Using AI on Your Website? Here’s How to Stay PDPA-Compliant

Artificial Intelligence (AI) is reshaping digital experiences—from intelligent chatbots to personalized product recommendations. These technologies improve customer service, drive engagement, and increase conversion rates. But while AI adds convenience, it also raises new privacy and compliance challenges—especially under Thailand’s Personal Data Protection Act (PDPA).

If your website uses AI to analyze behavior, make suggestions, or store conversation data, you must ensure these systems are transparent, consensual, and secure. Otherwise, you may be unintentionally violating user rights and risking fines.

This article outlines how AI-driven features intersect with PDPA rules and offers practical steps to keep your implementations legal and user-friendly. Plus, we share a real-world example where a Thai e-commerce brand gained trust by integrating smart consent controls into its AI tools.

How AI and PDPA Interact

AI on websites often involves:

• Collecting user behavior data (e.g., browsing history, clicks)
  
  

• Profiling for personalization (e.g., product recommendations)
  
  

• Chatbots storing conversation logs
  
  

• Real-time decisions based on inferred preferences
  
  

Under the PDPA, any action that collects, processes, or stores personal data—especially if it involves profiling—requires:

1. Informed, explicit consent
   
   

2. Clarity about the purpose and scope
   
   

3. Transparency on whether decisions are automated
   
   

4. The option to opt out or manage preferences
   
   

Common AI Use Cases Affected by PDPA

• Chatbots that log user conversations
  
  

• Recommendation engines based on previous behavior
  
  

• Predictive search or auto-fill using prior queries
  
  

• Dynamic pricing or promotions shown based on inferred demographics
  
  

• AI assistants that integrate with user accounts or external databases
  
  

All of these are legal—but only if implemented with clear consent and protective safeguards.

Real Case: E-Commerce Brand Builds Trust with AI Transparency

A Thai online retailer launched an AI engine to recommend products based on a user’s browsing habits. At first, the system operated silently—collecting behavior, generating profiles, and suggesting items in real time.

However, some users became concerned:

“Why do you know I looked at these shoes last week?”
“I didn’t agree to personalized ads.”

The brand quickly adjusted to align with PDPA requirements:

What They Did:

• Added a disclaimer next to recommendations, explaining how they were generated
  
  

• Included a toggle in the user settings to enable or disable personalization
  
  

• Gave users a brief walkthrough explaining how data would be used
  
  

• Ensured chatbot interactions began with a consent prompt
  
  

The Results:

• Customer complaints about “creepy” personalization disappeared
  
  

• Opt-in rate for recommendations reached 72%
  
  

• User engagement and conversion from personalized content actually improved
  
  

• The system became legally compliant—and more trusted
  
  

Best Practices for AI Compliance Under PDPA

1. Disclose AI Use Clearly

If AI is powering your chatbot, recommendations, or targeting, tell users what it does and why. For example:

“We use AI to suggest content you might like, based on your browsing behavior.”

2. Ask for Consent—Don’t Assume It

Make AI features opt-in rather than always-on. Use:

• A toggle in settings
  
  

• A checkbox at sign-up
  
  

• A chatbot prompt before collecting personal info
  
  

3. Let Users Opt Out Anytime

Users must be able to stop AI-driven tracking or suggestions. Offer simple off switches and honor them instantly.

4. Don’t Use AI to Process Sensitive Data Without Explicit Consent

Avoid using AI to analyze data related to health, religion, or biometric identifiers unless you have written, informed consent—these are considered “sensitive data” under PDPA.

5. Be Transparent About Profiling and Automated Decisions

If AI is making decisions that affect users—pricing, content visibility, support routing—let them know, and provide an appeal process where possible.

UX Suggestions for Transparent AI

• Add tooltips or info icons next to smart features
  
  

• Provide a privacy overview when onboarding users
  
  

• Include a “Why am I seeing this?” link for AI-driven suggestions
  
  

• Separate manual from AI-generated options (e.g., allow manual browsing as an alternative)
  
  

Tools That Support AI + PDPA Compliance

• AI-integrated consent managers like OneTrust or Osano
  
  

• Custom data preference dashboards in your CMS or user portal
  
  

• Audit trails and logs to track how AI uses data
  
  

• Privacy-focused chat tools that support message opt-outs and limited retention
  
  

Conclusion: Smart Doesn’t Mean Silent

AI is a powerful ally for business growth, but it must be used responsibly. The PDPA doesn’t stop you from innovating—it just ensures that innovation respects privacy and choice.

By embedding consent into the design of your AI features, you not only avoid fines—you win user trust. And trust is what turns personalization into loyalty.