AI product recommendations and transparency: what ecommerce stores must disclose

Personalized product recommendations drive 35% of Amazon's revenue according to McKinsey research. Every major ecommerce platform now offers AI recommendation engines: Shopify has its own, third-party tools like Nosto, Bloomreach, Constructor and Algolia are widely deployed and platforms like Klaviyo use behavioral data to personalize email product blocks. Most customers do not know their product feed is personalized to them specifically. New regulations require that they do.

The EU AI Act and the Digital Services Act together create disclosure obligations for ecommerce stores that use AI-driven recommendation systems. These obligations are not complex, but they require deliberate action to implement and the majority of stores deploying recommendation engines have not addressed them.

What counts as an AI recommendation system

The EU AI Act defines an AI system as a machine-based system that can generate outputs such as predictions, content, recommendations or decisions for a given set of objectives. Each AI system is assigned a risk category under the AI Act that determines the level of compliance required. A product recommendation engine that analyzes browsing history, purchase patterns and similar-customer behavior to generate a personalized product list is squarely within this definition.

The relevant question is whether the recommendation is personalized to the individual based on profiling or behavioral data. A "bestsellers" list ranked by total sales volume is not personalized. A "recommended for you" section that shows different products to different customers based on their individual profiles is personalized and triggers disclosure requirements.

Systems that qualify as AI recommendation systems in ecommerce:

• Personalized "You may also like" sections on product pages, based on individual browsing history
• Homepage product feeds personalized to returning customers based on past purchases
• Search results ranked or filtered using AI personalization based on user profiles
• Email product recommendation blocks populated by AI based on purchase and browsing history
• AI-driven cross-sell and upsell suggestions in cart and checkout
• Size, fit or style recommendations generated by AI based on user-provided or inferred data

Systems that are not AI recommendation systems for these purposes: rule-based product bundles configured manually, "frequently bought together" based purely on aggregate transaction data (without individual profiling) and manually curated "featured products" sections.

EU AI Act transparency requirements for recommendation systems

The EU AI Act's transparency obligations for recommendation systems flow primarily from Article 50, which covers AI systems that generate synthetic content and systems that interact with users, and from the Act's general transparency principles in Article 13.

For ecommerce recommendation systems classified as limited-risk AI, the primary obligation is ensuring users are not deceived about the AI nature of the recommendations and that the recommendation system's existence and basic functioning is disclosed. This means:

• Customers should be able to tell that product recommendations are personalized to them specifically, not randomly selected.
• The fact that an AI system is generating recommendations should be disclosed, ideally at the point of the recommendation itself.
• Customers should be informed in the privacy policy or a dedicated AI disclosure that recommendation systems use their personal data.

DSA requirements for recommender systems

The Digital Services Act, applicable since February 2024, creates more specific requirements for recommender systems used by "very large online platforms" (VLOPs) with 45 million or more average monthly users in the EU. Most mid-market ecommerce stores do not reach this threshold.

However, DSA Article 27 establishes principles for recommender system transparency that are broadly instructive even for stores below the VLOP threshold:

• Providers must set out in their terms of service, in plain and intelligible language, the main parameters used in their recommender systems and how those parameters affect what is shown to users.
• For recommender systems that use profiling: providers must offer at least one option not based on profiling.
• Users must be able to easily access, modify or disable the main parameters for recommender systems.

Even for stores below the VLOP threshold, implementing these principles is both good practice and increasingly expected by EU supervisory authorities as part of GDPR transparency obligations. GDPR Article 13 and 14 require disclosure of automated decision-making and profiling at the point of data collection. See our guide on GDPR cookie consent mistakes for related requirements.

What to disclose and where

An effective disclosure strategy for AI product recommendations covers three levels:

• At the recommendation itself. A brief, visible label on personalized sections: "Recommended for you" clearly signals personalization. More explicit: "Personalized recommendations based on your browsing history." This does not need to be lengthy. It needs to be accurate and visible.
• In privacy policy or dedicated AI disclosure. A section describing: what AI recommendation systems are in use, what data they use (browsing history, purchase history, inferred preferences), how recommendations are generated and how customers can opt out of personalization.
• In cookie consent/preference center. If recommendation personalization is enabled by cookies that track browsing behavior, customers should be able to opt out through the consent management interface. Declining analytics or personalization cookies should disable behavioral recommendation personalization.

The "non-profiling" alternative requirement

DSA Article 27(2) requires that VLOPs offer users at least one option for recommender systems not based on profiling. For mid-market ecommerce stores, this principle translates to a practical question: if a customer does not want personalized recommendations, what do they see instead?

Best practice for stores using recommendation engines:

• Implement a non-personalized fallback for users who opt out of profiling. This could be bestsellers in the relevant category, recently added products or editorially curated selections.
• Link the personalization opt-out to cookie consent. Customers who decline analytics cookies should see non-personalized recommendations.
• Provide an explicit "view non-personalized recommendations" option in the customer account preferences area.

