Fixing the digital trust issue in ChatGPT for travel

As interest in and implementation of ChatGPT and generative artificial intelligence more broadly ramps up, so too does concern about privacy and trust and calls for regulation.

Earlier this month, Italy became the first Western country to block ChatGPT over unease about privacy controls. The country’s data protection agency has given OpenAI, maker of the generative AI chatbot, a list of demands to meet by April 30. On Tuesday the company announced new privacy controls that seem to be in direct response to some of Italy’s concerns, including the ability for users to disable chat history, thereby allowing them to choose which conversations can be used to train ChatGPT’s models.

In the United States there has been talk, but no action, about the need for regulation, although Monday CNBC reported a tech advocacy group representing Microsoft, Adobe, IBM and Oracle is advocating for rules governing the use of AI in national privacy legislation.

Meanwhile, the launch of new tools and services using ChatGPT continues apace. And travel is certainly one of the verticals that is seeing a flurry of activity. In March, Expedia and Kayak became two of the first brands to release plug-ins for ChatGPT and less than two weeks later Expedia updated its mobile app to include ChatGPT for trip planning. Trip.com has also connected OpenAI’s API to its mobile app, and dozens of other companies are rolling out integrations seemingly daily. 

Some industry experts are sounding the alarm about the convergence of these two issues – legitimate concerns about data privacy and trust and a powerful technology that is becoming ubiquitous.

“With the scale of power that’s now available to us, the scale of catastrophe is also raised,” said Trevor Butterworth, co-founder and vice president for communications and governance for Indicio, a developer of open-source decentralized identity.

And the risk is most evident in the types of applications that have captured the attention of the travel industry, where the buzz is about using generative AI for personalization and fast, frictionless experiences for shopping and booking. With the launch of plug-ins in March, ChatGPT can now access external data sources, creating more opportunities but also more risks for privacy and security.

“Because you can have an intelligent agent - whether it’s a travel agent, a financial agent – that is capable of accessing your data, learning from it, understanding in a sense … in terms of correlations and patterns and behavior,” Butterworth said.

“And if that is owned by somebody else, and that is hacked or you’re hacked, your security is compromised. That’s a whole other level of dystopia.”

Solving ChatGPT’s trust issue

In a position paper recently published by Indicio, Butterworth and co-author Karl Schweppe, head of innovation at digital product studio Bay Tree Ventures, propose a solution: verifiable credentials – defined by the W3C as “a tamper-evident credential that has authorship that can be cryptographically verified” - used with a decentralized identifier communications protocol (DIDComm). Used in tandem, the authors propose, these technologies enable secure, trustworthy person-to-AI interaction – mitigating risk and maximizing a seamless experience for both companies and consumers.

In travel specifically, they write, the use of verifiable credentials would mean consumers can use ChatGPT agents – what they call a Chat Valet – to handle tasks such as booking flights and hotels according to preferences and then automatically paying for those bookings through secure, digital communication with the traveler’s bank. 

“We’ve spent 20 years gaining a sense of trust in the internet and in the brands and experiences we use on the internet, with about 80% confidence and 20% ‘this is tolerable,’” said Schweppe.

“With the new models of chat, AI and those interfaces, we have to rebuild a whole new infrastructure of trust. … In financing we have payment rails. We will need identity rails and trust rails for chat. But it’s going to be really challenging because it’s moving so fast.”

Butterworth and Schweppe have both been working with verifiable credentials for some time, but they say it was the release of OpenAI’s plug-ins and API in March that made them realize ChatGPT creates the perfect use case for this decentralized identity technology.

“It’s the only solution that can really manage the need for continuous verification between each party in the interaction,” Butterworth said.

“I recognize my ChatGPT agent as being mine, and it recognizes me as the owner. Whoever we are dealing with – the hotel for example - recognizes that the ChatGPT agent is my agent and that it’s not interacting with someone else. And when we exchange information, this process of verification is continuous. It applies zero trust relentlessly in order to ensure our data is secure.”

Schweppe predicts chat could eventually replace a website as the consumer’s interface with a brand, eliminating traditional logins and creating the need for a new model of identity verification.

“Up until this point we’ve always had walled gardens where you log into a website, and they protect your identity,” he said.

“With chat, they aren’t there in the same way anymore. The chat is going to be your interface that can then communicate and integrate with multiple services that are not necessarily walled in the same way. So the identity piece becomes so much more important.”

Mitigating the risk of “fake everything”

Jamie Smith, an expert on self-sovereign identity who writes about the topic on his Customer Futures blog, agrees that digital trust is critical right now because AI is creating “an explosion of fake everything.”

“In a world where I can’t tell what is real and fake, we’ll need digital wallets to help us prove who we are and for us to make sense of what we are seeing,” Smith said.

We will need identity rails and trust rails for chat. But it’s going to be really challenging because it’s moving so fast

Karl Schweppe - Bay Tree Ventures

Share this quote

“Yesterday it was fake reviews on Tripadvisor, tomorrow it will be you’ve taken my money for a package trip, but I get off the plane and there is no tour guide, there is no bus to collect you, there is no hotel. All the reviews are there but along with the website, the photos, the phone call you had with the agent – none of it is real. AI is surfacing incredible opportunity, but we have a fake everything problem.”

But the need for consumers to trust the brands and content they interact with in chat is just one piece of the puzzle. In order for the full power of AI to be activated to provide consumers with customized, frictionless shopping and booking experiences, they will need to give it their personal preferences and data – and trust that it is secure. Conversely, brands will need to know the consumers they are interacting with in chat are “real” and to recognize that verifiable credentials create an opportunity to – finally – build a fully-connected travel experience. 

“Now more than ever the travel ecosystem is looking for more collaboration, more connected journeys, more value and that’s the super power of verifiable credentials – portability,” Smith said.

“And in a world where personal AI is going to get closer to us and become increasingly more valuable, it needs to be trained on data it can trust, and individuals need to know what’s happening to that data. And verifiable credentials create a great supply chain of who produced what data, when and how.” 

Schweppe said companies should realize “this is early-adopter territory so brands that make an impact now do have an opportunity to get ahead of others that are slow to move. … For that reason, it’s imperative to stay aware of what’s going on and … begin to think what strategy will work.”

And with heightened concerns globally about data privacy and scrutiny of “big tech” such as Facebook, Google, Amazon and Apple, Butterworth said recognition of the risks associated with emerging AI solutions is critical.

“Across different industries and within verticals we are seeing companies take data privacy and security seriously. And [with verifiable credentials] there’s not a trade-off – it comes with the benefit of verifiable data,” he said.

“So the win-win aspect of decentralized identity and verifiable credentials is really apparent to a lot of companies. And in the marketplace, it will be who do you trust with your data? Can you control your data? That’s going to be a very simple, powerful message that I think will animate a large section of the marketplace both from business and from consumers.”