In-Conversation Consent Pack.
The point-of-collection disclosures that complete the legal chain. Without these, the Privacy Policy is theoretically valid but practically unenforceable, because regulators (especially CNIL, ICO, and the Commission d’accès à l’information) expect just-in-time notice at the moment of data collection.
Consent is captured at three layered surfaces. Each is intentionally redundant: regulators want to see that the user could not reasonably have missed the disclosure. Surface A is always visible. Surface B is non-skippable on session start. Surface C confirms at first message. Together they create an audit trail no regulator can dispute.
May 24, 2026 · v1.2 · Effective for all client deployments after this date.
The Three Surfaces.
Consent is captured at three layered surfaces. Each is intentionally redundant: regulators want to see that the user could not reasonably have missed the disclosure.
Surface A — Persistent Footer Badge.
Always-visible badge in the bottom-right of the Agent interface, on every Host Site where an Agent is deployed.
“Powered by studio-Máté.ai · Conversations are logged and anonymized. Privacy“
Click “Privacy” opens the End-User Privacy Policy in a modal or new tab.
Surface B — First-Message Disclosure (Spoken & Written).
The Agent delivers this disclosure as the second sentence of every new session, both as on-screen text and (for voice-enabled agents) spoken aloud. It is non-skippable; the conversation cannot proceed until the user either continues or closes the interface.
“Before we begin: I’m an AI assistant. Our conversation is recorded, anonymized, and used to improve service. By continuing, you agree to our terms and privacy policy. You can read them at any time using the link below.”
“Avant de commencer : je suis une assistante IA. Notre conversation est enregistrée, anonymisée et utilisée pour améliorer le service. En poursuivant, vous acceptez nos conditions d’utilisation et notre politique de confidentialité. Vous pouvez les consulter à tout moment en utilisant le lien ci-dessous.”
“Antes de comenzar: soy una asistente de IA. Nuestra conversación se graba, se anonimiza y se usa para mejorar el servicio. Al continuar, aceptas nuestros términos y política de privacidad. Puedes consultarlos en cualquier momento usando el enlace de abajo.”
Surface C — First-Send Confirmation.
On the user’s first outbound message of a session, a small inline confirmation appears beneath the chat input:
“By sending this message, you confirm you’ve read our terms and privacy policy.”
The middleware logs (a) timestamp of disclosure delivery, (b) timestamp of first user message, (c) policy version hash. This log is what you produce in a regulator inquiry to prove consent was obtained.
Special Cases.
Surfaces A and C are replaced with a spoken IVR-style disclosure at the start, plus a verbal confirmation: “Say ‘yes’ or press 1 to continue.” The confirmation event is logged.
Where a Host Site declines the footer badge, Surface B must be expanded to include the full subprocessor list and a clearer opt-out path. Counsel should review such deployments individually.
If the Agent detects (via direct statement) that the user is under sixteen (16), it terminates the conversation with: “I’m sorry, I can only help visitors who are at least sixteen years old. Please ask an adult to continue this conversation for you.”
Logging Schema.
Every session must log the following consent record:
- session_id (UUID)
- host_site_id
- agent_id
- consent_version_hash (SHA-256 of the disclosure text shown)
- privacy_policy_version_hash
- terms_version_hash
- disclosure_delivered_at (ISO 8601, UTC)
- first_user_message_at (ISO 8601, UTC)
- locale (e.g., en-US, fr-CA, es-419)
- ip_country (ISO 3166-1 alpha-2)
- opted_out (boolean) — for any user who clicks an opt-out control
Any session without a complete consent record must be excluded from the commercial dataset. Build this filter into the data pipeline before you market the dataset to a third party — not after.
Document URL: studio-mate.ai/legal/consent-pack · See also: · · ·