Is Your AI Chatbot Legal? A US, UK, Canada & Nigeria Checklist

Most of the AI-chatbot compliance questions I get from business owners come down to the same handful of rules. Here they are in one checklist, written for businesses serving customers in the US, UK, Canada and Nigeria, which is where most FIT clients are.

General information, not legal advice. Laws change and differ by state and province. Confirm your position with a qualified lawyer.

1. Tell people it’s AI

• Say clearly, at the start, that the assistant is AI. For example: “I’m FIT’s AI assistant. I can answer questions or pass you to the team.”
• US: California’s BOT Act prohibits undisclosed bots used to incentivise a sale or influence a vote. Utah’s AI law requires disclosure in certain circumstances, and more states are considering similar rules.
• EU: if you serve EU customers, the EU AI Act’s transparency obligations require that people are informed when they interact with an AI system, unless it’s obvious.
• Never let the bot claim to be human.

2. Collect only what you need, and say why

• Publish a privacy notice that covers the chatbot: what data you collect, why, who processes it (your AI and hosting providers), where it’s stored, how long you keep it, and people’s rights.
• Don’t ask for sensitive data (health, financial account numbers, ID numbers) in chat unless you truly need it and have the safeguards to match.
• UK and EU GDPR: identify a lawful basis, minimise data, set retention periods, and handle access and deletion requests.
• US: state privacy laws such as California’s CCPA/CPRA give consumers rights to know, delete and opt out of sale or sharing. Sector rules such as HIPAA apply to health data.
• Canada: PIPEDA requires meaningful consent and safeguards. Quebec’s Law 25 adds transparency duties for automated decisions and privacy impact assessments in some cases.
• Nigeria: the Nigeria Data Protection Act 2023 requires a lawful basis, transparency, minimisation and security, and some organisations have registration duties with the NDPC.

3. Check your vendors

• Use AI and hosting providers with business terms that exclude your data from model training where possible, and sign data processing agreements.
• Know where data is processed. International transfers may need safeguards (for example standard contractual clauses for UK and EU data).
• Limit what each tool can access to the minimum it needs.

4. Get marketing consent right

The chatbot can collect consent, but it must be real consent:

• Email: UK PECR and Canada’s CASL generally require opt-in consent for marketing emails. The US CAN-SPAM Act requires accurate sender details, a postal address and a working unsubscribe.
• SMS: in the US, marketing texts need prior express written consent under the TCPA, and carriers require business registration (10DLC). In Canada, CASL applies.
• WhatsApp: businesses need opt-in before sending business-initiated messages, and must use approved templates outside the 24-hour customer service window.
• Use an unticked checkbox for marketing consent, record when and how consent was given, and honour unsubscribes immediately.

5. Keep humans on high-stakes decisions

• Don’t let the bot give legal, medical or financial advice, approve refunds or credit, or make decisions that significantly affect someone without human review.
• Under UK and EU GDPR, people have rights regarding decisions based solely on automated processing that significantly affect them. Quebec’s Law 25 adds transparency duties for such decisions.
• Route complaints, vulnerable customers and urgent matters to a person quickly.

6. Recording and transcripts

• Chat logs are personal data. Keep them only as long as you need them, and say so in your privacy notice.
• For voice bots and call recording, consent rules vary. Some US states require all parties to consent to recording.

7. Accessibility

• Make the chat widget usable by keyboard and screen readers, with readable contrast. In the US, the ADA has been applied to websites. In the UK, the Equality Act 2010 applies. In Canada, provincial accessibility laws such as Ontario’s AODA apply.
• Always offer another way to reach you (email, phone, form).

8. Keep records and review

• Keep a short record of what the bot does, what data it uses, which vendors are involved, and who is responsible.
• Review a sample of conversations regularly for accuracy, bias and inappropriate answers.
• Re-check when you add a new channel, market or AI model.

The practical takeaway

Design for the strictest market you serve. In practice that usually means UK or EU-style privacy, opt-in marketing consent and clear AI disclosure. Then one setup works everywhere.

This is how we build every assistant at FIT, including the one on this site. If you’d like a second pair of eyes on your current setup, get in touch or start with the free AI audit.