AI in E-commerce: Key Legal Issues in Online Shopping

Do you use AI in online sales? Since February 2025, the first prohibitions under the AI Act have applied, and further rules are coming into force in stages through 2027. Before launching a new AI system, check whether your activities comply with the AI Act, GDPR, the Omnibus Directive and competition rules. Below are specific risks and steps you should consider.

The AI Act: the first law regulating artificial intelligence in business

The AI Act is an EU regulation adopted on 13 March 2024. It sets rules and prohibitions intended to protect buyers from harmful uses of AI. It was published in the Official Journal of the European Union on 12 July 2024 and entered into force on 1 August 2024.

AI Act implementation schedule

The rules take effect gradually. Plan your activities according to this calendar:

1. From 2 February 2025: rules on prohibited practices apply, including subliminal techniques, discrimination and social scoring of citizens.
2. From 2 August 2025: rules concerning general-purpose AI and governance apply.
3. From 2 August 2026: most of the remaining provisions of the AI Act apply.
4. From 2 August 2027: obligations apply to certain high-risk systems listed in Annex I.

Do not wait until 2027. The prohibitions on prohibited practices already apply.

Personalized offers: what is permitted and what is prohibited

According to a McKinsey Global Institute report, AI can increase customer-service efficiency by as much as 45%. Personalization is one of the most common uses of AI in e-commerce. Analyzing purchase history, habits and preferences makes it possible to tailor offers, discounts and recommendations to each individual user.

Risk of using subliminal techniques

Personalization can easily become manipulation. Imagine an AI system connected to your e-commerce store that profiles a user in real time and dynamically changes the background, colors or music to influence a purchase decision subliminally.

What you need to know:

• The AI Act prohibits subliminal techniques; the prohibition has applied since February 2025.
• Responsibility lies not only with the AI system provider, but also with you as the entity using the tool.
• If your AI system dynamically changes the interface in a way the user is unaware of, check whether you may be engaging in a prohibited practice.

Personal data protection (GDPR) when using AI in sales

Every use of AI in a sales process involves processing personal data. The GDPR continues to govern how you must protect that data.

What can go wrong: two main risks

1. Risk of lacking a legal basis for data processing: your AI system may collect data for which you have neither consent nor another legal basis for processing. Before implementing the tool, verify where the data comes from and whether you have the right to process it.
2. Risk of breaching information duties when profiling: if AI makes decisions automatically or profiles users, the GDPR requires you to:
   • inform users about automated decision-making and profiling,
   • give them the right to object,
   • enable human intervention in the decision-making process.

Dynamic pricing: legal limits

AI enables dynamic pricing, where a product’s price changes automatically based on analysis of demand, competitors and user behavior. If AI detects falling demand, it may lower the price to encourage a purchase.

Obligations under the Omnibus Directive

Rules on presenting price reductions have applied since 2023:

• Next to the promotional price, state the lowest price in the last 30 days before the reduction.
• If you personalize prices algorithmically, inform the consumer in your privacy notice or privacy policy.

Risk of breaching competition rules

Pay attention to two scenarios:

• Risk of distorting competition: if your algorithms give you a significant pricing advantage over smaller companies, this may breach the principles of market pluralism.
• Risk of price-fixing: dynamic pricing may lead to an informal agreement with competitors on prices. Such conduct breaches competition rules and is treated as market manipulation.

This restriction does not arise from the AI Act, but from competition rules, and applies whether or not you use AI.

Marketing consents, chatbots and customer-service automation

AI increasingly serves customers through virtual assistants and chatbots. These tools:

• answer questions about products, shipping and payment methods,
• recommend products,
• remind customers about abandoned carts,
• display ads dynamically, for example through remarketing.

What to check

Some of these activities are forms of direct marketing. Before implementing a chatbot or AI assistant:

• Check whether your existing marketing consents cover the new AI tools. If a chatbot recommends products or sends reminders, you need the user’s consent for this.
• Update the consent clauses if the scope of AI activities goes beyond what the user previously agreed to.

AI system risk categories: what developers and commissioners need to know

The AI Act divides AI systems into risk categories. The category affects which obligations you must meet.

Risk categories

• Unacceptable risk: prohibited systems, including subliminal techniques, social scoring of citizens and discrimination against specified groups. The prohibition has applied since February 2025.
• High risk: systems used, for example, in critical infrastructure or employment. They require a conformity assessment before being placed on the market.
• Minimal or no risk: most AI systems in e-commerce. They have fewer formal obligations, but transparency rules still apply.

Practices prohibited since February 2025

• Using solutions based on subliminal techniques.
• Systems that discriminate against specified groups of people.
• Using AI to assess citizens’ lifestyles, known as social scoring.

