Should a UK small business put an AI chatbot on its website?

Short answer: Yes, if enquiries arrive when nobody is there to answer them. The chat itself is the easy part, because replying to someone who asked you a question is not marketing. Check what the widget loads before the visitor opens it, tell them who runs the chat and how long you keep it, and be ready to hand over a transcript within a month.

Most chatbot advice comes from the companies selling them. Ours has a point of view: on a UK website, the conversation is the low-risk part. The homework sits at the two ends, the script that loads before anyone says hello and the transcript you keep after they leave. Both are cheap to fix. This is general information, not legal advice, so check the details against your own setup. For the wider system, see AI lead generation in the UK.

When a chatbot earns its place on a UK site

A contact form collects details and then waits until a person reads it. That is a problem in the evening, when the visitor is comparing three businesses and will talk to whichever one answers first.

A chatbot answers the two or three questions people ask before they commit: do you cover my postcode, roughly when could you come, do you do this kind of job. Then it takes a name and number. Its value is highest where enquiries arrive in the evenings and at weekends.

Do not trust vendor conversion figures. Measure your own: chats started, details left, jobs booked.

Always show a route to a person, such as a phone number or an “ask for a human” line. If you are weighing several tools, our guide to which AI lead tools are safe to aim at which contacts sorts them by risk.

The chat is the easy part

When a visitor types a question and your bot answers it, you are not marketing to them. They asked, you replied. That is a “service message”, and our AI lead generation guide covers where that line sits and what changes when a sequence starts promoting things.

So the conversation itself raises no marketing-consent question. The work is at the two ends: what your chat tool puts on a visitor’s device before they have typed anything, and what you do with the words once they are saved.

What your chat widget loads before anyone says hello

The Privacy and Electronic Communications Regulations (PECR), regulation 6, cover storing information on a visitor’s device, or reading it back. That means cookies and similar technologies. The rule is consent first, unless an exception applies.

The exception that matters for a chat tool is “strictly necessary”. The ICO’s guidance on the exceptions says it “applies when the purpose of the storage or access is essential to provide the service the subscriber or user requests”. It also says you should assess this “from the point of view of the subscriber or user, not your own”.

That wording matters, because the same guidance names chatbots. In its section on feature-led consent, it says a user may interact with a feature “such as by choosing to watch an embedded feature or engaging with a chatbot function. At that point, if the user is well informed, it can be considered strictly necessary to provide the service requested by the user.”

Our reading, not the ICO’s words: the exception attaches to the moment the visitor opens the chat, not to page load. A widget that drops an identifier on every visitor the moment the page loads is doing something the visitor has not asked for yet.

The guidance adds a second limit: “Any secondary purposes mean the exception would not apply.” So if the chat tool also feeds analytics or advertising with the same cookie, that use needs consent.

Three practical steps:

• Ask your supplier for a list of what the widget stores, and when it stores it.
• Set the widget to load only on click, or put it behind your cookie banner.
• Turn off the widget’s own visitor tracking if you do not use it.

We have not audited any particular vendor’s widget, and settings differ by product.

What ‘well informed’ looks like in a chat window

The ICO passage turns on the visitor being well informed. The guidance says clear information is still needed, including being clear when a third party provides the feature.

The ICO’s page on what privacy information to provide lists what you must always give when you collect personal data from someone:

• who you are and how to contact you
• why you are using the data
• your lawful basis
• how long you keep it, or how you decide
• their rights
• their right to complain to the ICO

And, where they apply, who receives the data and any transfer outside the UK.

You cannot fit all of that in a chat bubble. Put the essentials above the first message and link to the full privacy notice. Treat this as a starting point to check, not a guaranteed safe form of words:

This is an automated assistant, not a person.

This chat is provided by [supplier name] and saved so that we can reply to you.

Our privacy notice explains how we use it: [link].

Would rather speak to someone? Ring us on [number] or ask for a person at any time.

Show it before the visitor types anything. One more point on suppliers abroad: many chat tools process data in the United States, and a transfer from the UK needs a safeguard. Our guide to AI marketing for UK small businesses covers the options, so we will not repeat them here.

The transcript is a record your customer can ask to see

A chat transcript with a name, number or email in it is personal data. Under the right of access, a person can ask for a copy of their information. The ICO’s right of access guidance is clear on how easy that is to trigger:

• A request can be made verbally or in writing, including by social media.
• It can go to any part of the organisation.
• The person does not have to use the words “subject access request”.
• You must respond without undue delay and within one month. You can extend by up to two further months if the request is complex or you have received several from the same person.

Put those together and a visitor could make the request in the chat window itself. The ICO’s summary of the Data (Use and Access) Act 2025 says you need only make “reasonable and proportionate” searches. A search is quick to run, and easy to show was reasonable, when you know where the transcripts are kept.

