Is It Legal to Use an AI Chatbot on Your Website in Australia?

Yes, an Australian business can generally use an AI chatbot on its website, but the chatbot has to follow the same laws as everything else you say and do. The main ones are the Privacy Act and the Australian Privacy Principles (if your business is covered), the Australian Consumer Law's ban on misleading or deceptive conduct, and the spam rules if the bot sends marketing messages. The OAIC also says public-facing AI tools such as chatbots should be clearly identified as AI.

This article is general information, not legal advice. Laws and guidance change, and your obligations depend on your business. If you handle health, financial or other sensitive information, get advice specific to your situation.

Which laws apply to a website chatbot?

The rules mostly come from laws you probably already deal with. A chatbot is a new way of talking to customers, so the existing rules about what you say, what you collect and what you send still apply.

Area	Main source	What it means for a chatbot
Privacy	Privacy Act 1988 and the Australian Privacy Principles	Tell people what you collect and why, protect it, be careful sending it overseas
AI transparency	OAIC guidance on commercially available AI products	Identify the chatbot as AI and explain your AI use in your privacy policy
Automated decisions	APP 1.7 to 1.9, from 10 December 2026	Disclose in your privacy policy if programs make or substantially inform significant decisions about people
Consumer law	Australian Consumer Law, section 18	What the bot says must not mislead, including about prices, guarantees and rights
Marketing messages	Spam Act, enforced by the ACMA	Consent, identification and unsubscribe for any marketing the bot sends or triggers
Professional rules	Your regulator, such as Ahpra for registered health practitioners	Extra advertising limits, such as Ahpra's restrictions on testimonials

Privacy: does the Privacy Act apply to you?

Start here, because many small businesses are exempt and some are not. The OAIC says a small business is one with an annual turnover of $3 million or less, and those are generally exempt. But some are covered regardless of turnover, including health service providers and businesses that trade in personal information. Even if you are exempt, following the principles is good practice, and your chatbot vendor's terms may require it.

If you are covered, these principles matter most for a chatbot. The summaries come from the OAIC's APP quick reference:

APP 1, open and transparent management. Have a clearly expressed and up to date privacy policy. Mention the chatbot and your use of AI.
APP 5, notification of collection. Tell people certain things when you collect their information, such as who you are and why you are collecting it. A short notice in the chat window, with a link to your privacy policy, is a practical way to do this.
APP 6, use or disclosure. Use chat information for the purpose it was collected for, such as answering the enquiry, unless an exception applies.
APP 8, cross-border disclosure. Many chatbot tools process data overseas. The APP 8 guidelines explain the reasonable steps required before disclosing personal information overseas.
APP 11, security. Take reasonable steps to protect the information, and destroy or de-identify it in certain circumstances when you no longer need it.

What the OAIC says about AI chatbots

The OAIC's guidance on commercially available AI products is the most direct official guidance for a business adding a chatbot. Key points:

Public-facing AI tools such as chatbots should be clearly identified as such to external users such as customers.
Businesses should update their privacy policies and notifications with clear and transparent information about their use of AI.
Privacy obligations apply to personal information entered into an AI system and to output that contains personal information.
AI systems are known to produce inaccurate or false results, so processes for human oversight of outputs are needed.
Due diligence on AI products should be ongoing, not set and forget.
As best practice, do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.

The new automated decision rule from December 2026

The OAIC says that from 10 December 2026, organisations covered by the Privacy Act must include information in their privacy policy where they have arranged for a computer program to make, or substantially and directly inform, decisions that could reasonably be expected to significantly affect an individual's rights or interests. The required information includes the kinds of personal information used and the kinds of decisions involved.

A chatbot that answers questions and offers a booking link is unlikely to be making significant decisions. A chatbot that decides who is eligible for a service, a discount or a payment plan might be. If your bot does more than answer and route, read the OAIC's guidance on this rule before December.

Consumer law: your chatbot speaks for your business

Section 18 of the Australian Consumer Law, in Schedule 2 to the Competition and Consumer Act 2010, prohibits conduct in trade or commerce that is misleading or deceptive or likely to mislead or deceive. There is no exception for statements made by software. If your chatbot tells a customer the wrong price, invents a guarantee, or misstates their refund rights, treat that as your business saying it.

A well-known overseas example shows how this plays out. In Moffatt v. Air Canada (2024 BCCRT 149), a Canadian tribunal found the airline responsible for incorrect information its website chatbot gave about bereavement fares, and rejected the argument that the chatbot was responsible for its own actions. That decision is under Canadian law and does not bind Australian courts, but it is a clear warning about relying on a bot to state your policies.

Practical rules for staying on the right side of consumer law:

Give the bot only approved, current information: prices, inclusions, policies and service areas.
Tell it to say "I'm not sure, let me get a person to confirm" rather than guess.
Do not let it make promises about results, discounts or guarantees unless they are approved, written policies.
Never let it suggest customers have fewer rights than consumer guarantees provide.

