ConsentPixel – Privacy · Verified

AI Consent · Taxonomy · 2026

"AI / Automated Processing" Deserves Its Own Consent Category — Cookie Consent Isn't Enough

Open your consent banner and read the options: Necessary, Functional, Analytics, Advertising. Now find the box for the AI chatbot that ships your visitors' messages to a third-party model. It isn't there. The entire consent taxonomy the web runs on was built for the ad-tech era, and it has no category for AI. Yet the law already treats automated processing consent as its own thing. This is the argument for making "AI / automated processing" a first-class consent purpose — and why leaving it out is a category error.

CPConsentPixel Team Updated September 2026 12 min read Information, not legal advice
10 purposes
The IAB's consent framework defines ten standard purposes — all advertising and analytics, none for AI
Article 22
GDPR already gives automated processing its own consent basis — the banner UI just hasn't caught up
Its own box
AI processing is different enough from analytics to deserve a first-class consent purpose, not a sub-line

Key takeaways

  • The consent taxonomy is missing a category. Cookie banners and the IAB framework offer analytics and advertising purposes — but no purpose for AI or automated processing, which now runs on a huge share of sites.
  • The law already treats it as distinct. GDPR Article 22 gives automated decisions their own consent basis, and California's ADMT rules add dedicated opt-out and opt-in rights. The legal category exists; the interface lags it.
  • AI isn't just another analytics tool. It differs in risk, timing, disclosure duty, and data type — enough that bundling it into "functional" or "analytics" is a category error, not a shortcut.
  • Cookie consent asks the wrong question. A cookie banner governs storage; AI processing is about use — shipping a visitor's input to a model, often in real time, often before consent.
  • The fix is a first-class purpose. "AI / automated processing" should be its own opt-in toggle, separate from analytics and ads, disclosed at the interaction, and logged — which is exactly what we've built and encoded.

The missing box

Every consent banner you've ever clicked shares a hidden assumption: that the meaningful ways a website uses your data can be sorted into a handful of buckets — essential cookies, functional preferences, analytics, advertising. That taxonomy is so familiar it feels like the natural shape of the problem. It isn't. It's a snapshot of what websites did to visitors around 2018, frozen into a standard — and it's now missing the fastest-growing category of data use on the web: automated processing consent for the AI tools that read, interpret, and act on what visitors type.

Here's the concrete gap. When a visitor opens the support chatbot on your site and types "I'm having chest pains, are you open?", that text is often transmitted, in real time, to a third-party AI model that may log it, process it, and even train on it. Which box on your consent banner covered that? "Analytics" measures behavior in aggregate — this isn't that. "Advertising" targets ads — this isn't that either. "Functional" remembers preferences — this is a live human sentence going to an outside model. The honest answer is that no standard category describes it, so it happens under whichever bucket the site happened to file the chatbot under, or under no consent at all. That's the problem this article is about, and the argument is simple: AI / automated processing has become distinct and significant enough that it deserves to be a first-class consent purpose in its own right.

The consent taxonomy the web runs on is a snapshot of what websites did to visitors around 2018 — frozen into a standard, and now missing the fastest-growing category of data use on the web.

The core argument

The consent taxonomy we inherited

To see why the box is missing, look at where the boxes came from. The two taxonomies almost every site uses were both designed around advertising and analytics, before AI tools processed visitor input at all.

The universal cookie categories — Necessary, Functional, Analytics, Marketing — sort cookies. The IAB Transparency & Consent Framework (TCF), the ad-tech standard now in version 2.3 (mandatory since February 2026, with 2.4 arriving for web in October 2026), defines ten standard purposes: storing and accessing information on a device, creating and using profiles for personalized advertising, personalizing content, measuring ad and content performance, market research, developing and improving services, and so on.

The standard purposes — and the one that's missing 📊 Store / access info 🎯 Personalized ads 📈 Measure ad performance 📰 Personalized content 🔍 Market research 🛠️ Improve services 🍪 Analytics 📣 Advertising ⚙️ Functional 🤖 AI / AUTOMATED PROCESSING — no standard box Chat assistants, LLM endpoints, AI that reads what visitors type — filed under "other," or nothing

Read that list and one thing jumps out: every purpose is a variation on advertising, content, or measurement. That's not an accident — the TCF was built by and for the digital advertising industry to make programmatic ad consent portable. It does that job well. But it was never designed to describe a chatbot sending a visitor's words to an LLM, because in 2018 that wasn't a thing websites did. The framework even provides "publisher custom purposes" — slots for exactly the use cases the standard list doesn't cover — which is a tacit admission that the standard list has gaps. AI processing is the biggest one.

The law already made automated processing a category

Here's the part that turns this from an aesthetic preference into a real gap: the law is ahead of the interface. Regulators already treat automated processing as a distinct category of data use with its own consent rules — the consent banner just hasn't caught up to what the statutes already say.

