Article 50 Guide for Agencies

AI sales and lead-capture chatbots: disclosure, consent and handing leads to sales

Last reviewed 27 October 2026

Short answer. A sales or lead-capture chatbot needs the same AI disclosure as any other chatbot, shown before the visitor types. On top of that it collects personal data, so it needs a short privacy notice at the point of collection and a lawful basis for passing the lead to sales. Follow-up marketing email to a lead who never bought anything generally needs consent under the ePrivacy rules, so ask for it in the chat with an unticked option. What the bot says about price and terms counts as the business's own statement.

What applies, in one table

Part of the chat Rule What to do
The bot itself AI Act Article 50(1) and (5) Say it is an AI, at the latest at the first message
Asking for name, email, company GDPR Articles 6 and 13 Short notice in the chat, link to the privacy policy
"Can we email you about offers?" ePrivacy Directive Article 13 Separate opt-in, not pre-ticked
Chat widget cookies and identifiers ePrivacy Directive Article 5(3) Covered by the cookie banner unless strictly necessary
Claims about price, stock, discounts Unfair Commercial Practices Directive Answers from approved content only
Handing over to a sales rep Article 50(1), GDPR Tell the visitor a person is taking over

The AI disclosure

A lead-capture bot interacts directly with visitors, so Article 50(1) applies to it like any support bot. The duty sits with the provider of the system (often the chatbot vendor, sometimes the agency that built or branded it; see does Article 50 apply to client chatbots). In practice the business running the landing page should check the wording itself.

Sales bots raise two specific risks:

Opening line that works on a landing page:

"Hi, I'm the AI assistant for Northgate. I can answer questions about plans and pricing, or book a call with someone from our team."

More wording options are in the disclosure wording guide.

Collecting the lead's details

A name, work email and phone number are personal data, including for B2B leads. The GDPR points that matter for a chat:

The Article 50 and GDPR guide covers the general chatbot GDPR points.

Follow-up email: ask in the chat

Under Article 13 of the ePrivacy Directive, email for direct marketing to individuals needs their prior consent. The "soft opt-in" exception covers a business's own customers whose details were obtained in the context of a sale, for similar products. A lead who asked a bot a question has not bought anything, so in most cases the exception does not fit.

Rules for business addresses differ by country: Article 13(5) leaves member states to protect legal persons, and national laws went different ways. If leads come from several EU countries, the simple route is to ask everyone.

What that looks like in the chat:

"Would you like occasional emails about new features? [Yes, email me] [No thanks]"

Keep the answer to the visitor's request separate from the marketing yes or no, store the answer with a timestamp, and don't make the demo depend on saying yes.

What the bot is allowed to promise

Statements a chatbot makes on a business's site are treated as the business's statements. In Moffatt v. Air Canada (2024 BCCRT 149), a Canadian tribunal held the airline responsible for a refund policy its website chatbot had described wrongly (reported widely; not EU law, but the reasoning travels). In the EU, a bot that invents a discount, misstates a price or claims "only 2 left" without basis can be a misleading practice under the Unfair Commercial Practices Directive.

Practical limits:

Handing over to a sales rep

When a person takes over the chat, say so: "You're now chatting with Tom from our sales team." Visitors who were told they were talking to an AI should not have to guess when that stops being true. The reverse matters too: if the rep leaves and the bot comes back, the AI line goes back in.

If the chat is passed to a rep by email or CRM, the lead's details go only to the people who need them, and the transcript goes with the consent answer so sales knows whether marketing email is allowed.

Checklist for a lead-capture bot

Sources