AI Consent Management: Consent for the AI on Your Site — Not Just a Label
Most "AI compliance" tools stop at a notice. ConsentPixel goes further: it discloses the AI on your site under the EU AI Act's Article 50, and — the part that matters most in 2026 — it holds AI chat assistants until the visitor opts in, treating AI data processing like session recording under California's wiretapping law. Disclosure and CIPA-grade consent gating, with verifiable logs, from a single pixel.
AI on a website is three obligations, not one
The reason "AI compliance" feels confusing is that it's really three different duties wearing one name. Getting them straight is the whole point — because a tool that handles one does nothing for the others, and most tools handle only the easiest. Here's the map, and where ConsentPixel fits.
Label AI-made content
"This image was made by AI." Watermarking and provenance for AI-generated images, video and audio — under California's SB 942 and EU AI Act 50(2). Mostly for large AI providers above a user threshold.
CP: manual declaration onlyDisclose the AI
"You're talking to an AI." Telling visitors a chatbot or assistant is AI — under EU AI Act 50(1) and a wave of US chatbot-disclosure laws. Applies to any site with a bot.
✓ ConsentPixel does thisConsent before processing
"May this AI process your data before you've agreed?" Holding an AI chat before it ships the conversation to a vendor — under CIPA and the GDPR. The wiretapping-grade layer.
✓ ConsentPixel does thisConsentPixel is built for Layers B and C — disclosing the AI, and gating the data it processes until the visitor consents. It does not watermark AI-generated content (Layer A); we're honest about that below. But Layers B and C are the ones that apply to ordinary websites, and Layer C is where the litigation is heading.
Why now: AI chat is the new session replay
If you followed the website-tracking lawsuit wave, this will feel familiar — because it's the same theory, pointed at a new target. Plaintiffs' firms spent three years suing websites under California's Invasion of Privacy Act (CIPA) over session-replay tools and pixels that intercepted a visitor's activity before consent. In 2025–2026 that theory migrated to AI chatbots: when your chat widget ships what a visitor types to a third-party AI vendor in real time, plaintiffs argue the vendor is an uninvited eavesdropper on a private conversation — an unlawful interception under CIPA §631, with statutory damages of $5,000 per violation under Cal. Penal Code §637.2.
Chatbot wiretap claims are now described as the fastest-growing category of privacy litigation, growing from a handful of filings in 2021 to dozens by the end of 2025. And crucially, California's SB 690 — which narrows one CIPA theory — leaves the §631 wiretapping provision untouched, so the AI-chat suits continue even as the pixel wave narrows. Two questions decide these cases: did the visitor consent before the conversation began, and can the vendor use the conversation for its own purposes? ConsentPixel is designed around exactly those two questions. For the litigation detail, see our AI chatbots and privacy law guide and the CIPA Lawsuit Tracker. This is information, not legal advice.
What ConsentPixel does
Two capabilities, shipped and working: it discloses the AI on your site, and it gates the AI's data processing behind real consent. Here's exactly how, feature by feature.
Article 50 disclosure — declare the AI, surface it in the banner
The banner builder has a dedicated AI Act tab where you declare the AI tools used on your site — the disclosure the EU AI Act's Article 50 asks for. Since v1.19.0 the tab also lists the AI tools our scanner detected on your site, each with an "Add as disclosed tool" button, so you're not relying on memory. An optional page-load toast can surface the disclosure to visitors on arrival. This is disclosure — telling people the AI is there — and it's the first of the two obligations.
Shipped · disclosure layerThe ai_processing consent purpose — CIPA-grade gating
This is the part built for the wiretapping wave. ConsentPixel adds a dedicated ai_processing consent purpose with its own banner toggle — opt-in in every regime, treated like session recording under CIPA, and encoded in IAB TCF 2.3 as publisher custom purpose 1. AI chat assistants are held before consent: Intercom, Drift and the other assistant hosts in our catalog are blocked by the shim and the pixel until the visitor opts in, so the conversation never reaches a third-party vendor before the visitor has agreed.
Placeholder launcher + just-in-time consent modal
When a held chat widget exists, the visitor still sees a small launcher — the AI isn't hidden, just gated. Clicking it opens a one-step modal that discloses and asks for consent at the same time: Enable, or Not now. Both answers are logged. It's the cleanest resolution of the disclosure-and-consent problem: the visitor learns it's AI and makes a choice, in the same moment, before any data flows.
Shipped v1.19.0Notice logging — immutable, and it shows up as proof
Every modal decision and every toast shown is written to your consent logs as a notice row with hash version 2 — immutable. It appears in the portal's Consent Logs with a Notice chip, and on receipts. So you don't just disclose and gate the AI; you can show that you did, per visitor, with a tamper-evident record — the evidence that matters if a demand letter ever arrives.
Daily anchoring — externally verifiable AI consent records
Consent logs are anchored daily to a locked R2 bucket and to Rekor, so your AI consent records are externally verifiable — not just "trust our database." That external anchor is what turns a log into evidence a third party can check independently.
