AI Chatbot Disclosure and Privacy Notice Templates You Can Paste

Adding an AI chat widget changes what your website tells visitors in two places. Inside the chat, people need to know they are talking to an AI. In your privacy policy, a new set of data needs explaining: transcripts, email addresses and an AI model provider that reads every message. This post gives you paste-ready wording for both, plus the short notices in between, for whoever runs the widget and the policy on a small or mid-sized site: a founder, a marketer, a support lead or an agency.

Each template comes with the rule it serves, when it applies and what to change before you publish. Every legal reference was read in the official text on 19 October 2026: the EU AI Act, the GDPR and the ePrivacy Directive as published by the EU, the Digital Omnibus that amended the AI Act in July 2026, and the Utah and Maine codes on the state legislatures' own websites. The guide to chatbot disclosure laws explains why those laws apply and what breaking them costs; this post supplies the words. Treat it as general information, not legal advice, and have a lawyer review the final text, especially if you handle health, financial or children's data.

PepoChat is our product, an AI support agent for websites. The templates work with any chat tool. Where a PepoChat example appears, it is filled in from PepoChat's documentation and product as they stood on 19 October 2026, to show what an honest, specific version looks like.

Which disclosures and privacy notices does an AI chat widget need?

An AI chat widget needs five pieces of wording, each shown at the moment it matters. Two are about AI, the disclosure line and the handoff line, and three are about personal data: the privacy policy section, the notice where data is collected and the retention statement.

Article 50(1) of the EU AI Act requires that people be informed they are interacting with an AI system unless that is obvious, and Article 50(5) asks for that information in a clear and distinguishable manner "at the latest at the time of the first interaction or exposure", in an accessible form. The duty is addressed to the provider of the AI system, usually the chat vendor, but the business writes the name and greeting that carry it.

Article 113 makes these duties apply from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, left them unchanged; its grace period to 2 December 2026 covers only the machine-readable marking of AI-generated content under Article 50(2).

Utah's rules sit in Title 13, Chapter 77 of the Utah Code. Section 13-77-103 requires a business using generative AI with consumers to say so when a person clearly asks, and section 13-77-104 gives a safe harbor to a business whose AI discloses, at the outset and throughout the interaction, that it is generative AI, that it is not human, or that it is "an artificial intelligence assistant". Both sections read the same on 19 October 2026 as when they took effect on 7 May 2025.

Maine's rule was passed as section 1500-Y and has since been renumbered 10 MRSA §1500-DD, with its wording unchanged. Maine bars a chatbot that may lead a reasonable consumer to believe they are dealing with a human, unless the consumer is told clearly and conspicuously that they are not. One design satisfies the EU, Utah and Maine together: the word AI in the assistant's name, an AI line in the greeting, an honest answer to "are you a bot?" and a visible change when a person joins.

What should the AI disclosure line in a chat widget say?

The disclosure line should say in plain words that the visitor is chatting with an AI assistant and how to reach a person. Put it in the assistant's name as well as the first message, so it is still on screen after the greeting scrolls away.

Three placements do three jobs. The assistant name sits in the chat header for the whole conversation, which matches Utah's call for disclosure throughout the interaction. The greeting, the first message of a new chat, meets the EU's first-interaction deadline. The honest answer, written into the agent's instructions, covers Utah's duty to answer a clear question truthfully. In PepoChat's chat-first layout, the header's status line also begins with "AI assistant" without any setup.

Use words rather than a robot icon. Article 50(5) requires the information to meet accessibility requirements, and an icon on its own tells a screen reader user nothing unless it carries a text label.

Assistant name (chat header; PepoChat allows up to 40 characters)
  [Brand] AI assistant
  [Brand] AI support
  Ask [Brand] AI

Home screen subline (PepoChat allows up to 60 characters)
  Ask our AI assistant. A person can take over.
  Our AI assistant answers. The team replies by email.

Pick a greeting by tone; each one names the AI and the way to a person.

Expected answer to "Am I talking to a real person?"
  No, I'm [Brand]'s AI assistant, not a person. I can keep helping,
  or pass this conversation to our team.

Add to "How to sound and behave"
  If someone asks whether they are talking to a person or a bot, say that
  you are an AI assistant, not a human, then offer to bring in the team.

Add to "Never do this"
  Never say or imply that you are human. Never give yourself a human first
  name, a job title or a home town.

Name only tasks the agent can really do: an order lookup needs a store connection, and "explain delivery and returns" needs those pages in the knowledge base. The agent instructions docs explain where the two instruction lines go and what they can change.

Use the formal variant for licensed professions. Utah's section 13-77-103 requires a person in a regulated occupation to disclose generative AI prominently, in writing before a written interaction starts, when the chat collects health, financial or biometric data or gives advice someone may rely on for significant decisions. The chatbot welcome message examples have 30 more greetings by page and business type.

