AI Privacy Policy: Can AI Meet Legal Standards?

Can AI tools create a compliant privacy policy? 

Imagine an AI smart enough to write an accurate, legally compliant privacy policy tailored to your specific data collection practices. This could save businesses countless hours and legal fees. But can an AI truly meet the specific compliance requirements set by laws like GDPR and CCPA? We put the most used generative AI tool, ChatGPT-4 to the test.

Find out below how AI-generated privacy policies measure up to real compliance needs.

We used four distinct prompts with ChatGPT’s paid version, GPT-4 (accessible through OpenAI’s API for paying customers), refining each prompt to optimize the response.

#1 Generic AI privacy policy

Here is what we found:

• Lacks data collection specifics: The policy does not categorize or enumerate the types of personal information gathered, the methods and sources used to collect it, or the legal bases that permit collection.
• Insufficient transparency: It provides limited insight into data retention schedules, onward sharing practices, and security mechanisms and uses vague, generic language without naming data recipients, retention periods, or encryption methods.
• Lacks clarity: Although it offers the option to opt out of communications, the policy does not elaborate on processes for rights requests or detail cookie handling and tracking techniques beyond email subscriptions. Key areas such as international data transfers, data breach notifications, and retention periods are notably absent.

By not scoping data practices, third-party dealings, and technological capacities, the policy avoids compliance responsibility, which is risky.

ChatGPT does give a disclaimer in the beginning that this is only a generic template.

Now let’s try to ask for the law-specific privacy policy and see how GPT-4 does.

#2 GDPR-compliant privacy policy

Now let’s try asking ChatGPT AI to generate a GDPR-compliant privacy policy.

Better, but not quite there yet.

Key GDPR requirements were still missing from the policy content:

• Transparency and fairness: Fails to specify data collected, processing activities, or third-party sharing. This omission leaves it non-compliant with GDPR Articles 12–14.
• Legal bases and consent: Does not provide legal bases or consent processes for each data processing activity, violating Articles 6, 7, and 13.
• Data subject rights: Lists basic rights like access and erasure but lacks specific fulfillment processes or timelines, missing compliance with Articles 15-22 and Recital 59.
• International data transfers: Lacks adequate transparency regarding cross-border data flows and protection measures, falling short on Article 13(1)(f) standards.
• Security of processing: Barely mentions security measures like encryption, a requirement under Article 32.

In summary, deficiencies in transparency, legal basis linkage, data minimization, rights procedures, international transfers, and security protections make ChatGPT’s policy inadequate under GDPR standards.

Now, let’s try CCPA.

#3 CCPA-compliant privacy policy

This policy is not CCPA-compliant. Here’s why:

• Lacks specifics: It fails to include a detailed list of data types collected, which is required to meet CCPA transparency standards.
• Lacks proper disclosures: It does not address the CCPA requirement to disclose categories of third parties to whom data is sold or the requirement that service providers/contractors maintain reasonable security procedures and practices. It falls short of this aspect, with no information on security practices and third-party disclosures. This policy is also completely silent on retention periods. Consumers have no visibility from the policy into how long the website will retain their personal data.
• No opt-out rights: This is concerning since opt-out rights are one of the cornerstones of CCPA. There is no mention of how users can opt out of the sale or sharing of their personal information.

In essence, the ChatGPT-generated privacy policy, while covering some high-level CCPA requirements, misses the mark on critically important details around security, service providers, retention, and opt-out rights.

Since none yield fruitful results, let’s take a different approach. 

#4 GDPR and CCPA-compliant privacy policy

Finally, we tried to combine GDPR and CCPA requirements in one policy.

Here is a high-level analysis:

Compliance with CCPA

• Lacks specifics on consumer rights: It does not explicitly mention the right to opt-out of the sale of personal information, right to deletion, or right to non-discrimination, which are required under CCPA.
• No contact information for requests: It does not provide instructions or contact information for consumers to submit requests to exercise their CCPA rights, which is required.
• No retention periods specified: It fails to specify any retention periods for personal data, which should be documented under CCPA.

Compliance with GDPR

• Legal basis for processing: This does not specify the legal basis for processing different categories of data as required under Article 6. 
• Data retention: No specific retention periods were mentioned as required under Article 5(e).
• Right to erasure: Although it is mentioned, it does not describe the right to erasure as detailed in Article 17. 
• International transfers: There is very little mention of international transfers. It requires more details as per Articles 44-50.
• Security measures: The policy is light on the specifics of security measures in place as mandated under Article 32.

Currently, ChatGPT-4 has notable limitations as a policy generator, though AI technology is expected to advance over time.

In summary, despite adjustments, ChatGPT-generated policies remain basic, generic, and often overlook essential legal requirements. These policies need substantial editing and careful legal review to meet compliance standards. This outcome is not surprising, as ChatGPT cannot incorporate website-specific details or analyze a site’s data practices directly. Users must meticulously provide every detail regarding how their website manages user data—a process that can be lengthy and labour-intensive, as each compliance element must be spelt out for the AI to generate a near-compliant policy.

Even with detailed inputs, expert review is still advisable to ensure compliance. While AI can aid efficiency by drafting initial policy versions, adopting these drafts without thorough examination poses compliance risks. For instance, OpenAI’s privacy policy is exceptionally detailed and almost certainly vetted by legal experts—a reminder that AI-generated policies should not be adopted without human oversight.

If you are looking to create an outline for your website’s privacy policy, you can go ahead and make use of AI tools. But for website-specific details, you still need human intervention or a tool like CookieYes that will let you input the required specifics through its questionnaire and handle generating the legally compliant policy document.

• Information on company and website: Basic information about your business, such as name, website, and location.
• Collection of data: Information about the kind of personal information that is collected from your users.
• Use and disclosure of data: Disclosure of the purpose for which you collect personal information from your users.
• Tracking technologies: Disclosure of tracking technologies you may use, such as cookies.
• Data protection: Information about how users can contact you for data protection or privacy-related purposes.

These categories have several individual questionnaires under them that will help create comprehensive content for your policy page. This doesn’t take a lot of time. Once you are done answering them, the platform will generate the required content, which you can then copy as text or HTML and add to your website.

However, as with any autogenerated document, CookieYes policies may still require some review. The benefit is that policies generated by CookieYes provide an excellent starting point and framework that is far more detailed and website-specific than a pure AI-generated policy. You have the technical ease of automated generation and human oversight at key checkpoints.