● Draft – legal and case law references not yet verified
Summary
Emotional AI includes companions, affective chatbots and interfaces that adapt to users’ apparent feelings. These systems raise questions about whether users can meaningfully consent when personalised interactions also shape their preferences and decisions. The use case examines how GDPR consent requirements and EU AI Act safeguards address—and leave gaps around—subtle emotional influence.
The Problem
Agreeing to personal-data processing does not necessarily mean understanding or accepting a system’s persuasive influence. The core tension is how to distinguish supportive personalisation from manipulation, particularly when emotional attachment or vulnerability weakens users’ ability to refuse or disengage.
Emotion-responsive interactions should support users’ own goals rather than covertly redirect decisions toward commercial or other external objectives. Users need practical ways to disable personalisation or leave without emotional pressure.
Consent should distinguish between operating a chatbot, analysing emotional signals and using those signals to personalise influence. Emotional attachment must not become a mechanism for securing or retaining agreement.
Users should understand that they are interacting with AI, what emotional signals it processes and why its responses adapt. Disclosure should not imply that inferred emotions are reliable facts or that simulated empathy represents genuine feelings.
Design and evaluation should address foreseeable risks such as emotional dependency, distress and exploitation of vulnerability. Safeguards should account for how repeated interactions can create harms that are not apparent in a single exchange.
Where consent is the lawful basis for processing personal data, it must be freely given, specific, informed and unambiguous, and withdrawal must be as easy as giving consent.
Processing personal data to infer or respond to emotions must meet fairness, transparency, purpose-limitation and data-minimisation requirements, including clear information about processing purposes.
Emotional influence may fall within prohibitions on manipulative or deceptive techniques or exploitation of specified vulnerabilities when the statutory conditions, including significant-harm thresholds, are met; emotional persuasion is not categorically prohibited.
Article 50 sets disclosure duties for direct AI interaction and qualifying emotion-recognition systems, but the latter category requires biometric-data-based inference and does not automatically encompass text-only sentiment analysis.
Italian Data Protection Authority (Garante) · Provision of 2 February 2023 · 2023
The intervention directly addresses emotional companion chatbots, highlighting safeguards for minors and emotionally vulnerable users beyond merely obtaining agreement to data processing.
Key Takeaways
Separate consent to data processing from permission for optional emotion-based personalisation.
Provide clear AI disclosures and simple controls to disable emotional adaptation or disengage.
Test repeated interactions for dependency, covert steering and exploitation of vulnerability.
Assess GDPR duties and AI Act scope separately; consent and disclosure do not by themselves establish that influence is acceptable.