ShippedConsent-gate API — for your own AI code
If you build your own AI features — a custom assistant, an LLM endpoint, an AI search box — you can gate them on the same consent with a developer API. ConsentPixel.consent("ai_processing") returns a promise, and onConsent lets your AI code wait for the opt-in before it runs. Your AI simply doesn't process visitor data until the gate opens.
How it works, end to end
From page load to a verifiable record, here's the path a held AI assistant takes:
What ConsentPixel doesn't do yet — plainly
We'd rather tell you the boundary than let you discover it later. ConsentPixel's AI features are about AI tools that process visitor data — chat assistants and LLM endpoints. That's detection, disclosure, and consent for the interaction and the data flow.
For most websites, that boundary is in the right place: Layer A (content watermarking) rarely applies to an ordinary site, while Layers B and C — disclosing a chatbot and gating what it does with visitor data — apply to nearly everyone running a chat widget. Those are the layers ConsentPixel is built for.
See the AI already running on your site
Our free scanner now detects AI surfaces — chat assistants and LLM endpoints — alongside trackers. See what's on your site, and what fires before consent, in about 10 seconds, no account.
Scan your site free →Frequently asked questions
What is AI consent management?
AI consent management is treating the AI on your website as its own consent purpose — disclosing when a visitor is interacting with AI, and getting their consent before that AI processes their data. It's broader than a cookie banner: a chatbot that ships what a visitor types to a third-party AI vendor is processing personal data, and both the EU AI Act (disclosure) and California's wiretapping law (consent before interception) can apply. ConsentPixel adds a dedicated "ai_processing" consent purpose, holds AI chat assistants until the visitor opts in, and logs each decision. This is general information, not legal advice.
How does ConsentPixel block an AI chatbot before consent?
ConsentPixel holds AI chat assistants — Intercom, Drift and the other assistant hosts in its catalog — with a shim and the pixel, so the widget doesn't load and the conversation never reaches a third-party vendor until the visitor opts in. The visitor still sees a small launcher; clicking it opens a one-step modal that discloses it's AI and asks for consent (Enable or Not now). Only after opt-in is the assistant released. For your own AI code, the consent-gate API (ConsentPixel.consent("ai_processing")) lets your code wait for the same opt-in.
Does this cover the EU AI Act Article 50?
It covers the interaction-disclosure part — Article 50(1), telling visitors they're interacting with AI. ConsentPixel's banner builder has an AI Act tab where you declare the AI tools on your site, it lists the AI tools the scanner detected with an "Add as disclosed tool" button, and it can surface the disclosure in a page-load toast or in the just-in-time modal at the point of interaction. It does not automate Article 50(2) content marking (watermarking AI-generated images or text) — that's a separate obligation covered today only by the manual declaration. Whether Article 50 applies to you depends on your AI use; this is not legal advice.
Why treat AI processing like session recording under CIPA?
Because the legal theory is the same. California's CIPA drove a wave of lawsuits over session-replay tools that intercepted a visitor's activity before consent, and that theory has migrated to AI chatbots: when a chat widget transmits a visitor's messages to a third-party AI vendor in real time, plaintiffs argue it's an unlawful interception under Section 631, with statutory damages of $5,000 per violation under Cal. Penal Code §637.2. Treating AI processing as an opt-in purpose that must be consented to before the conversation flows is the prevention-first response to that risk. This is general information, not legal advice.
Can I prove a visitor was shown the AI notice and consented?
Yes — that's the point of the logging. Every modal decision and every toast shown is written to your consent logs as a notice row with hash version 2, immutable, and it appears in the portal's Consent Logs with a Notice chip and on receipts. The logs are anchored daily to a locked R2 bucket and to Rekor, so the records are externally verifiable rather than just an internal database claim. If you ever need to demonstrate that consent came before the AI processed anything, the evidence is there per visitor.
Does ConsentPixel watermark AI-generated images or text?
No. ConsentPixel's AI features are about AI tools that process visitor data — chat assistants and LLM endpoints — so it handles disclosure and consent for the interaction and the data flow. It does not watermark or embed provenance data into AI-generated images or text; that's a separate Article 50 obligation (and the focus of California's SB 942), generally the content provider's responsibility. Today only the manual disclosure tab lets you declare AI-generated content. If automated content watermarking is your need, that's a different type of tool.
Disclose and gate the AI on your site — from one pixel
ConsentPixel — Privacy · Verified surfaces the Article 50 disclosure, holds AI chat until the visitor opts in, and logs every decision as verifiable proof. Start with a free scan to see the AI already on your site, then a 14-day trial.
Scan your site free →Information, not legal advice. This page describes ConsentPixel product capabilities and related legal context for general informational purposes; it does not constitute legal advice or create an attorney–client relationship. Whether and how the EU AI Act, CIPA, US state chatbot laws, or the GDPR apply to your site depends on your specific AI use and visitors, and these laws are evolving. Feature availability reflects ConsentPixel v1.19.0 as of September 2026 and may change. The $5,000-per-violation figure reflects statutory damages under California Penal Code §637.2. ConsentPixel — Privacy · Verified is not a law firm and does not make any website "compliant" by itself; it does not watermark AI-generated content.