🇪🇺GDPR Article 22 — automated processing is its own basisArticle 22 gives individuals the right not to be subject to a decision based solely on automated processing unless they've given explicit consent (or it's necessary for a contract or authorized by law). That's the law carving out automated processing as a category needing its own, higher-standard consent — explicit, not the ordinary kind. If it were just "analytics," Article 22 wouldn't exist.
🇺🇸California's ADMT rules — dedicated rights for automated decisionsThe CPPA finalized regulations (effective January 1, 2026) creating specific rights around automated decision-making technology (ADMT) — defined broadly as "any technology that processes personal information and substantially replaces human decisionmaking." Consumers get an opt-out for ADMT in significant-decision contexts, and opt-in consent is required when ADMT processes sensitive data or minors' data, plus mandatory risk assessments. Again: a distinct category, with its own consent mechanics.
🤖The EU AI Act adds a disclosure duty on topArticle 50, in force since August 2026, requires telling people when they're interacting with AI. No cookie category has ever carried a "tell them it's AI at first interaction" duty — because cookies don't talk back. AI adds an obligation the old taxonomy never modeled.

Put those together and the conclusion is hard to avoid: three separate legal regimes have independently decided that automated processing is not the same thing as advertising or analytics — it gets its own consent basis (GDPR), its own rights (CCPA/ADMT), and its own disclosure duty (AI Act). The one place that hasn't caught up is the consent banner, where AI still has no box of its own. The taxonomy is lagging the law by years.

Three separate legal regimes independently decided automated processing isn’t advertising or analytics. The one place that hasn’t caught up is the consent banner.

GDPR · CCPA/ADMT · EU AI Act

Why AI isn't just another analytics tool

You could object: why not just add AI as a sub-item under "analytics" or "functional" and move on? Because AI processing differs from analytics on four axes that matter for consent — enough that filing it under an existing bucket isn't tidy, it's wrong.

1Different risk — it processes the person, not their behaviorAnalytics measures aggregate behavior: pageviews, clicks, funnels. An AI assistant processes the visitor's actual words — often free text they typed — and ships them to a third-party model that may retain or train on them. That's a categorically more sensitive operation than counting a page visit, and it deserves a consent choice that reflects that.
2Different timing — it intercepts a live conversationA cookie fires and stores something. An AI chat intercepts a real-time exchange — which is exactly why plaintiffs are suing over it under California's wiretapping law (CIPA), arguing the third-party model is an uninvited eavesdropper. It's the fastest-growing category of website privacy litigation, with statutory damages of $5,000 per violation under Cal. Penal Code §637.2. Cookie-consent taxonomy never modeled real-time interception, because cookies don't intercept conversations.
3Different duty — it has to disclose itselfAnalytics has no obligation to announce itself to the visitor. AI does: the EU AI Act requires disclosure at the interaction. So the AI category uniquely bundles a disclosure duty with the consent duty — two obligations a single analytics checkbox was never built to carry. We unpack that pairing in AI disclosure vs AI consent.
4Different data — free text can contain anythingAn analytics event has a known shape. A chat message is unstructured free text a visitor might fill with health details, financial information, or other sensitive data — which can trigger sensitive-data opt-in requirements (like California's ADMT rules) that a generic "analytics" bucket never contemplated. You can't give informed consent to a category that doesn't describe what's actually happening.

Any one of these might be survivable. Together, they make the case decisive: bundling AI into "functional" or "analytics" is a category error. It hides a distinct, higher-risk, differently-regulated operation inside a label built for something else — which is precisely the kind of mismatch between what the banner says and what the site does that regulators and courts have been penalizing.

Which category is your AI hiding in?

Most sites don't know their chatbot is uncategorized until they look. Scan your site to see the AI tools and trackers firing — and whether they fire before consent — in about 10 seconds, no account.

Scan your site free →

What a first-class "AI / automated processing" purpose looks like

If AI deserves its own category, what should that category actually be? Not a vague "we use AI" line buried in a policy — a real, structured consent purpose with defined properties, sitting alongside analytics and advertising in the banner. Here's the standard we'd propose, and the one we build to.

→Its own toggle, separate from analytics and ads"AI / automated processing" appears as a distinct purpose in the consent interface — not folded into another category — so the visitor can accept analytics while declining to have an AI model process their input, or vice versa. Separability is what makes consent specific.
→Opt-in by default, in every regimeGiven the risk profile and Article 22's explicit-consent standard, the AI purpose should be treated as opt-in everywhere — held until the visitor affirmatively agrees — rather than opt-out. Treat it the way the strictest applicable rule would.
→Disclosed at the moment of interactionBecause AI carries a disclosure duty, the category pairs consent with disclosure: when the visitor engages a held AI tool, they learn it's AI and make the consent choice in the same moment, before any data flows.
→Enforced, then loggedThe purpose isn't just a label — the AI is actually held until consent is given, and the decision is recorded as tamper-evident proof. A category that's declared but not enforced is the exact gap the lawsuits target.

