Guides

Chatbots and the law in the United Kingdom

The rules that apply when a UK business puts a chatbot in front of customers: the CMA's 2026 guidance on AI agents, PECR rules on cookies and on WhatsApp and SMS marketing, the UK GDPR for chat transcripts, automated decisions and the Equality Act. With links to the official texts.

By the chatbots.reviews teamPublished 18 September 2026Updated 18 September 2026Prices verified 18 September 2026
General information, not legal advice. We link to official sources and say what we could and could not verify in September 2026. Several UK rules changed on 5 February 2026. Check your own obligations with a solicitor or data protection adviser.

The short version

  • Treat the bot's answers as your own statements. The CMA holds you responsible for them, as it would for an employee.
  • Say it is a bot in the first message, and again when a person hands the chat back to it.
  • Stop the chat widget setting cookies on page load. Load it on click or after cookie consent.
  • Get consent before marketing on WhatsApp, SMS or DMs, unless every soft opt-in condition is met.
  • Set a retention period for transcripts and make sure you can export one person's chats within a month.
  • Sign a data processing agreement with the vendor and check how chat data reaches the US.

You answer for what the bot says

On 9 March 2026 the Competition and Markets Authority published Complying with consumer law when using AI agents. You are responsible for what an AI agent does in the same way as for an employee, even if someone else designed or provides it. Breaches fall under the unfair-trading rules of the Digital Markets, Competition and Consumers Act 2024, which the CMA enforces directly. The guidance mentions fines of up to 10% of worldwide turnover.

  • Train and test the bot on prices, cancellation rights and complaints before launch.
  • Keep a person actively checking its outputs.
  • Ground answers in your current policies. Our guide to writing a bot knowledge base shows how.

In Moffatt v. Air Canada (February 2024) a British Columbia tribunal held the airline liable for negligent misrepresentation after its website chatbot gave wrong advice on bereavement fares, and rejected the idea that the bot was a separate entity. The decision does not bind UK courts, but it points the same way. Do not rely on a disclaimer that the bot may be wrong.

Telling people they are talking to a bot

We found no UK statute that requires a bot to announce itself in every case. The nearest official statement is in the CMA guidance: label the bot if knowing it is AI could affect the customer's decision. You cannot predict when that will be, so say it in the first message.

If you serve customers in the EU, Article 50 of the EU AI Act has applied since 2 August 2026, and the chatbot disclosure duty has no grace period. Meta's Messenger policy also requires automated chats to say so where the law demands it, and recommends it everywhere.

Cookies and the chat widget

Regulation 6 of PECR was rewritten on 5 February 2026. It now bans storing or reading information on a user's device, with five exceptions in Schedule A1. The one that matters here is strictly necessary: chat cookies fit it only for a service the user has asked for, which means after the visitor opens the chat.

The ICO's final guidance on storage and access technologies, published on 29 April 2026, says you judge this from the user's side: would the service they asked for fail without it? The exceptions chapter has no chat-widget example, and we did not read the other chapters. So be cautious:

  • Load the widget on click, or behind the cookie banner.
  • Set no cookies or localStorage before the visitor engages with the chat.
  • Never reuse chat identifiers for analytics or advertising.
  • Record why each chat cookie is needed for the chat itself.

Since 5 February 2026 the ICO can fine PECR breaches up to £17.5 million or 4% of global turnover. The old cap was £500,000.

Marketing on WhatsApp, SMS and DMs

Regulation 22 of PECR covers unsolicited marketing sent by electronic mail to individuals. According to the ICO's guide, that includes texts and direct messages on WhatsApp, Messenger or Instagram. That page is marked as under review following the Data (Use and Access) Act. You need one of two things:

  • Specific consent from the individual. Log it, naming your business and the channel.
  • The soft opt-in. You got their details during a sale or negotiation, you market only your own similar products, and you offered an opt-out at collection and in every message. Bought lists and prospects never qualify. Charities have had their own version since 5 February 2026.

Meta's rules apply on top. The WhatsApp Business Messaging Policy requires an opt-in, lets a bot reply freely for 24 hours after the user's last message and allows only approved templates after that. It also requires a clear route to a human and respect for every opt-out, so make opting out one reply away. The WhatsApp Business Solution Terms bar general-purpose AI assistants, not ordinary support or sales bots. Our WhatsApp chatbot rules guide has the detail.