Should your chatbot say it is AI?

Yes. The OAIC's guidance says public-facing AI tools such as chatbots should be clearly identified as AI. Letting customers believe they are chatting with a person could also create a misleading impression. A simple opening line works: "Hi, I'm the AI assistant for [business name]. I can answer common questions and help you book. You can ask for a person at any time." Give the bot a name if you like, but do not give it a fake human identity.

Record keeping: what to keep, and for how long

Good records protect you and your customers. Keep:

The bot's instructions and knowledge base, with dates. If a customer disputes what the bot said, you need to know what it was told to say at the time.
Conversation transcripts, for a period set out in your retention policy. Keep them only as long as you need them, and secure them, in line with APP 11.
Consent records. If the chat collects contact details for marketing, record when and how consent was given. The ACMA says marketing messages need consent and every message must identify you and offer an easy unsubscribe.
Vendor answers. Where the chatbot provider stores data, which sub-processors it uses, and how to delete data.
Review notes. What you checked each week and what you changed.

Extra care for regulated professions

Some industries have rules on top of the general law. For example, Ahpra explains that advertising a regulated health service must not use testimonials about clinical aspects such as symptoms, diagnosis, treatment or outcome. A clinic's chatbot should not share patient success stories, and should not discuss an individual's symptoms or treatment. Health information is sensitive information under the Privacy Act, so design the bot to steer clinical questions to a practitioner. Legal, financial and other regulated professions should check their own regulator's rules before launching a chatbot.

A ten-point chatbot compliance checklist

Work out whether the Privacy Act applies to your business.
Label the chatbot clearly as AI from the first message.
Add a short collection notice in the chat window with a link to your privacy policy.
Update your privacy policy to describe the chatbot and your AI use.
Ask the vendor where data is stored and processed, and keep the answer.
Load only approved, current facts, and tell the bot not to guess.
Block topics it must hand to a person: complaints, refunds, health, legal and financial specifics.
Make it easy to reach a person at any point.
Record consent before any marketing follow-up, with an unsubscribe in every message.
Review transcripts weekly and keep dated copies of the bot's instructions.

Example (hypothetical): a dental practice adds a chatbot that answers questions about opening hours, parking, payment options and how to book. It opens by saying it is an AI assistant, links to the privacy policy, and hands any question about symptoms or treatment to reception. The practice manager reads a sample of conversations each Monday and updates the bot's instructions when it gets something wrong.

What we learned in our own business

Our team's education business uses AI to reply to and follow up with new enquiries. These lessons come from our own operations, not client results.

Monitoring matters more than setup. A hidden 1,000-row database limit meant about 30 people received the same follow-up email daily for several days. The OAIC's point that AI due diligence should not be set and forget matches our experience exactly. Someone needs to look at what the system is actually sending.

Guard against repeats. One person tapped a sign-up button about 10 times in 10 seconds and received 10 welcome texts, and our team got 10 alerts. Any chatbot or automation that sends messages needs a one-time-send guard, not just a time window.

Use AI to remove the bottleneck, not the people. We connected ads, AI replies, follow-up, CRM and tracking into one system when every lead depended on our founder or his co-founder. The AI handles the first reply. People still own the rules it follows and review what it says.

See what slow replies cost your business.

The free Lead Leak Calculator turns your own numbers into a monthly figure in about 60 seconds.

Try the calculator

For the bigger picture on safe automation, read what AI can actually automate in small business marketing and how fast you should respond to a new lead. If you are choosing the system your chatbot will connect to, see the best CRM for an Australian service business.

Frequently asked questions

Is it legal to use an AI chatbot on my website in Australia?

Generally yes. The chatbot must follow the same laws as the rest of your business, including the Privacy Act if you are covered, the Australian Consumer Law's ban on misleading conduct, and the spam rules for marketing messages. This is general information, not legal advice.

Do I have to tell customers they are talking to AI?

The OAIC says public-facing AI tools such as chatbots should be clearly identified as AI to customers. Letting people think they are talking to a person could also be misleading. Say it is an AI assistant in the first message.

Am I responsible for what my chatbot says?

You should assume so. The Australian Consumer Law prohibits misleading or deceptive conduct in trade or commerce, and it has no exception for software. A Canadian tribunal held Air Canada responsible for its chatbot's wrong advice in 2024.

Can my chatbot collect names, emails and phone numbers?

Yes, with care. Tell people what you are collecting and why, link to your privacy policy, protect the data, and record consent before sending any marketing messages. Collect only what you need for the next step.

Does the December 2026 automated decision rule apply to chatbots?

It applies to covered organisations where a computer program makes or substantially informs decisions that could significantly affect someone's rights or interests. A bot that only answers questions and books appointments is unlikely to be caught, but one that decides eligibility might be.

Should I keep chatbot transcripts?

Keep them for a defined period in line with your retention policy, secure them, and delete or de-identify them when no longer needed. Also keep dated copies of the bot's instructions so you can show what it was told to say.