Marketing, media & customer-facing AI

Regulated uses

• Customer-service and sales chatbots and voice agents
• AI-generated images, video, audio and ad copy
• Deepfakes, voice clones and synthetic spokespeople
• Personalisation, profiling and targeted advertising
• Facial recognition or analytics in stores and venues
• Performance claims about AI products in marketing

Laws by region

Obligations checklist

• ☐Make every chatbot or voice agent say it is AI — up front where the law requires, and always when asked.
• ☐Label AI-generated or manipulated images, video and audio, and keep machine-readable marks (C2PA-style metadata) intact.
• ☐Keep chatbot answers tied to an approved knowledge base, log conversations and offer an easy path to a human.
• ☐Substantiate every claim about what your AI can do before you publish it.
• ☐If you develop generative AI for Californians, publish the AB 2013 training-data summary.
• ☐Tell people when profiling or tracking technology is used and how to opt out (Quebec, GDPR).
• ☐Do not run facial recognition on customers without a lawful basis, testing and safeguards.

Real cases

• Ruling2024 · CA-BC
  Moffatt v. Air Canada — airline liable for its chatbot's wrong answer

  Decision 2024 BCCRT 149 (February 2024). Air Canada was ordered to pay C$812.02 in total: C$650.88 in damages (the fare difference) plus pre-judgment interest and tribunal fees. Small money, but the first widely reported ruling that a company answers for what its customer-facing AI says.

• Ban2023 · US-federal
  FTC v. Rite Aid — five-year ban on facial recognition surveillance

  Settlement announced 19 December 2023. Rite Aid is banned from using facial recognition for surveillance for five years, must delete the images and any models built from them, must notify consumers before enrolling them in any future biometric system, run a comprehensive security programme with independent assessments for 20 years, and have its CEO certify compliance annually.

• Fine2024 · EU
  Italian Garante v. OpenAI — EUR 15 million ChatGPT fine (later annulled on appeal)

  OpenAI appealed, calling the fine disproportionate. The Rome Tribunal suspended the fine in March 2025 and then, in judgment no. 4153/2026 filed 18 March 2026, annulled it, reported as finding that once OpenAI had an Irish establishment the GDPR 'one-stop-shop' made Ireland's DPC the lead authority, so the Garante lacked competence. The substantive findings were not endorsed; the corrective orders and campaign had already been carried out.

• Ruling2026 · CA-federal
  Canadian privacy regulators v. OpenAI — joint findings on ChatGPT training data

  Complaint well-founded. The federal OPC treated it as conditionally resolved on the strength of OpenAI's commitments (filtering tools, clearer notices about accuracy and sources, improved access tools, quarterly reporting); the Quebec, BC and Alberta offices found the consent and retention issues unresolved. No fine was imposed — PIPEDA gives the OPC no penalty powers.