Chatbots, legal aspects to take into account

Do you want to carry out a bank transaction without leaving home? Do you want to buy some sneakers without having to go to the department store? Do you want to reserve accommodation for your next vacation from your computer?

All this sounds very common and this is due to the evolution of electronic commerce. As consumers we have endless possibilities to satisfy our needs with a single click and from the comfort of our sofa.

The digital transformation is a reality, the creation of a digital channel and the opening towards electronic commerce force companies to adapt to these new rules of business survival.

In the relationship business to consumer (B2C) chatbots appear, which replace human interaction with customers, to retain the consumer with the brand and above all, to lower costs and time in the sale of a product.

There is no doubt that chatbots are one of the technological advances that generate the most interest in the industry. The advantage of interacting with a chatbot as if you were communicating with a family member or friend, brings greater opportunities for companies. This advantage is accentuated when the channel used to maintain this automatic conversation between business to consumer it is the same that the consumer uses in their social relationships.

«Let's think that we will be able to send messages to businesses in the same way that you send a message to a friend, you will receive a quick response and it should not take your full attention as a phone call would and neither, you should have to install an app"

Mark Zuckerberg, 2016 at the Facebook Developer Conference.

In 2017, chatbots became a ¨trending topic¨ within the framework of the digital transformation of companies. The Gartner consulting firm estimated that by 2020, more than 85% of the call centers will be operated by chatbots. Deriving a radical change in our customs as a society, especially in the way we communicate and in which we consume.

We can define the chatbot as a software based on artificial intelligence capable of holding a conversation with a human being using natural language. To make this possible, the algorithms of its programming are fed with information that the software receives and the responses of the software are increased while interacting with the consumer, humanizing in this way to the bot.

In Peru, many companies have used this type of technology. One of the first chatbots to be implemented in the financial market was Arturito Banco de Crédito del Perú, in the retail sector Falabella has implemented Amanda and in the legal sector, the international law firm Ontier has made available to Aretha.

Legal implications in chatbots

Behind the commercial advantages that the use of this type of technology brings, there is a legal background to take into account. Unlike traditional communication between humans, when using a chatbot one of the intercollectors is software.

Therefore, the incorrect use of this tool can cause unwanted situations that could lead to legal responsibilities. It is important not to ignore this facet of chatbots in order to minimize the inherent risks of their use and in any case, anticipate the risks they may cause.

We will take the opportunity to analyze the most sensitive regulatory areas in the use of this technology:

  1. i) Contractual liability

It must be taken into consideration that chatbots are instruments that act automatically by encoding the information provided to the system and that due to their own characteristics they may have the ability to create legal effects, such as the sale of a product.

Both characteristics can create situations that derive from responsibilities of all kinds. Let's imagine that the chatbot answers a series of questions in the wrong way to a user and that said user makes harmful decisions based on them. Or in any case, situations in which the ability to understand the chatbot was not clear and it was understood that the user wishes to enter into a contract with certain terms, perfecting it without the express consent of the user.

This is why it must be taken into account that chatbots are automatic tools where there is a foreseeable margin of error and that is why the consumer's rights must always be protected, as it would happen in the case that they were dealing with natural persons representing a company.

In this contractual relationship, it is extremely important that the consumer has accepted some terms and Conditions of use of the chatbot so that the scope of the use of this type of technology is clearly established.

The stipulations that the chatbot terms and conditions must contain are the following:

  • Detail the scope of the chatbot,
  • Make it clear that the communication is with a bot and not with a human,
  • The means by which the consumer can receive information,
  • Scope of personal data protection, and
  • Responsibilities of the company and the user.

It is recommended that the user accept the terms and conditions before starting the interaction between the bot and the consumer, in order to avoid any type of legal liability other than that agreed between the parties.

  1. ii) Consumer protection

In 2016, Tay, Microsoft's chatbot was deactivated one day after its launch for issuing scratchy and xenophobic comments and insults. The big bet of the technology giant ended up becoming a failure.

Consumers have the right to receive fair and equitable treatment in any commercial relationship, whether with a bot or between humans, without being discriminated against.