What should a privacy policy say about a website chatbot?

A privacy policy needs a chat section covering the items GDPR Article 13 lists: who is responsible, what the chat collects, why and on which legal basis, who receives the data (including the AI model provider), whether it leaves the EU, how long you keep it and what rights the visitor has. Article 13 says this information must be given when the data is collected, so link the section from the chat itself.

The GDPR also sets the style. Article 12(1) asks for information in a concise, transparent, intelligible and easily accessible form, in clear and plain language. Article 83(5)(b) puts breaches of the duties in Articles 12 to 22 in the higher fine tier, up to €20 million or 4% of worldwide annual turnover, whichever is higher.

Chat assistant on this website

This website has a chat window where you can ask questions. Replies come
from an AI assistant unless a member of our team joins the conversation,
in which case their name appears with their messages.

Who is responsible
[Company legal name], [postal address], is responsible for personal data
collected through the chat. Contact: [privacy email].
[Data protection officer: [name or role], [email].]

What the chat collects
- The messages you type, and any images or files you send.
- Details you choose to give, such as your name, email address, phone
  number, company or order number.
- [If visitors can verify an email] the address you confirm with a code.
- When you open the chat: [browser and operating system, screen size,
  language, timezone, the website the chat was opened on].
- [If the chat is limited by country] your country, worked out from your
  IP address. [Say whether the IP address itself is stored.]
Please do not type passwords, card numbers or health details into the chat.

Why we use it, and our legal basis
- To answer your question and follow up if you ask us to: [steps taken at
  your request or our contract with you, Article 6(1)(b) GDPR].
- To review conversations and improve our answers: [our legitimate
  interest in giving accurate support, Article 6(1)(f) GDPR].
- [To send you news or offers, only if you agree separately: consent,
  Article 6(1)(a) GDPR, which you can withdraw at any time.]

Who receives it
- [Chat provider], which runs the chat for us as our processor.
- [AI model provider], whose models write the assistant's replies. It
  receives the conversation, the parts of our content used to answer,
  and our instructions to the assistant.
- [Email provider], which sends chat emails such as verification codes
  and copies of conversations you ask for.
- [Tools the chat can look things up in, such as our order system or
  help desk], when you ask the assistant to check or create something.
- Members of our team, who read conversations handed over to them.

Transfers outside [the EU/EEA or the UK]
[Where each recipient processes data, the safeguard used, such as an
adequacy decision or Standard Contractual Clauses, and how to get a copy.]

How long we keep it
[Insert your retention statement.]

Information about other people
[If you give us details about someone else, for example when you book
for them, we use them only to deal with your request and keep them for
as long as the conversation.]

Do you have to give us personal details?
No. You can chat without giving your name or email address. Without an
email address we can only reply inside the chat window. [If an email is
required before chatting, say so and why.]

Automated decisions
The assistant answers questions. It does not make decisions about you
that have legal or similarly significant effects.

Your rights
You can ask for a copy of your chat data, have it corrected or deleted,
restrict or object to our use of it, and receive it in a portable format.
Where we rely on consent, you can withdraw it at any time. Write to
[privacy email]. If you chatted without giving an email address, tell us
roughly when you chatted and what you asked, so we can find it. You can
also complain to [your data protection authority].

The table maps each heading to the Article 13 item it answers.

Article 14 covers personal data you did not collect from the person it is about, and a chat produces some. A visitor who books for a partner or asks about a colleague's order gives you details of someone else. Article 14 adds two items, the categories of data and their source, and allows up to one month to inform the person, or until your first message to them if you contact them sooner.

When informing them would be impossible or take disproportionate effort, Article 14(5)(b) allows other measures, including making the information publicly available, which is the job of the optional "Information about other people" paragraph. Keep the automated-decisions line only while it stays true: an assistant that approves refunds or screens applicants on its own needs a different answer.

How do you fill in the processors, the AI provider and the transfers?

Fill the recipient and transfer placeholders from your vendor's documentation and contract, never from guesswork. Name the chat vendor as your processor and the AI model provider that writes the replies, list the services that store or email chat data, and add every tool the chat can query for a visitor.

Check your current policy for these sentences, which stop being true once a chat widget is added.

Article 5(3) of the EU's ePrivacy Directive covers storing information on the visitor's device in general, not just cookies, and makes an exception for storage strictly necessary for a service the visitor explicitly asked for. Whether a chat's session storage falls inside that exception depends on how your widget loads and what it keeps, so describe the storage plainly in your cookie notice either way.

Here are the collection and recipient parts filled in for a site that uses PepoChat, from PepoChat's privacy notes, its security overview and the product itself, as of 19 October 2026.

