AI, Privacy and Your Website: 5 Things Every Business Needs to Know
While AI continues to change almost every aspect of our lives, have you taken the time to think about how it affects your business and privacy of your data of your customers?
Artificial intelligence (AI) is rapidly changing the way businesses build, manage and use their websites. From AI-powered chatbots and personalised customer experiences to content creation, website development and automated customer service, there are more opportunities than ever to use AI to improve your online presence.
But there is another side to the AI conversation that businesses cannot afford to ignore: privacy.
If your website collects names, email addresses, phone numbers, customer enquiries, payment information, or other personal information, introducing AI can create new privacy and security considerations, you may not have even thought about.
The Office of the Australian Information Commissioner (OAIC) has made it clear that Australian privacy obligations apply to uses of AI involving personal information. This includes information entered into an AI system and personal information contained in AI-generated outputs.
So, how can your business take advantage of AI without creating unnecessary privacy risks? Here are five things you need to know.
1. Know what information your AI tools are accessing
The first question every business should ask before introducing AI is simple: What information will the AI system have access to?
An AI website chatbot, for example, could receive information directly from visitors. A customer might enter their name, email address, phone number, account details, or details about a problem they are experiencing.
If that information is personal information, privacy obligations may apply.
The OAIC recommends that organisations consider whether using personal information with an AI product is necessary and appropriate, rather than using AI simply because the technology is available. It also recommends that businesses take particular care with sensitive information and avoid entering personal information into publicly available generative AI tools where possible.
Businesses should therefore map out what information their website collects, where it goes and which third-party platforms or AI systems can access it.
Before adding an AI tool to your website, ask:
- What information does it collect?
- Does it need personal information to work?
- Where is that information stored?
- Who can access it?
- Is information sent to another provider?
- Could the information be used to train or improve an AI model?
Understanding the data flow is an important first step towards responsible AI implementation.
2. Your privacy policy needs to reflect how you actually use AI
Adding AI to your website can change how you collect, use and disclose information. For example, if your website introduces an AI chatbot, visitors should be able to understand that they are interacting with AI and what happens to information they provide.
The OAIC recommends that businesses update their privacy policies and notifications to provide clear and transparent information about their use of AI, including clearly identifying public-facing AI tools such as chatbots.
This means your website’s privacy policy should not simply be a generic document that was written years ago and forgotten. It should accurately reflect your current technology stack and data practices.
Depending on how AI is being used, this may include explaining:
- What personal information is collected
- Why it is collected
- How AI is used
- Who information may be disclosed to
- Whether information is processed by third-party providers
- How customers can contact your business about their information
Your website should make privacy information easy to understand rather than hiding it behind complicated legal terminology.
3. Don’t assume AI-generated information is accurate
One of the biggest mistakes businesses can make is assuming that AI is always correct. It isn’t.
Generative AI can produce inaccurate, incomplete or misleading information. This becomes particularly important when AI is interacting directly with customers or handling personal information.
The OAIC specifically highlights accuracy as an important consideration when businesses use AI. Under Australian Privacy Principle 10, organisations covered by the Privacy Act have obligations to take reasonable steps to ensure personal information they collect, use or disclose is accurate.
For a website, this means AI should not necessarily be left completely unsupervised.
An AI chatbot might provide an incorrect answer about your services. An AI-generated article could contain inaccurate claims. An AI system could misunderstand a customer enquiry. The solution isn’t to avoid AI. It is to introduce human oversight where it matters.
Businesses should establish rules around:
- What AI can answer independently
- What information AI can access
- When an enquiry must be escalated to a person
- How AI-generated content is checked
- How errors are identified and corrected
AI should support your business, not replace human judgement.
4. Treat AI as part of your website security strategy
AI doesn’t exist separately from your website. If you add an AI chatbot, AI-powered search, automated form processing, or another AI service, it becomes part of your broader technology environment.
That means security needs to be considered from the beginning.
