Key takeaways
- From 20 July 2026, any website using generative AI on customer data — chat widgets, recommendation engines, personalisation — needs a specific AI data notice under PDPC’s finalised guidelines.
- There’s no fixed format. A well-placed line near the feature, linking to a dedicated page, beats a generic cookie-style banner.
- Opt-out buttons aren’t legally required, and you can’t refuse service to a visitor who declines — so the design problem is disclosure, not gatekeeping.
- Anonymised data is exempt entirely.
Most conversations we have with clients about their website’s AI features are about what the feature does for the visitor — smarter search, a chat widget that qualifies leads, product recommendations that actually feel relevant. As of 20 July 2026, there’s a second conversation worth having: what the site tells visitors about how their data feeds that feature. Singapore’s Personal Data Protection Commission (PDPC) has finalised advisory guidelines requiring an AI-specific notice wherever personal data is used to train a generative AI model, and for a lot of the premium sites we build, that now includes features that were quietly shipped without much thought to disclosure.
This isn’t another cookie banner
The instinct when a new privacy rule lands is to bolt on a pop-up. Please don’t. PDPC deliberately left the format open — a pop-up, a dedicated webpage, or an updated privacy policy clause can all satisfy the requirement, as long as the wording is specific rather than generic. For a brand that’s paid attention to every pixel of its site, a blanket interstitial is the wrong tool. The better pattern we’re building into new projects is closer to what PDPC itself is encouraging for AI chatbots more broadly: a single, clearly labelled place — think of it like a nutrition label for the feature — that a curious visitor can find in one click from wherever the AI feature lives.
Where this actually applies on a typical site
Across the sites we design and maintain, the features most likely to trigger the new requirement are:
- AI chat or lead-qualification widgets that learn from visitor conversations rather than just running a fixed decision tree.
- Product recommendation engines on e-commerce sites, trained on browsing and purchase history.
- Dynamic content or personalisation blocks that adapt based on a visitor’s behaviour across sessions.
- Lead forms feeding a scoring model used by sales or marketing teams downstream.
One nuance worth knowing if you run an online store: if you’ve been using customer browsing or purchase data purely for on-site recommendations, and later decide to repurpose that same dataset to build or license a separate AI product, PDPC treats that as a fresh purpose. It needs its own notice, even if your original privacy policy already covered the recommendation use.
What you don’t need to build
Two things got clarified — and softened — between PDPC’s draft consultation and the final guidelines, and they change the design brief meaningfully:
- No mandatory opt-out flow. You’re not required to build a toggle letting visitors withdraw their data from AI training, which saves a genuinely complex piece of UX and backend work. Some premium brands still choose to offer one as a differentiator.
- No right to refuse service. A business cannot decline to serve a visitor purely because they’ve indicated they don’t want their data used for AI training — so the notice is purely informational, not a gate.
That means the design problem is almost entirely about clarity and placement, not building consent-management infrastructure — good news for timelines.
A short checklist before your next site update
- List every AI-driven feature on the site and what data feeds it.
- For each one, write a single specific sentence describing that data use — not “to improve our services.”
- Decide the lightest-touch placement: inline link, footer page, or privacy policy section.
- Flag anywhere customer data might be repurposed for a new AI product, since that needs its own notice.
Frequently asked questions
Do I need a popup on every page?
No. PDPC doesn’t dictate format — a well-placed inline notice or dedicated page is enough, and usually a better experience than a site-wide pop-up.
Where should the notice legally need to sit?
Anywhere it’s genuinely visible and specific: near the AI feature itself, on a dedicated page, or as a clear clause in your privacy policy.
Is my e-commerce recommendation engine covered?
Yes, if it trains on personal browsing or purchase data. It needs a fresh notice too if that data is later reused to build a separate, licensable AI product.
Do I have to add an opt-out button?
No, it’s not mandatory, and you can’t refuse service to someone who opts out even if you offer the choice.
What if my chatbot only uses anonymised data?
Then it’s exempt — the requirement only applies to personal data that can be tied to an identifiable individual.
Want this built into your site properly, not bolted on?
8CLICKS designs AI-feature disclosures as part of the site itself — considered, on-brand, and placed where visitors will actually see them — whether we’re building your site from scratch or updating an existing one.