Chat transcripts are personal data

  • Retention. Personal data may be kept no longer than necessary (Article 5(1)(e); we link the EU text, and the UK GDPR uses the same article numbers). Set a period in the builder; do not trust its default.
  • Access requests. A person can ask for a copy of their conversations, and you have one month (Articles 15(3) and 12(3)). Check that the platform can search and export by user.
  • Notice. Above the chat input, say who runs the chat, name the vendor that records it and link your privacy policy.
  • Vendor contract. Sign a data processing agreement and forbid the vendor from reusing transcripts, including for AI training.
  • Transfers. Under the UK-US data bridge, in force since 12 October 2023, you can send chat data to US vendors certified to the UK Extension to the Data Privacy Framework. It depends on the EU-US framework, which secondary sources describe as valid but under appeal. Ask what fallback transfer clauses the agreement contains.

When the bot decides things

The Data (Use and Access) Act replaced the old rule on automated decisions with new Articles 22A to 22D of the UK GDPR, in force since 5 February 2026 under S.I. 2026/82. Earlier decisions stay under the old Article 22. We confirmed the commencement but did not work through the new articles, so we do not summarise them. If your bot can refuse a refund, a claim or credit with no person involved, route those flows to a human and take advice. France's CNIL, which has no authority here, advises that a chatbot conversation alone should not produce an important decision such as refusing credit. See also when not to use a chatbot.

Accessibility

No UK statute names chat widgets, and we found no EHRC or government guidance on them. The general duty is in section 20 of the Equality Act 2010: service providers must take reasonable steps so that disabled customers are not substantially disadvantaged, including information in an accessible format. WCAG 2.2 AA is the usual benchmark, though only secondary sources say so. Make the chat work with a keyboard and a screen reader, and keep another contact route. The European Accessibility Act does not apply in the UK but binds UK firms selling to EU consumers, microenterprises excepted.

Before you switch the bot on

  1. The bot says it is a bot in its first message.
  2. The widget sets no cookies or localStorage until the visitor opens it or has consented.
  3. A short privacy notice sits above the chat input and names the vendor.
  4. The bot's answers on prices, cancellations and complaints are tested, and someone reviews transcripts.
  5. A customer can always reach a person. The bot is never the only channel.
  6. Every marketing contact has a logged consent or meets every soft opt-in condition, and STOP works at once.
  7. A transcript retention period is set, and you can export or delete one person's chats within a month.
  8. A data processing agreement is signed and the US transfer route is checked.
  9. The chat works with a keyboard and a screen reader.

Frequently asked questions

Does UK law require a chatbot to say it is a bot?

We found no UK statute that requires it in every case. The CMA's March 2026 guidance says to label the bot if knowing it is AI could affect the customer's decision. If you serve EU customers, Article 50 of the EU AI Act has required disclosure since 2 August 2026. Saying it in the first message covers both.

Do I need cookie consent for a chatbot or live chat widget in the UK?

Yes, if the widget sets cookies on page load. PECR bans storing or reading information on a device, with a few exceptions, and chat cookies fit the strictly necessary exception only once the visitor has opened the chat. Put the widget behind the cookie banner or load it on click.

Can I send WhatsApp marketing messages to my UK customers?

Only with the individual's specific consent or under the soft opt-in: you got their details during a sale or negotiation, you market only your own similar products, and you offered an opt-out at collection and in every message. Bought lists never qualify. WhatsApp's own policy also requires an opt-in.

Am I liable if my chatbot gives a customer wrong information?

Expect to be. The CMA says a business is responsible for its AI agent in the same way as for an employee, even when a vendor built it. Test the bot on prices, cancellation rights and complaints, and keep a person checking its outputs.

Can a UK business use a US chatbot vendor?

Yes, with paperwork. Sign a data processing agreement, check that the vendor is certified to the UK Extension to the Data Privacy Framework under the UK-US data bridge, and ask what fallback transfer clauses the agreement contains. Forbid reuse of transcripts for AI training.

Keep reading

Researched and drafted with AI assistance from the sources listed on this page. We have not built or tested bots on these platforms yet. Method: How we review