There is no rule against it — but CREA’s AI standard and ordinary privacy law both still apply to whatever the chatbot says and collects.
Short answer
Yes, subject to the same standard CREA has now set for any AI tool a REALTOR® uses: “transparency, accuracy and accountability.” CREA’s AI guidance does not create a special chatbot rule — it treats a chatbot as one more AI tool an agent remains fully accountable for, and whatever information it collects from a visitor is still governed by the ordinary privacy rules that apply to any lead-capture form.
“The adoption of AI does not alleviate the professional responsibilities of REALTORS®. REALTORS® must remain fully accountable for the information, advice and services they provide to clients,” per CREA’s AI guidance page, which names REALTOR® Code Articles 13 (Advertising: Content and Accuracy) and 15 (Advertising Claims) as remaining fully applicable to AI-generated content. A chatbot that answers a visitor’s question about pricing, timelines or process is making a representation on the agent’s behalf, and the agent owns whatever it says.
A chatbot that asks for a name, phone number, email or property address is collecting personal information the same as any web form, which means the ordinary PIPEDA disclosures apply: what is being collected, the purpose for collecting it (a privacy policy has to name the purpose, the way a treadstonelaw checklist names “running a newsletter” as a worked example of a disclosable purpose), who it is shared with, whether it leaves Canada, how long it is kept, and how someone withdraws consent — privacy policy checklist for Ontario business websites. No separate double opt-in requirement exists on top of ordinary consent, but consent still has to exist before the lead is added to a marketing list.
Nothing found at either the CREA or federal level makes disclosing “this is an automated chat” a hard legal requirement the way visitor ID is not required at an open house — but CREA frames disclosure of AI involvement as prudent, and pairing that disclosure with a visible link to what the tool does with a visitor’s information covers both the transparency standard and the privacy-policy obligation in one line of text.
See also: is there a business relationship exemption and should you ask visitors for ID.
A 30-minute call is enough to see where your compliance and follow-up practices would hold up.
