Telling guests about AI: wording for the chat window, the privacy notice and marketing

An AI disclosure statement is the sentence that tells a guest a reply, an image or a page came from software. In Türkiye, the binding duty is the KVKK privacy notice; a separate chatbot notice is good practice. Article 50 of the EU AI Act is an EU rule. It may apply to Turkish hotels if they serve users in the EU or process EU residents' data. Treat it as a reference point for global best practice, but confirm its specific applicability to your guest mix with a lawyer.

A guest opens the chat window on your website at 23:40 and asks whether the pool is heated. The answer arrives in two seconds and it is correct. The open question is whether the guest knows who, or what, wrote it. After reading this, you will have the first line of the chat window, the handover line, the paragraph for the privacy notice and a rule for images and translated pages, each written and each labelled as duty or good practice.

Is an AI disclosure statement a legal duty in Türkiye, or good practice?#

In Türkiye, we found no text that names a chatbot notice as a separate legal duty. The duty that does bind you is the KVKK notice, and it applies whether or not AI is involved.

Separate three things before writing anything. The duty to inform under KVKK is binding. Duties that come from a contract or from a platform you use vary by contract. Your own good practice is yours to set, and you can be judged on it.

The Communiqué on the Procedures and Principles for Fulfilling the Duty to Inform (Resmî Gazete 10 March 2018, No. 30356) sets the minimum content of a notice: the identity of the data controller and its representative if any, the purpose of processing, to whom and for what purpose data may be transferred, the method and legal reason for collecting it, and the person's other rights under Article 11 of Law No. 6698. Its Article 4 to 6 rules (opens in a new tab) are published by the Personal Data Protection Authority (kvkk.gov.tr, viewed 4 November 2026).

Article 5 of the Communiqué adds the quality rules. The notice is given in every case of processing, whether or not consent is the basis. A new notice is needed before processing when the purpose changes. Giving it does not depend on the person's request, and the controller must be able to prove it was given. The purpose must be specific and explicit, the language clear and plain, the legal reason named from Articles 5 and 6 of the Law, and the notice must say whether data is collected by fully or partly automated means. A chat transcript collected by software is automated collection.

Article 6 covers data you did not get from the person: inform within a reasonable time, at first contact if you will use it to communicate with them, and at the latest when it is first transferred.

The closest thing to a chatbot rule is Article 50 of the EU AI Act. It requires that people interacting with an AI system are told so, clearly and distinguishably, at the latest when the interaction begins, unless that is obvious to a reasonably well-informed, observant person (European Commission AI Act Service Desk (opens in a new tab), 27 July 2026). It is an EU rule. We cover its possible reach in our article on the EU AI Act and hotels in Türkiye.

Treat every wording below as a draft for your own lawyer, and confirm your case with them before publishing.

What should the first line of the chat window say?#

One sentence, placed before the first reply, that says the answer comes from software and that a person can take over.

Put it above the first message, not in a footer, a terms page or a cookie banner. A guest who has to scroll has not been told. Name the thing plainly: software, an automated assistant, a virtual assistant. Do not let a brand name or the word smart be the only description.

Say what it can and cannot do in the same breath. It answers questions about the hotel from the hotel's own information; it cannot change a booking or take a payment. Say how the guest asks for a person, because a promise of a person is worth more than a description of the technology.

Keep it to two lines on a phone. If the sentence needs a second read, it is too long for the moment it appears. And do not overclaim: if the assistant answers only from a fixed set of pages, do not imply it can see the guest's bill or the day's room availability.

What should the handover line say when a person takes over?#

One line that tells the guest a person is now reading the conversation, and what happens next.

Say that a person has joined. Do not write that the request has been escalated, queued or logged; those words describe your system, not the guest's situation. Give a time expectation only if you can keep it. A wrong promise at the handover is worse than no promise.

Make the change visible: the software should stop answering once the handover line appears, so the guest can see who is speaking. Handle the out-of-hours case in the same line: say when a person will reply, and say that the assistant will not answer in the meantime. Keep the same voice as the first line, so the guest does not feel passed to a different company halfway through a question.

The rules for deciding when to hand over are a separate question, set out in our article on when to hand a guest message to a person.

What must the privacy notice say when an AI provider processes guest messages?#

It must name a specific purpose, the recipient groups and the purpose of any transfer, and it must say that the data is collected by automated means.

Write the purpose concretely. "Answering questions sent through the website chat and keeping the transcript for 12 months" is a purpose. "Improving the guest experience" is not specific, explicit and legitimate in the sense Article 5 of the Communiqué requires.

Name the recipient groups and the purpose of the transfer. If messages pass through a service provider, the notice must say to whom and for what purpose data may be transferred; your lawyer decides whether the category is enough or the name is needed. State that collection is fully or partly automated, because a chat window collects by automated means and Article 5 requires the notice to say so.

Name the legal reason, taken from Articles 5 and 6 of Law No. 6698. If consent is the basis, informing and obtaining consent are two separate acts, done separately. Add a new notice before the purpose changes: using old transcripts for something new is a new processing purpose, and the notice comes first.

Keep proof. The notice is not given on request and the controller must be able to show it was given, so date each version and keep it. State the retention period for transcripts in the notice and apply it in the system. A period written in the notice and not enforced is a misleading statement. For the full template, see our article on a hotel privacy notice under KVKK, section by section.

What about generated images, translated pages and review replies?#

A person signs these, so the question is not disclosure but whether the guest is misled.

A generated image used as illustration is acceptable when it is labelled and when it does not stand where a guest expects the actual room, the actual view or the actual breakfast. A generated image of a beach, a pool or a spa that the property does not have is a misleading claim, not a style choice, and no label repairs it.

A machine-translated page is still the hotel's statement. Check names, prices, dates and cancellation terms in every language you publish; a wrong cancellation term is a contract problem, not a translation problem. If a page is machine-translated, say so and give a way to reach a person who speaks that language.

A review reply or an email signed by a person needs no AI label, because the guest is dealing with a person. The honesty duty moves to the content: no claim the hotel cannot support, no invented detail about the stay. And do not use "AI-powered" as a marketing line in place of saying what the thing does. It names a technology and tells the guest nothing they can check. Our honesty checklist for AI-generated images goes deeper on visuals.

How do you keep the wording current?#

Give one person a register of every place a guest can meet software, and re-check it whenever the tool, the provider or the purpose changes.

List every surface in one place: the website chat, the guest app, automatic email replies, translated pages, generated images, review replies, and any printed material that repeats the same claim. Record the date and the version of each wording. This is also your proof that the notice was given, which Article 5 of the Communiqué places on the controller.

Re-check when the provider changes, when the assistant's underlying model changes, and when you add a channel. A sentence written for one tool can become false for the next. Re-check when the purpose changes, and publish the new notice before the new processing starts.

Read the wording aloud once a quarter with the guest relations team. If a colleague cannot explain the sentence to a guest, the guest will not understand it either. Delete wording for tools you no longer use: a notice about a retired chatbot is itself incomplete or misleading information.

What to do next#

Write the three sentences this week: the first chat line, the handover line and the paragraph in the privacy notice. Then have your lawyer read them against the Communiqué before anything is published. Put all three in one dated register, because the same discipline that keeps the wording honest is what lets you prove a guest was told.