What the chat collects
- The messages you type, and any images you attach (PNG, JPG, WebP or
  GIF, up to three per message).
- Details you choose to give: your name, email address, phone number or
  company, and any email address you verify with a six-digit code.
- When you open the chat: browser and operating system, screen and
  window size, language, timezone, whether cookies are enabled, and the
  website the chat was opened on.
- [Only if you block countries] your country as a two-letter code,
  derived from your IP address. The IP address itself is not stored.
- The chat sets no cookies on this website. In its own browser storage
  it keeps a session identifier, so you can come back to your
  conversation, plus which replies you have seen and whether you
  dismissed the privacy notice. A session lasts 24 hours and is extended
  while you chat.

Who receives it
- PepoChat, operated by PepoCloud LLC, which runs the chat for us as our
  processor.
- OpenAI, which PepoChat uses to write the replies. OpenAI receives the
  conversation, the passages of our content used to answer and our
  instructions to the assistant.
- Resend, which PepoChat uses to send the chat's emails: verification
  codes to you, alerts to our team that quote your name and email when
  known and the last three messages, and, if you ask after the chat is
  resolved, a copy of the conversation to the address you verified.
- [Each connected tool, such as our help desk], which receives what you
  ask the assistant to look up, such as an order number or email address.
- [If voice chat is on] Vapi, which runs our voice assistant.

PepoChat's security overview names the services involved: Convex for the backend, Vercel for the dashboard and the chat widget, OpenAI for AI replies, Resend for email, Vapi for voice when you enable it, and Dodo Payments for billing your subscription. The privacy notes suggest listing PepoChat as your processor and the AI model provider as a sub-processor.

What should the notice next to the chat say?

The notice next to the chat should be one sentence, placed where the visitor types, that says replies come from an AI, that messages are kept, and where to read more. Wherever the chat asks for an email address, add a second sentence on what the address is for.

A short line with a link is a layered notice: the first layer gives the essentials at the moment of collection, and the link leads to the full privacy section. Layering is how you meet Article 13's timing, information when the data is obtained, without pasting a privacy policy into a chat window that is 400 pixels wide.

Notice line above the message box (link the last words to your policy)
  Replies come from an AI assistant. We keep chats to help you and to
  improve our answers. How we use chat data

  You're chatting with an AI assistant. Messages are saved, and our
  support team may read them. Privacy notice

Consent text under an email form (PepoChat: plain text, up to 300 characters)
  We use your email only to reply about this conversation, and we won't
  add you to a mailing list. Privacy notice: [yoursite.com/privacy]

  Your email lets our team follow up if the AI assistant can't help. We
  keep it with this conversation for [period]. Details: [yoursite.com/privacy]

Optional marketing sign-up (a separate step, never pre-ticked)
  [ ] Also send me [Brand]'s monthly newsletter. I can unsubscribe at
      any time.

Add to "How to sound and behave"
  When you ask for an email address, say in the same sentence that it is
  used only to follow up on this conversation.

PepoChat provides the first layer in two places. Paste your policy's address into Privacy policy link on the Widget Customization page, and the widget shows "By chatting, you agree to our privacy policy" above the message box, with the last words linked. A visitor can dismiss the line, and it stays dismissed in that browser until you change the link.

The second place is the Consent text field under Lead Capture, up to 300 characters, shown under the pre-chat email form. PepoChat displays the consent text as plain text, so a web address in it is not clickable: write the short form, such as acme.com/privacy. When the agent asks for an email in the conversation instead, no consent text appears, which is what the instruction line in the template is for. The lead capture docs list the three moments the chat can ask.

A notice and consent are different things in the GDPR. Under Article 4(11), consent is a freely given, specific, informed and unambiguous indication of the visitor's wishes, given by a statement or a clear affirmative act. Recital 32 rules out silence, inactivity and pre-ticked boxes, and Article 7 requires a consent request to stand apart from other matters and be as easy to withdraw as to give. A line someone scrolls past while typing a question informs them; it does not collect consent.

For answering a visitor's own question you rarely need consent, because contract or legitimate interests usually fit, as the GDPR guide for chatbots explains. PepoChat's email form has no tick box, so keep marketing out of the consent text and ask for it in a separate step. The guide to chatbot lead generation covers when asking for an email helps at all.

How long should you keep chat transcripts, and how do you say so?

Keep chat data only as long as you need it to answer the question and handle what follows, then delete it on a schedule. The GDPR sets no number: Article 5(1)(e) limits storage to what the purpose needs, and Article 13(2)(a) requires your notice to state the period, or the criteria used to set it when a fixed period is not possible.

Write the statement per type of data, because sessions, transcripts, contacts and attachments rarely share a lifetime. For transcripts, tie the period to something real, such as how long customers can return goods or raise a complaint about the same issue.

