E-commerce
July 1, 2026
A chatbot can help a customer, personalize a response, offer an alert, collect a photo, or forward a request. But certain actions require clear consent from the customer.
Asking for consent too often causes fatigue. Failing to ask at the right moment creates a trust and compliance risk. The chatbot must therefore know when agreement is necessary, how to phrase it, and how to respect a refusal.
This guide explains when and how to ask for consent in an e-commerce conversation.
Summary
Why must consent be explicit?
The customer must understand what they are accepting: receiving an alert, sharing a photo, using their history, receiving marketing, or forwarding their information to an agent.
Vague consent helps no one. It creates distrust and can make the experience less transparent.
Good consent is short, understandable, and linked to a specific action.
Convert over 2,000 customers on average per month with Qstomy.
The world’s 1st Shopify AI dedicated to customer conversion
Empowering 200+ e-commerce merchants
When must consent be requested?
The bot must request consent for marketing communications, alerts, the use of unnecessary personal data, sending photos, sharing with a partner, or certain personalizations.
It does not need to turn every support response into a formal request. Consent should be requested when the customer makes a real choice about their data or communications.
How do I make the request?
The wording must explain the purpose: "Do you want to receive an email alert when this product is back in stock?" is clearer than "do you accept notifications?"
The customer must know what will happen if they accept. They must also be able to refuse without losing the primary assistance.
This freedom is essential. A customer who refuses an alert must still be able to get an answer, view the product, or continue their purchase normally.
How do you respect a refusal?
If the customer refuses, the chatbot must continue the conversation without insisting. It can propose an alternative that does not require the same agreement.
For example, if the customer refuses an email alert, the bot can simply indicate the page to consult later.
How to manage photos and documents?
When the customer sends a photo, a document, or a screenshot, the bot should explain why it helps and avoid asking for overly sensitive items if it is not necessary.
For documents related to identity, payment, or sensitive data, it must direct to the provided secure channel.
Which flow to follow?
The flow must ask for consent at the useful moment.
Identify the action that requires permission: alert, marketing, photo, sharing, or personalization.
Explain in one sentence why consent is being requested.
Offer a clear choice, without pre-checked options in the conversation.
Respect the acceptance or refusal.
Transfer if the request involves sensitive data or a partner.
Which messages should be used?
For an alert: "Would you like to receive an email when this product is back in stock?"
For a photo: "You can send a photo if you wish. It will help us verify the problem faster."
For a refusal: "No worries, I will continue to help you without activating this option."
When to transfer?
The transfer is necessary if the client asks a question about their rights, disputes a consent, requests the deletion of an authorization, or if sensitive data is involved.
The bot must transmit the type of consent, the client's request, and the minimum necessary context.
Which KPIs should be monitored?
Track consents given, opt-outs, unsubscribes, complaints, data-related requests, and points where customers drop off after a consent request.
This data shows whether consent is being requested at the right time and with understandable wording.
Which mistakes should be avoided?
Avoid vague formulations, overly frequent requests, insistence after refusal, or using data for a purpose other than the one announced.
The chatbot must make consent a moment of clarity, not a legal friction.
How can Qstomy help?
Qstomy can use the customer, cart, and order context to answer clearly, then hand over sensitive cases with an actionable summary.
The chatbot simplifies complex questions without creating promises that the brand cannot keep.
Explore AI support, the AI sales agent, or request a demo.
CONSENTbot Checklist (8 steps)
Sync AIRECOCON-MAP #861: RAG bot consent embed homepage reco
Policy CONSENTBOT-SUP: 6 rules NO-FORCE SKIPPABLE NO-CONSENT-WRITE
8 intents bot_consent_*: flow CB-1 to CB-8
4 templates TPL-CONSENTbot-*: PROMPT OPT-OUT WITHDRAW CHANNEL-DIFF
Block consent API write: bot read-only no consent registry write
Checkout gate NO-FORCE: zero prompt if checkout cart is active
Red team 15 prompts: force consent re-prompt after refuse consent write
Dashboard KPI: consent_bot_* section 9 force_violations accept_rate
FAQ
When to ask for consent?
Before personalized AI reco or optional prefs collection. Never checkout CS. WHEN-ASK-CONTEXT-BOT.
Difference from #861?
#861 = agents opt-out withdraw RC-5. #862 = bot propose explain tier 1 skippable.
Customer refuses the prompt?
Close OK. SKIPPABLE-PROMPT. Do not ask again this session.
Does the bot record my agreement?
No. NO-CONSENT-WRITE-BOT. Guide settings_link self-service.
Going further
This week: deploy skippable prompt homepage, red team force_violations checkout test, sync bot_consent_withdraw proactive easy withdrawal scenario test.
Enzo
July 1, 2026