That's the vocabulary we think the market should adopt: AI / automated processing as a named, opt-in, separately-toggled, disclosed-and-enforced consent purpose — the consent interface finally catching up to what GDPR Article 22, the CCPA's ADMT rules, and the EU AI Act already require in substance.

From vocabulary to a real banner toggle

Naming a category is easy; operationalizing it is the hard part, and it's where this stops being a think-piece. We didn't just argue AI should be a consent purpose — we shipped it as one. In ConsentPixel, "AI / automated processing" is a real, standards-encoded consent purpose, not a concept.

How it's built. ConsentPixel adds a dedicated ai_processing consent purpose with its own banner toggle — encoded in IAB TCF 2.3 as publisher custom purpose 1, which is precisely the mechanism the framework provides for use cases its standard purposes don't cover. It's opt-in in every regime and treated like session recording under CIPA. AI chat assistants — Intercom, Drift, and the others in the catalog — are held before consent: the widget doesn't load or transmit until the visitor opts in. When they engage it, a one-step modal discloses it's AI and asks for consent at once; both answers are logged immutably. And a consent-gate API lets a site's own AI code wait for the same opt-in.

That's the difference between writing about a category and defining one: the argument is backed by a working toggle that a visitor can see, a standard (TCF) that can carry it, and enforcement that actually holds the AI until the answer is yes. The full capability lives on the AI consent management page.

The honest boundary
To be precise about scope: the ai_processing purpose governs AI tools that process visitor data — chat assistants, LLM endpoints, AI widgets. It is not about labeling AI-generated content (images or text) on the page, which is a separate obligation. And "publisher custom purpose 1" is exactly that — a publisher custom purpose, not yet a formal standard TCF purpose. That's the point of this article: the category is real and legally grounded today, but the industry standard hasn't formally adopted it yet. We think it should.

What this means for you — don't wait for the standard

The taxonomy will catch up eventually; standards bodies move slowly, and a formal TCF purpose for AI may be years away. But your legal exposure isn't waiting for the standard. GDPR Article 22, the CCPA's ADMT rules, the EU AI Act, and the CIPA litigation wave all apply now, to the AI already running on your site. So the practical move is to adopt the category ahead of the standard.

1Find the AI that has no categoryInventory the AI tools on your site — chat, search, assistants, LLM endpoints. If they're not in your consent banner as their own purpose, they're miscategorized or unconsented. A scan is the fastest way to see them; our is your website using AI on visitors? guide walks through what to look for.
2Give it its own opt-in toggleAdd "AI / automated processing" as a distinct, opt-in purpose in your banner — separate from analytics and advertising — rather than hiding it under "functional." Specific consent requires a specific box.
3Hold the AI until consent, and disclose at the interactionDon't let the chatbot transmit before the visitor agrees, and tell them it's AI when they engage. Consent plus disclosure, in the same moment.
4Keep the recordLog each AI-consent decision as proof — the evidence that, whatever the standard eventually says, you treated automated processing as its own category before you had to.

The sites that handle the next wave calmly won't be the ones with the most elaborate cookie banner. They'll be the ones who recognized that AI is a different kind of data use, gave it its own place in the consent conversation, and could prove it — while everyone else was still trying to decide whether the chatbot counts as "functional."

Frequently asked questions

What is AI or automated processing consent?

It's consent specifically for a website's use of AI or automated tools that process a visitor's personal data — chat assistants, AI search, LLM endpoints — as distinct from consent for cookies, analytics, or advertising. It matters because these tools often transmit what a visitor types to a third-party model in real time, a different and often higher-risk operation than storing a cookie. The law already treats it separately: GDPR Article 22 requires explicit consent for solely automated decisions, and California's ADMT rules add dedicated opt-out and opt-in rights. This article argues consent banners should reflect that with a distinct "AI / automated processing" purpose. This is general information, not legal advice.

Why isn't cookie consent enough to cover AI?

Because a cookie banner asks the wrong question for AI. Cookie consent governs storage — what gets saved on a device — using categories built for advertising and analytics. AI processing is about use: shipping a visitor's input to a model, often in real time, often to a third party that may retain or train on it. It differs from analytics in risk (it processes the person's words, not aggregate behavior), timing (it intercepts a live conversation, which drives CIPA lawsuits), disclosure duty (the EU AI Act requires telling people it's AI), and data type (free text can contain sensitive information). No standard cookie category describes that, so cookie consent alone leaves AI uncategorized. This is general information, not legal advice.

Does the IAB TCF have a purpose for AI?