Chatbots, being an alternative channel to traditional channels, do not limit their responsibility for their operation. In fact, the information provided by this type of technology is transmitted in the name and on behalf of the company.

This can be verified with the concurrence of the elements of a consumer relationship in an interaction between a chatbot and a consumer, in accordance with the provisions of the Consumer Protection Code: a consumer, supplier and producer or service subject to commercial transaction.

This is why the Consumer Protection Code is applicable to transactions carried out by the chatbot and thus, the user is legally protected, since the company representing the management and use of the chatbot could incur an administrative infraction regarding the conversation via chat that you have with the consumer.

1.iii) Privacy Policy

Chatbots store all kinds of information, including personal information. Most of the companies that have this type of technology use this information collected as part of their sales strategies.

User information is a raw material that many companies transform into products. In fact, the value of data has been increasing in the last decade.

«Large technology companies uncovered the potential value of the data. With that germ, we saw that it is the oil of the XNUMXst century »

Antonio Camacho, founder and CEO of Hocelot.

Now, the collection of personal data entails the creation of a personal data bank and this generates a series of obligations for the company, in accordance with the Personal Data Protection Law - Law 29733.

First of all, for the treatment of information, the user must know the conditions of the own treatment of their personal data, giving their prior, informed, express and unequivocal consent. This consent for the collection of information must be prior to the interaction with the chatbot.

As we discussed in the terms and Conditions A personal data protection clause must be included that contains at least the following information:

  • Information about the owner of the personal data bank,
  • Purpose of the data processing,
  • Determine if there will be a cross-border flow of data,
  • Database where they will be stored,
  • Conservation time, and
  • Possibility of exercising your rights of access, rectification, cancellation or opposition.

In any case, a Privacy Policy to deepen the points mentioned.

Additionally, Directorial Resolution 019-2013-JUS / DGPDP approved the Information Security Director which is intended to facilitate and guide the owners of personal data banks on the measures to be implemented in the company.

  1. Technical security measures:
  • Management and use of passwords when the treatment is carried out with computerized means.
  • Review and record of access privileges.
  • Authorization for the withdrawal or transfer of personal data.
  • Elimination of information contained in removable computer media.
  • Security in the copying or reproduction of documents.

2. Organizational security measures:

  • Develop an organizational structure with roles and responsibilities according to the proportionality of the data to be protected.
  • Documented commitment to respect the principles of the law.
  • Periodically review the effectiveness of the security measures adopted and registered.
  • Develop a procedure for managing incidents, assigning privileges, creating awareness and training, processing personal data, and auditing the security measures used.

3. Legal security measures:

  • Maintain the consent forms for the processing of personal data.
  • Adequacy of the personnel contracts with the treatment of personal data.
  • Adequacy of contracts with third parties.


We are not strangers to the revolution that chatbos have had in recent years, in fact, in the national market it is very common to find this type of technology applied to electronic commerce.

Companies have the obligation to adequately manage consumer expectations, without neglecting the legal responsibilities generated by the implementation of this type of technology.

Capturing leads, hiring chatbot providers, cross-border flow of personal data, among other points, are the new challenges and new areas of expertise that chatbots bring.

The digital strategy of the company that decides to implement this type of technology, in addition to complying with all technical requirements, must have a legal vision that allows correct strategic planning, exploiting all the potential of chatbots in the market, without affecting the users.

The consumer society evolves and the law must not lose its rhythm.

* The opinions expressed in this article are those of the author and do not necessarily reflect the views of the administrators of The Crypto Legal blog or the Lawgic Tec association.

- Advertising Notice-
Eduardo Linares placeholder image
Eduardo Linares is a lawyer from the University of Lima, candidate for the Master of Laws (LLM) by IE Law School and has specialized studies in topics related to Personal Data Protection, New Technologies and Startups. Currently, he is prominent as an international lawyer in the Digital Law area of ​​the international firm Ontier in Madrid. He has been General Director of Athina Magazine, and is currently an extraordinary member of the Athina Iuris Civil Association.


1,914Happy fans


*All fields are required
es Spanish