So do four things now, while it is quiet:

• Know where transcripts live, and how to export one by name, email address or phone number.
• Decide a retention period and state it. The law gives no fixed number, but the ICO requires you to tell people the period or how you decide it.
• Delete on schedule, not “when we get round to it”.
• Tell the bot’s script not to ask for more than it needs. A transcript you never collected cannot be requested.

The complaints step most small firms have not set up

The same ICO summary of the Data (Use and Access) Act 2025 has a latest update dated 19 June 2026, which says all of the Act’s data protection provisions are now in force. One of them is easy to miss.

The Act “requires you to take steps to help people who want to make complaints”, and you “have to acknowledge complaints within 30 days” and respond “without undue delay”.

For a small firm, that means a named inbox, a line in your privacy notice saying where to send a data complaint, and a rule in the bot’s script. The rule is simple: anything that sounds like a complaint about personal data goes to a person. The bot does not try to answer it.

Is a bot that qualifies leads ‘automated decision-making’?

The ICO’s guidance on automated decision-making and profiling was updated on 31 March 2026 for the Act. As read on 7 October 2026, it is still a draft under consultation, so expect wording to move.

What it is about is decisions “based solely on automated processing” that have a “legal or similarly significant effect” on a person.

Our reading, not the ICO’s: a bot that asks what job you need and passes the answer to a person is not making that kind of decision. A bot that turns someone down by itself, for example refusing a quote or finance with no person involved, is much closer to it, and that is the point to get advice.

The simple rule is to let the bot sort and route, and let a person say no.

A hypothetical kitchen fitter in Stirling, worked through

This is a hypothetical, with no figures, to show the order of work.

A three-person kitchen fitting firm in Stirling gets many enquiries in the evening, after people have visited a showroom. The form sits unread until morning. Here is what the firm sets up, in order.

1. The widget loads only on click. Nothing from the chat supplier is stored on a visitor’s device until they press the chat button.
2. A four-line notice sits above the first message. It says the assistant is automated, names the supplier, links to the privacy notice and gives a phone number.
3. The bot asks three things, plus a name and number: postcode, type of job, rough timing. It then offers a call-back slot.
4. Transcripts are kept for a period the firm chose and states in its privacy notice, and are deleted once it ends.
5. One person is named for copy requests and complaints.
6. Anything the bot cannot answer goes to a person the next morning. The bot never refuses a job itself.

For the first two months, the firm counts three things: chats started, details left, home surveys booked. If they stay flat, it goes back to the form.

When to keep the contact form instead

Keep the form if any of these fit.

• You get few enquiries a week. A handful of chats does not justify the set-up, the notice and the retention rules. A form is simpler.
• Someone already answers within the hour in working hours, and enquiries arrive in working hours. The gap the bot fills does not exist.
• Your first conversation involves health, money trouble or legal problems. A bot collecting details invites people to type sensitive things into a third-party tool. Health details are special category data, which the ICO’s Act summary describes as more protected.
• Nobody will read the handovers. A bot that takes details nobody follows up promises a reply it cannot deliver.

If your leak is slow follow-up rather than a slow first reply, the fix is elsewhere. Look at marketing automation for UK small businesses before you add a chat window.

If a chatbot does fit, and you want it set up with the notice and the handover built in, that is part of our AI automation work.

Frequently asked questions

Does a website chatbot need cookie consent in the UK?

Not for what is strictly necessary once the visitor opens the chat and has been told what it is, according to the ICO guidance. Anything the widget stores before that point needs consent, and so does anything it uses for analytics or advertising. Ask your supplier for a list of what the widget stores and when.

Can a customer ask for a copy of their chat transcript?

Yes. A chat transcript with a name, number or email in it is personal data, and a person can ask for a copy verbally or in writing, without using any special words. You must respond without undue delay and within one month, which can be extended by up to two further months if the request is complex or you have had several from the same person.

How long should a small UK business keep chatbot transcripts?

The law sets no number. Pick the shortest period that covers your sales cycle, state it in your privacy notice and delete on schedule. The ICO expects you to tell people the period or how you decide it.

Is a lead-qualifying chatbot automated decision-making under UK GDPR?

Usually not, in our reading. The ICO guidance is about decisions based solely on automated processing that have a legal or similarly significant effect. A bot that asks what job you need and passes the answer to a person is not making that kind of decision, but a bot that refuses a quote or finance by itself is much closer, so let a person say no.

Does it matter if my chatbot supplier is based in the United States?

Yes. Many chat tools process data in the United States, and a transfer from the UK needs a safeguard. Ask the supplier which one it relies on and name it in your privacy notice.

Should a small UK business use a chatbot or a contact form?

Use a chatbot if enquiries arrive after hours, when nobody is there to answer. Keep the contact form if you get few enquiries, if someone already replies within the hour during working hours, or if first conversations involve health, money trouble or legal problems.

---

Not sure whether a chatbot or a better form would catch more of your enquiries? Get a free AI marketing audit and we will tell you which, before you buy anything.