How to Write a Privacy Notice in the Age of AI
The rapid spread of AI-supported systems in customer segmentation, risk scoring, pricing, fraud detection, content recommendations and marketing automation has made conventional privacy notices…
⏱️ Reading time: 14 min · 📁 Category: KVKK, Artificial Intelligence & duty to inform
How to Write a Privacy Notice in the Age of AI
The rapid spread of AI-supported systems in customer segmentation, risk scoring, pricing,
fraud detection, content recommendations and marketing automation
has made conventional privacy notices inadequate.
As of 2025, the KVKK Board and European data protection authorities assess
the duty to inform in AI-supported processing against a high transparency standard
.
This makes separate, detailed privacy notices necessary for systems involving automated decision-making and profiling in particular
.
"If artificial intelligence is used, the person concerned should be able to understand how and for what purpose it is used." Why are conventional privacy notices inadequate?
Traditional privacy notice often include:
- Includes abstract phrases such as "Your data is processed"
- It does not explain automation and algorithmic processes
- It does not explicitly specify profiling
- It does not explain whether decisions involve human intervention
Whereas in 2025 audit practice, the Board expects a clear answer to the following questions:
- Is artificial intelligence being used?
- What data enters the model?
- Is profiling carried out?
- Is the decision automated, and is there human approval?
- What is the impact of this decision on the person?
Uncertain expressions such as "algorithmic systems", "automation" or "analysis" are not enough.
The privacy notice must state clearly that AI-based systems are used.
Profiling is automatic assessment of a person's behavior, preferences, or level of risk.
This activity must be explained under a separate heading.
If the AI system:
- sets the price,
- rejects or approves an application,
- decides whether to display a campaign,
The possible consequences of this on the person concerned should be clearly stated.
"Automatic decision making" cannot be hidden.If this is not specified, the duty to inform is considered to have been breached. Sample privacy notice covering AI, automated decisions and profiling Example — Privacy notice for AI-supported processing (draft)
This privacy notice has been prepared by [Company Name], as data controller,
under Article 10 of Personal Data Protection Law No. 6698.
Your identity, contact, transaction-security, behavioural and digital-interaction data
are processed to improve customer experience, assess risks and provide personalised services and campaigns using
AI-supported systems and algorithmic analysis tools.
In this context, your personal data are used
to carry out activities based on your usage habits, preferences and transaction history:
profiling is carried out, and
Content, offers or services offered to you in accordance with these profiles are determined.
In certain cases, through said AI systems
Automatic decision-making processes can be operated,
these decisions may affect campaign eligibility, risk level or service prioritisation.
Automated decision-making processes, if they are qualified to have legal consequences on the person concerned or to have similarly significant effects,
These decisions are open to human intervention,
As the person concerned, you have the right to object to these decisions, request human intervention, and submit opinions.
Your personal data may, solely for the purposes above,
be shared to meet legal obligations and with the technology providers whose services we use.
Your data is stored for as long as it is stipulated in the relevant legislation or required for the purpose of processing.
Under Article 11 of the KVKK;
You can contact us via [communication channel] to exercise your rights to your personal data.
- Hiding AI usage with general statements
- Not specifying profiling activity
- Not explaining the effect of automatic decision making
- Using ambiguous phrases such as "not completely automated"
- Leaving relevant person rights theoretical
"The person concerned has not been reasonably informed of the use of artificial intelligence." What should organisations do as 2026 approaches?
- Assess privacy notices separately for every process that uses AI
- Operations involving profiling must be clearly stated in inventory
- If there is automatic decision-making, the mechanism of human intervention must be established
- privacy notice - data inventory - Consent text consistency must be ensured
- Contracts with AI providers must include a transparency obligation
have become a means of defence that reduces legal risks. Conclusion
AI-supported data processing
cannot be managed with conventional privacy notices.
In processes involving AI, automated decisions and profiling,
As the level of transparency increases, legal risk decreases.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.