# Flow Legal Disclosures Section: Security & Legal Matters Description: Ask for consent in your flows and in the pre-chat survey, and tell visitors they're talking to a bot. Verified against Tidio panel 12.304.0 Last updated: 2026-11-06 Source: https://help.tidio.com/articles/flow-legal-disclosures/ At Tidio, we actively pay attention to the legal matters concerning chatbots to provide you with the most recent updates and legislation around the topic of Artificial Intelligence (AI). This article explains how to create GDPR-friendly flows and comply with the SB-1001 Bots: disclosure. **In this article, you'll learn:** - [How to create GDPR-friendly flows]() - [What is the Bot Disclosure and Accountability Act, and how to obey it]() ## GDPR-Friendly Flows [Video]() Silent walkthrough. Ask visitors for consent in a flow and add a GDPR consent field to the pre-chat survey. To make some of the workflows compliant with the GDPR laws in Europe, we suggest you add a step to your workflow to ask visitors and future leads for consent. Below, we describe how to do that. A decision action helps us ask for consent. In the flow editor, you can choose from **Decision (Quick Replies)**, **Decision (Buttons)** and **Decision (Card Messages)** - for example, ask "Do you agree to receive our newsletter?" with the answers "Yes, I agree" and "No, thanks": ![The flow editor with a Decision (Quick Replies) action open on the right: the message "Do you agree to receive our newsletter?" and two quick replies, "Yes, I agree" and "No, thanks", each with its own path on the board]() To remember the answer, connect the "Yes, I agree" reply to the **Update contact property** action, and save the visitor's consent in a contact property (for example, a "Newsletter consent" property set to "yes"). From there, we can use the **Based on variable** condition - pick the same contact property - to continue the workflow only when a user gives their consent. ![The flow editor with a Based on variable condition open on the right: a contact property "Newsletter consent" selected and the condition set to "yes"; on the board, the condition follows an Update contact property action on the "Yes, I agree" path]() In this example, the workflow will continue only for users who permitted us. Their answers are saved as their contact properties, which you can see in **Contacts**. ![The chat widget opens a GDPR consent request, the visitor selects "Yes, sure", and the flow continues by asking what they are looking for.]() ![The contacts list is filtered to contacts whose "gdpr\_consent" property is "yes".]() Asking for newsletter consent? Use the **Mailing subscriber** condition first. It filters your visitors by those who are subscribers and those who are not, so you only ask for consent from those who aren't subscribed yet: ![The flow editor with the Mailing subscriber condition on the board, its two paths leading to the end of the flow (subscribed) and to the consent question (not subscribed), and the condition's description open on the right]() Another option to comply with the GDPR is to use the dedicated **GDPR Compliance** field in the **Pre-chat survey**. Head over to **Settings \> Live Chat \> Appearance**, open the **Pre-chat survey** tab in the **Content** section and turn the survey on with its switch. Then click on **Add new** and choose **GDPR Compliance**. You can then edit the consent text, and add a link to your privacy policy: ![Settings \> Live Chat \> Appearance, Content section with the Pre-chat survey tab open: the survey switched on and the Add new menu expanded with Email, Name, Phone number, GDPR Compliance and Department, and the widget preview on the right showing the pre-chat survey]() Learn more about it in our [Pre-chat Survey]() article. ## The Bot Disclosure and Accountability Act On July 1, 2019, the state of California has enacted the [BOT act]() to prevent deceptive practices for commercial and political bots. The law states that it's illegal to mislead the other person to incentivize a purchase or sale of goods or vote in an election. However, It's still unclear whether bots such as Tidio Flows providing technical assistance or solely answering technical questions are subject to the BOT Act. Since the disclosure obligation rests on the person who created the bot/flow, we have prepared the guidelines for complying with the act. The guidelines should be considered by the Tidio users whose bots will interact with another person online in the state of California. #### It's important to distinguish between automation and humans To comply with the act, the person talking to the chatbot needs to be aware the conversation is automated and processed by the chatbot. - We recommend using a sentence such as "Hi\! I'm a bot\!" at the beginning of the flow. - Try not to give your bots a human photo or human name that could mislead the visitor. We will be monitoring the regulations for further updates. ## Further reading - [Privacy Policy and GDPR Compliance]() - [Flow editor: Actions]() - [Flow editor: Conditions]() - [Contact Properties]()