GEO courseModule 8 of 10: Accurate and Above BoardLesson 8.5
Client Data, Staff AI Use, Copyright and Your Accounts
The risks inside your own agency: what staff paste into AI tools, AI note-takers on calls, chatbots that speak for you, who owns the photos and floorplans, who's responsible for what AI says, and who holds the keys to the accounts AI relies on to find you.
Why it matters
A negotiator pasting a landlord's email into a free AI tool, or a Business Profile owned by an ex-employee's personal email, are risks most agencies don't know they have.
The evidence
Evidence: Official guidance
UK GDPR and ICO material for data protection; the government's copyright report. No study shows staff policies change AI visibility: the case rests on risk.
Do this first
List every account (Business Profile, Search Console, Bing, domain, hosting, website, social) with its owner, and flag personal emails and leavers.
01What it is
The keys to your shop. You want a list of who has one, you take it back when someone leaves, and you don’t leave a spare under the mat.
Think of it like
Handing your clients' files to a helpful stranger to photocopy. Even if they're helpful, you need to know who they are and what they do with the copies.
02Why it matters
To the people searching
Clients trust you with addresses, finances and tenancy details. They expect them kept private, they may not know they're talking to an AI, and they expect to reach the real agency, not a fake profile using your name.
buyers
May be recorded, or talk to AI without knowing it.
tenants
Share personal and financial details that must be protected.
sellers
Trust you with sensitive details and expect them kept private.
landlords
Share financial and property details, and expect to reach the real agency.
To Google, Bing and AI
Evidence: Official guidanceUK GDPR applies to personal data about identifiable people whatever tool you use. The ICO publishes a record of its own chatbot (tells users it's AI, needs no personal data, hands over to a human, reviews its content quarterly): a good model, not a legal template. On responsibility: your website, listings, feeds and chatbot are your statements. A Canadian tribunal held Air Canada responsible for its chatbot's wrong answer in 2024, which isn't UK law but shows the direction. On copyright: the UK government's March 2026 report on copyright and AI changed nothing and chose no option, so there's no legal opt-out from AI training, and robots.txt is a request, not a legal shield. Agents often don't own their listing photos or floorplans.
An agent example
A lettings branch finds its Business Profile is owned by a former negotiator's personal email, so it can't update the branch's new hours. It adds the manager as owner, turns on two-step verification, writes a one-page AI policy, and bans AI note-takers on calls without the other person's agreement. A month later a negotiator asks to use AI to tidy a reply to a landlord in arrears; under the new policy, she uses an anonymised version in an approved tool.
03Your turn
Check yours, then fix it
- 1List Business Profile, Search Console, Bing Webmaster Tools, Analytics, domain registrar, hosting, website admin, review platforms and social accounts.
- 2For each: who owns it, who has access, is two-step verification on?
- 3Flag personal emails, providers as sole owners, and anyone who's left.
- 1Ask each person which AI tools they use and for what.
- 2Count personal accounts and free tools ("shadow AI"). Ask what's pasted into them.
- 1Does your chatbot say it's AI, and can a person take over in one click?
- 2Does your privacy notice mention AI tools, chatbots, suppliers and how long data is kept?
- 1Search your agency and branch names, with common misspellings, on Google and Maps. Note any profile or site that isn't yours.
- 2For ten listing photos and floorplans: who owns the copyright, and what does the licence allow?
Draft a one-page AI use policy for a small UK estate and lettings agency: approved tools, what must never be entered (client names, addresses, ID, tenancy and offer details), who signs off AI-written public copy, a simple usage log, and rules for recording calls. Mark anything that needs legal review.
- 1Approved tools, ideally a business tool with a contract.
- 2Never paste client names, addresses, ID, tenancy, offer or arrears details into public AI tools. Use anonymised examples.
- 3A named person signs off AI-written copy on fees, legal topics and listings (lesson 6.8).
- 4Tell people before recording or using an AI note-taker, say why, and offer an alternative.
- 5Have everyone confirm they've read it.
- 1Move ownership of every account to the agency, using a shared company address.
- 2Turn on two-step verification everywhere, use a team password manager, and give each person their own login.
- 3Remove leavers the same day.
- 1Restrict any chatbot to approved pages and your fact sheet, label it as AI, offer a human, and read transcripts (lesson 9.3).
- 2Put supplier responsibilities for accuracy, reviews and content in writing.
- 3Check photo and floorplan licences before reusing them.
- 1Report fake profiles, listings or look-alike domains through each platform's own route, keep dated screenshots, and log the outcome.
- 2Search for them each quarter.
Then: Ask a data protection adviser, or the ICO's small business helpline, to review your policy and any chatbot or call recording before you rely on it. This is general information, not legal advice.
04Keep it up
Account audit and impersonation search quarterly. Policy review yearly, and whenever you adopt a new AI tool.
That's lesson 8.5
Worked through it? Mark it done and we’ll keep track on this device.
← Back to 8.4 Fake Reviews, Hidden Prompts and GEO Spam (and Choosing a Provider)