This is not currently a strict legal requirement for most ecommerce stores. But implementing it proactively demonstrates good faith to regulators and addresses the increasingly common consumer expectation of control over personalization.

Dark patterns in recommendations

Both the EU AI Act and GDPR prohibit AI systems and data processing that uses manipulative techniques against users' interests. In the context of recommendations, dark patterns to avoid:

• Hidden profiling. Using behavioral data to personalize recommendations without disclosing that profiling is occurring or giving users the ability to opt out.
• Urgency manipulation. AI systems that display "only 2 left" or "10 people viewing this now" without accurate underlying data, designed to manipulate purchase decisions.
• Exploitative personalization. Using inferred sensitive attributes (health conditions, financial distress, life events) to target vulnerable customers with manipulative offers.
• Opaque sorting manipulation. Search results or category pages that appear to be sorted by relevance but are actually sorted to maximize margin or clear slow-moving stock, without disclosure. Similar opacity concerns apply to AI-driven dynamic pricing.

The FTC in the US has also scrutinized dark patterns in recommendations. Its 2022 report on "Bringing Dark Patterns to Light" specifically called out recommendation interfaces that exploit behavioral data to nudge consumers toward higher-priced options without disclosure.

FTC scrutiny of AI-driven recommendations in the US

While the EU has the most developed regulatory framework for AI recommendations, US regulators are increasingly active in this space.

The FTC has taken enforcement actions related to AI-driven targeting and personalization:

• The FTC's 2021 report on algorithmic bias highlighted how recommendation systems can produce discriminatory outcomes based on protected characteristics, even without explicitly encoding those characteristics.
• Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices, applies to AI recommendation systems. Showing customers higher prices based on inferred race or location without disclosure would be deceptive under Section 5.
• The FTC's proposed rules on commercial surveillance practices would require disclosure of profiling and personalization activities. While not yet finalized as of late 2026, the rules indicate the regulatory direction.

Several US states have enacted or proposed AI transparency requirements. California's proposed AI legislation and Colorado's AI Act (passed 2024) require algorithmic impact assessments and transparency for high-risk AI decisions affecting consumers. Recommendation systems in commercial contexts are not currently designated as high-risk under these frameworks, but the trend is toward broader AI transparency requirements.

Consumer trust data

The business case for transparency in AI recommendations is not purely compliance-driven. Consumer research consistently shows that transparency improves trust:

• A 2023 Edelman Trust Barometer survey found that 61% of consumers want brands to be transparent about how they use personal data for personalization.
• Adobe's 2023 consumer survey found that 48% of consumers are more likely to purchase from brands that explain how their recommendations are generated.
• Research published in the Journal of Marketing Technology (2022) found that explicit disclosure of AI recommendation systems increased customer trust scores by 18% compared to undisclosed personalization, with no significant negative effect on conversion rates.

The fear that disclosing AI personalization will reduce conversions is largely unfounded in the research. Customers who understand they are seeing personalized recommendations relevant to their interests are more engaged with those recommendations, not less.

Practical disclosure UI patterns

Effective implementation of recommendation transparency does not require major design changes. Patterns that work:

• Section label with info icon. Label personalized sections "Picked for you" with a small information icon. Clicking the icon reveals a brief explanation: "These recommendations are based on your browsing and purchase history. Manage your preferences." Link to preferences page.
• Hover tooltip. For desktop users, a hover state on the recommendation section triggers a tooltip: "Personalized to your preferences." Simple and unobtrusive.
• Account preference page. A "Personalization" section in account settings where customers can see what data is used for recommendations, opt out of profiling and request deletion of their recommendation profile.
• Privacy policy AI section. A dedicated section in the privacy policy titled "AI and Automated Decision-Making" that describes recommendation systems, the data they use and how to opt out. This section should also cover AI-generated content disclosure requirements. Link to this from the recommendation disclosure.

The goal is not to burden customers with information they did not ask for. The goal is to make it findable for customers who want it, which satisfies transparency requirements and builds trust with privacy-conscious shoppers.

Frequently asked questions

Do ecommerce stores need to disclose AI product recommendations?

Yes. The EU AI Act and GDPR both require disclosure when product recommendations are personalized using AI and individual profiling data. Customers must be informed that recommendations are tailored to them specifically.

Must stores offer non-personalized recommendations?

The Digital Services Act Article 27(2) requires very large online platforms to offer at least one recommendation option not based on profiling. For smaller stores, this is best practice and increasingly expected by regulators.

What counts as an AI recommendation system?

Any system that uses machine learning to generate personalized product suggestions based on individual browsing history, purchase patterns or user profiles qualifies. Static bestseller lists or manually curated selections do not.

Does disclosing personalized recommendations reduce conversions?

Research shows it does not. A 2022 study found that explicit disclosure of AI recommendations increased customer trust by 18% with no significant negative effect on conversion rates.