AI in hospitality and tourism: dynamic pricing, profiling and the GDPR

Short answer: Hospitality and tourism use AI for dynamic pricing, recommendations, chatbots and guest profiling. These applications rarely fall under the AI Act's high-risk category. The decisive framework is the GDPR: as soon as you profile guests or make automated decisions about them, you need a legal basis, transparency and safeguards.

Dynamic pricing

Dynamic pricing — prices that move with demand, time or occupancy — is permitted in itself. It becomes sensitive when the price is determined by the individual customer's personal data: browsing behaviour, device, past purchases or estimated purchasing power.

Personalised prices based on profiling require a GDPR basis and transparency. The consumer must know that automated processing influences the price. Prices that discriminate on sensitive characteristics are moreover unlawful.

Profiling and recommendations

Recommendation systems that suggest rooms, restaurants or outings process preferences and behaviour. Insofar as this is personal data, the GDPR applies in full: purpose limitation, data minimisation and a valid legal basis.

Profiling is permitted, but the guest has rights: access, objection and — for fully automated decisions with legal or similarly significant effect — the right to human intervention. A chatbot that independently refuses bookings or imposes surcharges may fall into that last category.

Transparency about AI interaction

Article 50 of the AI Act requires that a guest knows when they are interacting with an AI system, for example a chatbot. The interaction must be recognisable as such, unless it is obvious. This is a light but concrete obligation for the sector.

High-risk obligations rarely apply here; the high-risk obligations overview is mainly relevant if you use AI for staff, for example in recruitment or scheduling.

What to do

• Justify your pricing logic: know whether the price rests on market data or on personal data — the latter requires a GDPR basis and transparency.
• Document profiling: purpose limitation, data minimisation and a legal basis for each profile.
• Secure guest rights: facilitate access, objection and human intervention for automated decisions.
• Make AI interaction recognisable: label chatbots in line with Article 50.
• Avoid discrimination: pricing or access decisions must not rely on sensitive characteristics.

In hospitality and tourism the guest is the centre — and therefore the GDPR is the sharpest framework. That differs from AI in agriculture, where business data and machine safety come first.