A chatbot on a freight website should answer the questions whose answers are already written down, and hand off everything that commits the company. The second list is shorter than the first and far more important.
Key takeaways
A chatbot is useful on a logistics site in exactly one situation: when the answer already exists in writing, is stable, and is not a commitment. Terminal addresses and hours, equipment types and capacity, service area, what documents you need before a pickup, where to find a proof of delivery, how to open a claim, who to call for a specific lane. Those questions arrive constantly, they have fixed answers, and every one the bot handles is a call your dispatcher does not take.
Everything that commits the company goes to a person. Not because the technology cannot produce a sentence, but because a sentence from your website is your sentence.
The Office of the Privacy Commissioner is explicit in its principles for responsible, trustworthy and privacy-protective generative AI technologies: where a generative AI tool is public-facing, organisations should ensure that individuals interacting with it are aware they are interacting with a generative AI tool, and are informed about privacy risks and available mitigations — such as not entering personal information into a prompt unless necessary.
The same guidance states the accountability position in one line worth putting in your internal policy: accountability for decisions rests with the organisation, and not with any kind of automated system used to support the decision-making process. If the bot says something wrong, it is the carrier that said it.
A chat transcript is personal information the moment it contains a name, an email address or enough detail to identify someone. Schedule 1 to PIPEDA requires that the amount and type of personal information collected be limited to what is necessary for the identified purposes, that safeguards appropriate to the sensitivity of the information protect it against unauthorized access, and that the organisation be open about its policies and practices.
Practically: do not ask for a phone number in order to answer “what time does the Brampton terminal close?”. Decide a retention period for transcripts and enforce it. Say in the privacy notice that a chat assistant is in use, what it records and for how long. Treadstone Law’s privacy policy checklist for business websites covers the notice itself, and whether PIPEDA applies to your business covers the threshold question.
Capturing an email address is not the risk. Using it is. Section 6 of Canada’s anti-spam legislation prohibits sending a commercial electronic message without consent, express or implied. Two exceptions commonly apply to a freight site: subsection 6(5) puts outside the section a message sent to a person engaged in a commercial activity that consists solely of an inquiry or application related to that activity, and subsection 6(6) removes the consent requirement where the message solely provides a requested quote or estimate, or solely facilitates or confirms a transaction the recipient already agreed to.
Neither covers a monthly capacity newsletter to everyone who ever opened a chat window. For that you need consent, and the difference between implied and express consent is where most small operators get it wrong. The maximum administrative monetary penalty under the Act is $10,000,000 for a person other than an individual, and unsubscribe requests must be given effect within 10 business days under section 11.
Worked example: “can you take a load of paint tomorrow?”
A 3PL turns on a chatbot fed from its website content. In the first week it fields a genuinely useful volume of terminal-hours and document questions.
Then a prospect asks whether it can move a load of paint from Guelph to Sudbury tomorrow. The website says the company handles general freight in Ontario, so the bot answers yes.
Paint is frequently a dangerous good. Whether that shipment can move depends on the UN number, the packing group, the quantity, whether the driver holds a valid training certificate, and what safety marks and shipping document the load requires. None of that is on the website, and the regulations put a trained, certificated person behind the act of offering it for transport.
The correct behaviour is not a longer answer. It is a refusal with a next step: collect the UN number and quantity, say that dangerous goods are reviewed by a person, and route the conversation to the compliance contact with everything the prospect has already typed.
The Privacy Commissioner’s principles say that where a generative AI tool is public-facing, individuals interacting with it should be made aware they are interacting with a generative AI tool and informed of privacy risks and mitigations.
It can retrieve a number. Whether it should publish one to a prospect is a different question: a price stated to the public is a representation, and section 74.01 of the Competition Act applies to representations made by any means whatever. Route pricing to a person.
The minimum needed to answer or to route — and no more. PIPEDA’s limiting collection principle requires the amount and type of information collected to be limited to what is necessary for the identified purposes.
The organisation. The Privacy Commissioner’s guidance puts accountability for decisions with the organisation rather than with any automated system supporting them, and a misleading representation is attributed to the business that published it.
We help Canadian carriers and 3PLs scope a website assistant that deflects real volume without ever committing the company.
