Can I use AI on customer data without asking them?

You can process customer data with AI under legitimate interest or contractual necessity without explicit consent, but you must always inform customers about the processing in your privacy policy.

What if a customer objects to AI processing of their data?

Under GDPR, customers have the right to object to processing based on legitimate interest. You must stop processing unless you can demonstrate compelling legitimate grounds that override their rights.

Do I need consent for AI-powered marketing?

For direct marketing, consent is generally required under GDPR regardless of whether AI is involved. For AI-powered personalization within your service, legitimate interest may be sufficient.

Quick answer

Under GDPR, you need a legal basis to process customer data with AI, but consent is only one of several options. Legitimate interest or contractual necessity may also apply. You must inform customers about AI processing regardless of your legal basis, and you need additional safeguards for automated decision-making.

Updated June 2026 · MmowW AI Compliance

Do I Need Consent to Use AI on Customer Data?

Understanding Legal Bases for AI Data Processing

Many businesses assume they need explicit consent for every AI use of customer data. This is not quite right. Under GDPR, consent is one of six legal bases for data processing. Others include contractual necessity, meaning the processing is needed to fulfill a contract with the customer, legitimate interest, meaning you have a genuine business reason that does not override the customer's rights, and legal obligation, meaning you are required by law to process the data.

For many business AI use cases, legitimate interest is the most practical legal basis. But using legitimate interest requires you to document a legitimate interest assessment showing that your business interest does not override the customer's privacy rights.

When Consent Is Required

Consent becomes necessary or strongly advisable in several situations: when AI makes significant automated decisions about customers without human involvement, when you process sensitive data categories like health, biometric, or racial data with AI, when you use customer data for purposes beyond what they would reasonably expect, and when you share customer data with third-party AI services for purposes unrelated to your service.

If you rely on consent, it must be freely given, specific, informed, and easy to withdraw. Pre-checked boxes and buried terms do not count as valid consent under GDPR.

Transparency Requirements

Regardless of which legal basis you use, you must inform customers about your AI data processing. Your privacy policy should explain what AI processing you do, what data is involved, the purpose of the processing, and customers' rights regarding automated decisions. Under the EU AI Act, additional transparency requirements may apply depending on the risk level of your AI use.

Practical Steps

Audit your AI data processing activities. For each one, identify the appropriate legal basis. Update your privacy policy to include AI processing. If you rely on consent, ensure your consent mechanisms meet legal requirements. If you rely on legitimate interest, document your assessment. Regardless of legal basis, always be transparent with customers about how their data is used.

Staying Current With AI Law

AI regulation is evolving faster than almost any other area of law. What is compliant today may not be sufficient next year. Build a habit of checking for regulatory updates at least monthly. Subscribe to updates from your national AI authority, your industry association, and reputable AI compliance publications.

Do not try to become a legal expert yourself. Instead, build a relationship with a legal advisor who understands AI regulation and can help you interpret new requirements as they emerge. Even a brief annual consultation can save you from costly compliance mistakes. The investment in staying informed is small compared to the cost of discovering too late that your practices have fallen behind the law.

Check your AI compliance readiness — free.

Take the Readiness Check 3 minutes · 10 questions · no signup required

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.