Answer of the Week · CW41
Why Maria no longer requires consent
CW41 · 2026 · Frag-Maria™ at frag-maria.ai
Until recently, every conversation with Maria began with a hurdle: "By clicking Yes, you confirm our privacy policy. Do you agree?" That sounded secure. Our data protection expert Marc Pastuska from our network showed us why this is exactly the wrong approach. As a result, we have reset Maria across all agents. Here is the first conversation after the change.
0 clicks
until the first question. Instead of asking for consent, Maria displays a clear notice: You are chatting with an AI, with links to our privacy policy and AI transparency. Then, you can start immediately.
The new opening
M
Hello, I am Maria 😊 the digital AI assistant from Frag-Maria.
You are chatting with an artificial intelligence, not a human.
Before we start, please note our information on data protection and AI usage:
➡️
Privacy Policy➡️
AI Transparency & Data ProtectionPlease do not enter any sensitive data in the chat, such as health or payment information.
How can I help you today?
Round 1 · Handover to the expert
M
I will quickly bring in our security and compliance expert for you.
M
Regarding server locations, I can tell you the following:
- Frag-Maria runs on EU/EEA-compliant data centers with enterprise-grade security (24/7 monitoring, multi-AZ, disaster recovery).
-
Data Processing Agreements (DPA) are in place with all sub-processors.
-
Swiss data localization can be configured upon request.
For binding details regarding recipients and exact storage locations, please refer to our:
➡️
Privacy Policy
M
Yes, Frag-Maria is GDPR-ready — this was considered from the very beginning, not added as an afterthought. […]
Important to note: You should always coordinate the specific implementation in your own company with a data protection officer — I can show you how Frag-Maria is set up technically, but I cannot provide legal assurances for your company.
Round 2 · The desire to speak to a human
K
i want to speak to a human
M
I would be happy to put you in touch with our team. Simply choose the option that works for you:
➡️
Contact form➡️
Schedule a personal appointment➡️
Email the teamCan I help you with anything else in the meantime?
Round 3 · The most honest answer of the day
M
Yes, certainly:
+41 41 539 13 73However, Maria will answer there as an AI voice assistant — not a human directly. If you would prefer to guarantee that you speak to a person, I recommend one of the other options:
➡️
Contact form➡️
Schedule a personal appointment
M
You're welcome! If you have any further questions about security, GDPR, or compliance, I'm here. Have a great day! 👋
What is actually happening here
At first glance, it's an unspectacular chat. That is exactly the point. The visitor didn't have to confirm anything, click anything, or leave an email address. Despite this, they knew exactly where they stood from the very first second.
The trigger was a piece of practical advice: A privacy policy is not a contract, but a piece of information. Asking users to confirm it with a "Yes" treats it like a contract. It seems thorough, but it creates no additional security and costs us conversations because many visitors drop off at exactly that point.
Before
"By clicking
Yes, you confirm our privacy policy. Do you agree?" No "Yes," no conversation. Upon escalation: capture name and email in the chat.
After
Clear AI notice plus links to privacy policy and AI transparency. The conversation starts immediately. Upon escalation: direct contact methods instead of data collection in the chat.
Four rules that now apply to all agents
01
Notice instead of consent
Privacy policy and AI usage are linked, not requested.
02
Clearly recognizable as AI
"Digital AI assistant," mentioned in the very first sentence and every follow-up.
03
No contact data in the chat
Maria does not ask for names, emails, or phone numbers.
04
A human is one click away
Contact form, appointment, or email, directly from the chat.
The strongest moment in the chat is the phone number. Maria provides it and says in the same breath: "However, Maria will answer there — not a human." Transparency is not a mandatory exercise at the beginning. It runs through every answer.
And what if someone types their email anyway?
Maria will not repeat it, will not store it in a ticket, and politely refers to the contact channels: "Thank you! To ensure our team reaches you securely, please use one of these methods directly." Personal data ends up where it belongs, not in the chat history.
What this means for SMEs
Many chatbots in German-speaking countries still start today with a consent pop-up. Well-intentioned, often well-sold, but rarely well-thought-out. Since the labeling obligations of the EU AI Act have come into effect, the question is no longer whether an AI should identify itself. The question is how well it does so without slowing the visitor down.
Drop-offs at chat entry Consent that is not consent Contact data in chat history AI that sounds like a human Unclear paths to the team
A notice that informs is worth more than consent that slows down. Trust is not built with a click. It is built through clarity in every answer.
How does the chat start on your website? Let's take a look together in 30 minutes.
Book initial consultation
Share:
AI Superevent 2026
Maria & Selina