also mention the chatbot and the supplier behind it. We have covered the wider rules in our posts on privacy notices and on using AI tools with customer data.

When a chatbot makes decisions about people

Most small business chatbots answer questions and nothing more. A different rule applies if a system makes decisions about people. The ICO's guidance on automated decision making explains that Articles 22A to 22D of the UK GDPR cover decisions based solely on automated processing, with no meaningful human involvement, that have a legal or similarly significant effect on someone. The guidance lists safeguards for those cases: providing information about decisions, enabling people to make representations, offering human intervention and letting people contest decisions.

The ICO updated this guidance on 31 March 2026 to reflect the Data (Use and Access) Act 2025. The updated version is a draft under public consultation, and the previous version will be withdrawn once the final guidance is published. For most small firms the practical advice is simple: do not let a chatbot approve or refuse credit, hiring, refunds above a set value or account closures without a person checking.

What people think of customer service chatbots

Customer patience is a business risk too. Recent Hacker News discussion includes a story titled "Customer Service Chatbots Must Be Stopped" from October 2026, and another headlined "I hate customer-service chatbots", about the consumer relationship with AI refunds being rocky. A chatbot with no route to a human tends to annoy people more than it helps them. An older story on the same site recalls a delivery firm's chatbot that swore and called the company the worst delivery firm. Those are headlines rather than evidence of how your own customers feel, but they show how quickly a badly set up bot becomes a talking point.

A checklist for this week

• Limit what it can talk about. Point it at your opening hours, delivery areas and menu or product details, and have it refuse anything about refunds, legal terms or complaints.
• Feed it your real policies. A bot working from an out of date page will repeat an out of date answer. Review its source material whenever you change prices or terms.
• Say it is an AI. A short line at the start of the chat avoids confusion and sets expectations.
• Always offer a person. A visible phone number, email or "talk to a human" button prevents the dead end customers complain about.
• Add a data notice. Explain what is collected, why, how long you keep it and who the supplier is, and update your privacy notice.
• Ask the supplier where data goes. Find out whether chats are stored, where, and whether they are used to train the supplier's models.
• Test it yourself. Spend half an hour trying to trick it into promising discounts or refunds, and read a sample of real chats every month.
• Keep humans on significant decisions. Let the bot gather information, and let a person decide.

Is it worth it?

For many small firms a well built FAQ page and a clear contact form do the job with less risk. A chatbot earns its place when you get many repetitive questions outside working hours and can restrict it to facts you control. If you want help scoping something like that, our AI solutions team can talk through what is sensible for your size of business, including when the answer is not to build one.

The principle running through all of this is the same as the tribunal's: a chatbot is part of your website. Treat what it says as you would treat a page you published, and what it collects as you would treat a form you built.