Businesses should understand how AI services connect to their website and what permissions they require. They should also consider the security of APIs, plugins, integrations, databases, and third-party platforms. This is particularly important for WordPress websites, where websites can contain numerous plugins and integrations.
A secure website should be regularly updated, monitored and backed up, with unnecessary access and integrations removed. AI should be introduced with a privacy-by-design and security-by-design mindset, rather than added first and assessed later.
The OAIC also recommends businesses undertake due diligence when selecting commercially available AI products, including considering privacy and security risks, testing, human oversight, and who can access information entered into the system.
5. Create an AI policy before everyone starts using AI
One of the biggest risks for businesses may not be the AI integrated into their website. It could be the AI tools employees are already using. Employees may be using generative AI to write emails, analyse information, create marketing content, summarise documents, or respond to customers.
Without clear guidelines, someone could accidentally enter confidential business information or customer personal information into a public AI tool.
Businesses should establish an internal AI policy covering:
Which AI tools employees can use
What information must never be entered
How customer information should be handled
When human review is required
How AI-generated content should be checked
Who is responsible for managing AI tools
How new AI applications are approved
This gives employees clear boundaries while still allowing your business to benefit from AI.
How CircleBC Can Help You Use AI the Right Way
AI can deliver enormous benefits to a business website, but implementing it properly requires more than simply installing an AI plugin or connecting a chatbot.
CircleBC can help businesses assess, implement, and manage AI solutions as part of their wider website strategy.
From AI-powered website features and chatbots to AI content workflows, integrations and WordPress development, CircleBC can help you identify where AI can provide genuine value while considering privacy, security, usability, and performance.
The goal isn’t to add AI everywhere. It is to identify where AI can solve a real business problem, improve the customer experience or save your team time, and implement it responsibly.
We can also help review your existing website, integrations, and technology environment to identify opportunities and potential risks before introducing new AI functionality.
AI Should Make Your Website Better, Not Riskier
AI is becoming an increasingly important part of today’s websites. Used correctly, it can improve your customer service, streamline processes, create efficiencies, and deliver better digital experiences.
But responsible AI starts with understanding the data.
Before introducing AI to your website, make sure you know what information is being collected, where it is going, how it is being used and who has access to it.
Privacy, security, transparency, and human oversight should be built into your AI strategy from the beginning.
If you’re considering adding AI to your website but aren’t sure where to start, CircleBC can help you navigate the technology and implement AI in a practical, secure, and responsible way.
Want to know more? Call us on 1300 978 073 or click here to book an obligation free chat.
FAQs - AI, Privacy and Websites
Is AI on my website a privacy risk?
AI isn’t automatically a privacy risk, but the way it is implemented can create privacy risks. If an AI system collects, processes, stores or generates personal information, businesses need to understand their privacy obligations and how the system handles that information.
Can I use customer information with ChatGPT or another AI tool?
Businesses should be very cautious about entering customer personal information into publicly available generative AI tools. The OAIC recommends avoiding this practice, particularly where sensitive information is involved.
Does my website privacy policy need to mention AI?
If AI changes the way your business collects, uses or discloses personal information, your privacy information may need to be updated. The OAIC recommends transparency around the use of AI, including public-facing tools such as chatbots.
Can AI-generated website content be trusted?
AI-generated content should always be reviewed before publication. AI can generate inaccurate information, so businesses should have a human review process, particularly for factual, technical, legal, financial or customer-facing information.
Do small businesses need to worry about AI privacy?
Yes. Whether the Privacy Act applies to a particular small business depends on its circumstances. While many small businesses with annual turnover of $3 million or less are not covered, there are important exceptions. Businesses should therefore assess their specific obligations rather than assume they are exempt.
How can CircleBC help with AI and my website?
CircleBC can help businesses assess where AI could benefit their website, implement AI-powered functionality, integrate AI with existing systems and consider website privacy, security and performance as part of the implementation process.