Explicit user consent before AI processing

Sending user data to a third-party AI provider without consent violates GDPR Article 6 (lawful basis for processing) and Article 7 (conditions for consent). Under CCPA §1798.100, consumers have the right to know how their data is used. When an AI API call fires unconditionally on every user message, you are processing personal data without a documented lawful basis — exposing the business to regulatory enforcement, fines up to 4% of global annual revenue under GDPR, and user trust collapse if discovered. OWASP A01 (Broken Access Control) classification applies when the missing gate allows any session to trigger AI processing regardless of consent state.

Add a server-side consent check before every AI API call — client-side guards alone are bypassable. Gate on a flag stored in the user record or session, not a query parameter.

// app/api/chat/route.ts
export async function POST(req: Request) {
  const session = await getServerSession()
  if (!session?.user?.aiConsentGranted) {
    return Response.json(
      { error: 'AI features require consent. Enable them in Settings.' },
      { status: 403 }
    )
  }
  // proceed with AI call
}

Store the consent flag with a consented_at timestamp on the user record. Present AI-specific terms separately from your general ToS so the consent is specific to AI processing, as GDPR Art. 7 requires. Verify by revoking the flag for a test user and confirming the endpoint returns 403.