Using your bot successfully is a major part of leveraging Drift. Recently, there has been increased global focus, regulatory attention, and legislation around Artificial Intelligence (AI), automated systems, and conversational bots. Navigating this evolving regulatory landscape can be complex, and we actively monitor legal developments to ensure our guidance reflects current regulatory expectations and best practices. We will continue to provide updates as new laws, regulations, and enforcement guidance emerge.

---

The Current Landscape in Europe and the US

Europe

GDPR

Under the General Data Protection Regulation (GDPR), a data subject has the right to object to automated processing of their data, and to request that the processing be performed by a human being when that processing could result in a decision which produces legal effects or significant effects on the data subject. (Article 22, GDPR).  In order for the data subject to properly object, they would have to know that they are speaking with a bot, which is where proper disclosure of the bot may be a factor. It’s unclear if any of the processing performed by Drift could have a significant legal impact on the data subject. For example, if the bot vets a data subject and determines that they are not a good lead, is that a significant legal effect?  Instead of trying to navigate those waters, Drift errs on the side of disclosure.

EU Artificial Intelligence Act (EU AI Act)

The EU AI Act introduces a comprehensive regulatory framework for AI systems in the European Union, including transparency obligations for certain AI use cases. In particular, the regulation includes specific requirements for AI systems that interact directly with humans.

Under the EU AI Act, users must be informed when they are interacting with an AI system, unless this is obvious from the context. This transparency obligation applies regardless of the AI system being classified as Limited Risk.

For conversational bots and AI-powered chat systems, this means:

• Individuals must be clearly informed that they are interacting with an AI system or bot

• The disclosure must be understandable, timely, and not misleading

• The intent is to prevent deception, manipulation, and confusion about whether a human or AI is participating in the interaction

This aligns directly with Drift’s disclosure-first approach and reinforces the importance of clearly distinguishing between bots and humans in customer interactions.

---

United States

In the US federal legislation has been proposed (The Bot Disclosure and Accountability Act) and went live on July 1, 2019.  The full text of the proposed bill is available here.  The state of California recently enacted a similar law aimed at deceptive bot practices, and it is expected that other states will pass similar laws.

The California law was drafted with the intent of preventing deceptive practices for commercial and political bots, primarily on social media.  Think bots that have harmful effects on society, either through influencing elections or even posting fake reviews to falsely impact perceptions of a product or service.  However, since the law hasn’t gone into effect and we haven’t seen any enforcement actions and interpretation of the law, it’s unclear how this may apply to companies like Drift, who use bots for sales and marketing.  Additionally, we don’t yet know how this law will apply to bots that send automated emails on behalf of humans.

Another interesting side effect of legislating bots and what bots can and cannot say is intersection with the First Amendment right to Free Speech.

So, all of the boring legal stuff aside, the important thing is, how does this affect the Customer and their use of Drift NOW?  Below are some guidelines.

 

---

Application

While it is unclear whether either of these laws apply to Drift, we believe that it’s important to distinguish between  bots and humans because:

• The expectations of the party on the other end change depending on whether they are talking to a human or a bot

• In order for a human to object to automated processing, they have to know that the processing taking place is automated or being performed by a bot.

• Disclosure builds trust and reduces confusion

• Transparency is increasingly a regulatory expectation globally (GDPR, EU AI Act, and emerging U.S. laws)

• Bots aren’t the enemy!  Bots help you, and don’t hurt you.

---

Best Practices for Bot Disclosure

Customers can distinguish between humans and bots by following these guidelines:

• Use clear bot naming
  Give your bot a clearly non-human name (e.g., including “Bot,” “Assistant,” or another neutral identifier). Avoid ambiguous naming that could imply a human identity.

• Explicit disclosure
  Configure your bot to clearly state that it is an automated system (e.g., “Hi! I’m an AI assistant,” or “Hi! I’m a bot here to help.”)

• Avoid human impersonation
  Do not use human photos, realistic avatars, or human names that could reasonably mislead users into believing they are interacting with a person.

• Consistent transparency
  Maintain consistent disclosure across chat, email, and automated workflows to ensure users always understand when automation is involved.

What Customers can do to distinguish between humans and bots:

• Give your bot a special name (depending on your primary audience and the language they speak, it may or may not be enough to call it something like “Bot”).  Avoid ambiguous naming that could imply a human identity.

• Configure your bot to clearly state that it is an automated system (e.g., “Hi! I’m an AI assistant,” or “Hi! I’m a bot here to help.”)

• Don’t give your bot a human photo, realistic avatars, or a human name, that could potentially mislead the person on the other side of the chat.

• Maintain consistent disclosure across chat, email, and automated workflows to ensure users always understand when automation is involved.

We are proactively monitoring this space for updates to make sure that Drift is at the forefront of compliant companies.  Bots are a huge help when utilized correctly and we want to continue to provide our customers with the tools and resources to configure their bots effectively and in compliance with the law.

---

Commitment to Compliance

We are proactively monitoring global regulatory developments, including GDPR enforcement trends, the EU AI Act implementation timeline, and evolving U.S. legislation. Drift is committed to maintaining a compliance-forward approach and supporting customers with tools, configurations, and guidance that align with transparency, trust, and responsible AI use.

Bots are a powerful tool when implemented responsibly. Our goal is to ensure they are deployed in a way that is transparent, compliant, and aligned with emerging global standards for ethical and lawful AI use.