Not as a standard purpose. The IAB Transparency and Consent Framework defines ten standard purposes, all oriented around advertising and analytics — storing information, personalized ads, content personalization, performance measurement, and so on — none of which is "AI" or "automated processing." The framework does provide "publisher custom purposes," which are slots for use cases the standard list doesn't cover, and that's where an AI purpose can be encoded today. ConsentPixel implements its AI-processing consent purpose as TCF publisher custom purpose 1 for exactly this reason. A formal standard purpose for AI would require the framework itself to add one, which hasn't happened yet.

Does GDPR require separate consent for automated processing?

In defined circumstances, yes. GDPR Article 22 gives individuals the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, unless they gave explicit consent, it's necessary for a contract, or it's authorized by law. That's a distinct, higher-standard consent basis for automated processing — ordinary analytics consent isn't automatically sufficient. Not every AI interaction triggers Article 22, but the fact that the regulation carves out automated processing at all shows the law treats it as its own category. Whether it applies depends on the facts; this is general information, not legal advice.

How do I add an AI consent category to my site?

Add "AI / automated processing" as its own opt-in purpose in your banner, separate from analytics and advertising; hold the AI tools until the visitor consents so nothing transmits to a third-party model first; disclose that it's AI at the interaction; and log each decision as proof. Doing this manually across tools is hard, which is why a platform that treats AI as a first-class purpose helps — ConsentPixel adds a dedicated ai_processing toggle encoded in the TCF framework, holds assistants before consent, and records the decision. Start by scanning to see which AI tools need a category. This is general information, not legal advice.

Is "AI / automated processing" an official consent category yet?

Not as a formal industry standard. The major consent taxonomies — the universal cookie categories (necessary, functional, analytics, marketing) and the IAB TCF's standard purposes — don't yet include an AI or automated-processing purpose. The legal category exists in substance (through GDPR Article 22, California's ADMT rules, and the EU AI Act), but the consent-interface standards haven't formally adopted a matching purpose. Today it's implemented as a publisher custom purpose rather than a standard one. This article argues that it should become a first-class, standard purpose — and that site owners shouldn't wait for the standards body to catch up before treating AI as its own consent category, because the legal exposure already exists.

The bottom line

The consent taxonomy the web runs on was designed for the advertising era, and it shows: analytics and ads get their own boxes, while AI — the fastest-growing and arguably highest-risk category of data use on modern sites — has none. That's not because AI is minor. It's because the standard froze before AI tools started reading what visitors type.

But the law didn't freeze. Article 22, the ADMT rules, and the AI Act all treat automated processing as its own thing, with its own consent and disclosure requirements. The only laggard is the banner. So the argument is straightforward: "AI / automated processing" should be a first-class consent purpose — separately toggled, opt-in, disclosed, and enforced — and the sites that add it now, ahead of the standard, are the ones matching their consent interface to what the law already says.

You can start by finding out which category your own AI is currently hiding in.

Give AI its own consent category — today

ConsentPixel — Privacy · Verified ships "AI / automated processing" as a real consent purpose: its own opt-in toggle, encoded in the TCF framework, holding AI assistants until consent and logging each decision. Start with a free scan to see the AI on your site, then a 14-day trial.

Scan your site free →
No account needed for the scan · then a 14-day free trial, no credit card required

Related reading

What Is AI-Aware Consent? AI Disclosure vs AI Consent — the two duties websites confuse EU AI Act Article 50 for Websites AI Consent Management — the ai_processing purpose in the product
CP

The ConsentPixel Team

Privacy & Consent Compliance

ConsentPixel — Privacy · Verified treats AI as a first-class consent purpose: a dedicated ai_processing toggle encoded in the IAB TCF framework, holding AI assistants until a visitor consents, pairing disclosure with the consent prompt, and logging each decision as tamper-evident proof. This article argues a position about consent taxonomy and is educational, not legal advice; whether any rule applies to your site depends on your facts. ConsentPixel is not a law firm.

Information, not legal advice. This article argues a position about how consent taxonomy should evolve and is provided for general educational purposes; it does not constitute legal advice or create an attorney–client relationship. "AI / automated processing" is not currently a formal standard consent purpose in the universal cookie categories or the IAB TCF; ConsentPixel implements it as a publisher custom purpose. Legal references — GDPR Article 22, the California CCPA/CPRA ADMT regulations (effective January 1, 2026), and the EU AI Act Article 50 (in force August 2026) — are for orientation and are evolving; whether and how they apply depends on your specific processing and visitors. The $5,000-per-violation figure reflects statutory damages under California Penal Code §637.2; California ADMT penalties are up to $7,500 per intentional violation. Consult qualified counsel about your situation. ConsentPixel — Privacy · Verified is a consent-management and detection tool, not a law firm, and does not label AI-generated content.

Scroll to Top