How long we keep it
- Chat sessions: [period].
- Conversations and transcripts: deleted [period] after [the conversation
  ends / its first message], unless we still need them to finish your
  request or deal with a dispute.
- Contact details you give in the chat: [period], or until you ask us to
  delete them.
- Images or files you send: [period].
- Copies in other systems, such as help desk tickets or exports: [period
  set in that system].

For PepoChat, these are the defaults and the settings you control, taken from the privacy notes, the team docs and the product. Last verified 19 October 2026.

How long we keep it (PepoChat example, Data retention set to 90 days)
- Chat sessions last 24 hours and are extended while you chat. A session
  in which no conversation started is deleted a day after it expires.
- Images you attach are deleted a week after upload.
- Resolved conversations, transcript included, are deleted permanently
  90 days after their first message. Conversations still open or waiting
  for our team are kept until they are resolved.
- Contact details you give in the chat are kept until you ask us to
  delete them.
- [Tickets we create in our help desk follow its retention: [period].]

Two details trip people up. PepoChat's retention clock starts at a conversation's first message, not at resolution, so a conversation resolved on day 95 under a 90-day setting is deleted at the next daily run. And with Data retention off, the default, your policy has no period to state, and "until we delete them" is not a criterion, so choose a period in the team settings before you publish.

What should the chat say when a person takes over?

When a person takes over, say so in words on both sides of the switch. The AI says the conversation is going to the team, the person introduces themselves by name, and if the AI comes back, it says so too.

None of the laws in this post prescribes handoff wording, but the disclosures above stay accurate only if the visitor can see when the speaker changes. Utah's safe harbor wants the AI disclosure to hold throughout the interaction, and Maine's test turns on what a reasonable consumer believes about who is on the other end.

Add to "How to sound and behave"
  When you hand a conversation to the team, say clearly that a person on
  our team will reply and that you, the AI assistant, will stop
  answering in this conversation.

The person's first message (type it when you join)
  Hi, this is [first name] from the [Brand] team. I've read the
  conversation so far, so you don't need to repeat anything.

When you hand back to the AI assistant
  I'm handing you back to our AI assistant, which can keep helping with
  [topics]. Ask for a person again at any time.

Reply by email after a chat
  Subject: Re: your chat with [Brand]
  Hi [name], this is [first name], a person on the [Brand] support team,
  following up on your chat with our AI assistant on [date].

In PepoChat the switch is quiet by design. When a conversation is escalated, the typing indicator stops and the agent goes silent, and the agent's own handoff sentence follows your Team availability setting: a teammate picking up shortly, or your away message when nobody can reply. Your team's replies appear under each person's display name with an initials avatar, while the agent keeps the logo avatar, so ask everyone to set a real name on the Profile page.

Setting a conversation back to unresolved puts the agent back to work, which is the moment for the hand-back line. Replies typed in the team inbox are not emailed to the visitor, so if they have left, answer with the Reply by email button in the alert email, which opens your mail client with the subject "Re: your chat with" and your workspace name. The human handoff guide covers the whole escalation flow, and the offline chat message examples give 25 away messages for when nobody can reply.

How do you set up these templates in PepoChat?

Every template above maps to a PepoChat setting, all on every plan including Free; the widget customization docs describe each field.

1. Open Widget Customization, and in Appearance & Home Screen set Assistant name to a name with AI in it, such as "Acme AI assistant".
2. In the same card, paste your policy's address, starting with https://, into Privacy policy link.
3. In General Chat Settings, replace the Greeting message with one of the five variants; it applies to new conversations.
4. Paste the honesty, email and handoff lines into How to sound and behave and Never do this, which hold up to 4,000 and 2,000 characters.
5. If you collect emails, switch on Collect contact details under Lead Capture and paste a line into Consent text.
6. Under Team availability, choose the mode that matches your staffing and write an Away message of up to 300 characters.
7. Click Save Settings.
8. On the Team page, set Data retention to 30, 90, 180 or 365 days; only owners and admins can change it.
9. On the Knowledge Base page, add your privacy policy's URL as a source, so the agent answers "what do you do with my data?" from the policy itself.
10. Ask each teammate to set a display name on the Profile page.
11. Click Test the agent and ask "Am I talking to a real person?" and "What happens to my email?"; test chats are free and stay out of analytics.

What to do next

Start with the two lines visitors see first: rename the assistant so it says AI, and swap the greeting for one of the five variants. Then add the chat section to your privacy policy, link it from the widget, and set a retention period so the policy states a real number.

• For why each disclosure rule applies and what it costs to ignore it, read Do you have to tell customers your chatbot is AI?
• For lawful basis, processors and the questions to ask a vendor, the GDPR guide for chatbots goes deeper.
• You can create a free workspace and launch a clearly labelled AI support agent without a credit card.