Transparency and the prohibition on dark patterns

Transparency duty

The AI Act requires AI system providers to act in a way users can understand. If your online store uses AI to generate product recommendations:

• Tell customers how recommendations are generated.
• Explain which data is used to generate them.
• Make sure the algorithms do not manipulate users.

Dark patterns: manipulative interface techniques

Dark patterns are interface-design techniques that encourage a user to take actions contrary to their intentions. For example, during a purchase a user may select a box without realizing that this signs them up for a newsletter or additional services. This is sometimes called a trick question.

What you need to know:

• With AI, dark patterns can operate at a much more sophisticated level than before.
• Using dark patterns breaches consumer-protection rules.
• Very high penalties may apply.

Liability for damage caused by AI

Who is responsible?

The AI Act identifies two responsible parties:

• The AI system provider is responsible for damage caused by the system’s operation.
• The entity using AI, meaning you as the business operator, are responsible for damage resulting from implementing the system in your business.

Example

Your store uses AI to process returns automatically. The system incorrectly assesses a request and refuses the return. You are responsible for the harm caused to the customer.

What to implement

• Introduce risk-management procedures for the operation of AI.
• Conduct regular checks of the accuracy of decisions made by the system.
• Monitor whether algorithms favor some customer groups over others. This creates a discrimination risk and may also breach competition and consumer-protection rules.

AI as a tool for online transaction security

AI does not only create risks. AI algorithms may protect your customers:

• Analyzing suspicious patterns: identifying unauthorized payment-card transactions.
• Detecting phishing attempts: preventing attempts to persuade users to disclose personal or financial information.
• Monitoring activity on the platform: tracking suspicious activity and blocking fraud in real time.

Investing in AI-based security systems builds user trust and improves customer satisfaction with your store.

Summary: what to do now

AI is changing e-commerce, but you must comply with several legal instruments at once: the AI Act, GDPR, the Omnibus Directive and competition rules.

Your checklist

1. Check that your AI tools do not use subliminal techniques: the prohibition has applied since February 2025.
2. Verify the legal bases for processing data collected by AI systems.
3. Update privacy notices to cover profiling, automated decision-making and price personalization.
4. Review marketing consents to make sure they cover chatbot and AI-assistant activities.
5. Implement risk-management procedures and regular checks of decisions made by AI.
6. Check that dynamic pricing complies with competition rules and the Omnibus Directive.
7. Remove dark patterns from interfaces; high penalties may apply.
8. Plan next steps according to the AI Act implementation schedule for 2025 to 2027.

Before launching a new AI system in sales, make sure it does not propose actions that conflict with applicable rules.

This article is from the e-book “9 Ways to Improve the Sales Process,” published by the Silesian Startup Foundation and Startup Podbeskidzie Foundation. The e-book is available for download here.

Frequently asked questions

Which rules should I check before implementing a new AI tool in e-commerce? Before implementing a new AI tool, check compliance in four areas: the AI Act, including the prohibition on subliminal techniques that has applied since February 2025 and further duties phased in through 2027; the GDPR, including a legal basis for data processing and information duties when profiling; the Omnibus Directive, including price-presentation rules and disclosure of personalized pricing; and competition rules, including the risk of price-fixing and distorted competition with dynamic pricing. Start by checking that your tool does not use subliminal techniques, which have been prohibited since February 2025.

Can AI-based offer personalization be considered prohibited manipulation? Yes. If your AI system dynamically changes the interface, for example the background, colors or music, in real time and without the user’s awareness, you may be using prohibited subliminal techniques. The AI Act has prohibited these practices since February 2025. Responsibility lies not only with the AI provider but also with you as the entity using the tool. Check that personalization in your store relies on visible recommendations rather than subliminal influence over purchase decisions.

What GDPR duties apply when AI profiles customers or makes automated decisions? You have three specific duties: inform users that automated decision-making and profiling take place; give them the right to object to these activities; and enable human intervention in the decision-making process. Before implementing the tool at all, check where the data comes from and whether you have a legal basis to process it. Lack of consent or another legal basis is a separate risk that may call the entire implementation into question.

Can I use dynamic pricing with AI, and what duties do I have toward customers? You may use dynamic pricing, and you must follow two Omnibus Directive requirements: state next to a promotional price the lowest price from the 30 days before the reduction, and, if you personalize prices algorithmically, inform consumers in privacy notices or your privacy policy. Also check that your pricing algorithms do not lead to an informal agreement with competitors or distort market competition. The source describes these competition-law risks as applying independently of the AI Act.

Does an AI chatbot that recommends products or reminds customers about abandoned carts require separate marketing consent? Product recommendations and abandoned-cart reminders are forms of direct marketing. If your existing marketing consents do not cover these activities when performed by a chatbot or AI assistant, you need updated consent from the user. Check the scope of your current consent clauses and update them to cover the specific activities of the new AI tool. Otherwise, you may act without the required basis.