A talking 3D host is an AI system that speaks to the public, so two sets of European rules apply to it: the transparency duties of the EU AI Act and the data protection rules of the GDPR. Neither is hard to meet for a website host, as long as they are built in from the start. This is a practical overview, not legal advice; check the details with your own adviser.
The AI Act: say it's an AI
Article 50 of the AI Act requires that people are informed when they interact with an AI system, unless it is obvious from the context. The duty has applied since 2 August 2026. The 2026 "Digital Omnibus" postponed other parts of the Act, such as the high-risk rules, but not this one (Goodwin, Ropes & Gray).
A realistic 3D character that greets visitors by voice is exactly the case the rule has in mind. In practice:
- Say it at the start. Her first line can do it naturally: "Hi, I'm Riya, a virtual assistant for the studio."
- Show it on screen too: a short label such as "AI assistant" next to her name or near the chat input, visible before the visitor speaks.
- Don't let her claim to be human, even if asked. Write it into her rules.
- Keep it in kiosk mode. A host on a lobby screen needs the same notice, on the screen itself.
The same Article also covers AI-generated images, audio and video shown to the public. A live conversation with a clearly labelled assistant is the simple case; if you also publish generated videos of your host, label those as AI-generated too.
GDPR: what she hears and remembers
A host processes personal data the moment a visitor speaks or types: their voice, their words, sometimes their name, email or phone number when they ask to be contacted. The usual GDPR principles apply, and a few choices make them easy to meet.
Collect only what the conversation needs. A host that answers questions needs the question, not the visitor's identity. Ask for contact details only when the visitor wants a callback or a booking, and say what they will be used for.
Decide what is kept, and for how long. Typical choices:
| Data | Common choice |
|---|---|
| Voice recordings | Turned into text and deleted straight away; not stored |
| Conversation text | Kept for a short, fixed period to improve answers and report to you, then deleted or anonymised |
| Contact details from a lead | Sent to your inbox or CRM, then handled like any other enquiry |
| Visitor memory ("welcome back") | Only with a clear notice, stored on the visitor's device or for a limited time |
Put a data processing agreement in place with whoever runs the host for you, and list the AI and voice providers it relies on, with where they process data.
Update your privacy notice: that an AI assistant is on the site, what it processes, why, how long it is kept, and how visitors can ask for deletion.
Cookies are a separate question. The host itself doesn't need advertising cookies. If your site uses ad tracking around it, that still needs the visitor's consent as usual.
Rules for what she says
The AI Act's transparency duty is about who is talking. Consumer and sector rules still apply to what is said, exactly as they would for a person on your front desk:
- Prices and offers must match your published ones. Her answers should come only from your own information, and she should say when she doesn't know.
- Health and medical topics: a clinic host explains treatments as the clinic describes them and books a consultation; she doesn't give personal medical advice. See our page on AI receptionists for clinics.
- Financial or legal topics: keep her to general information and hand over to a person.
A pre-launch checklist
- Her first sentence says she is an AI assistant, and a label on screen says it too.
- Her rules forbid claiming to be human and inventing prices or promises.
- The privacy notice mentions the assistant, what it processes and the retention periods.
- A data processing agreement is signed with the provider.
- Voice recordings aren't stored unless you have a reason and a notice for it.
- Contact details are collected only when the visitor asks to be contacted.
- Someone on your team reads a sample of conversations each month.
Lobbyface hosts are built this way by default: a disclosure line and label, answers limited to your information, and short retention. If you're weighing an avatar against a simpler chat, see AI avatar vs chatbot.