Virtual private shopping assistants (VPSAs) made possible by recent advances in artificial intelligence (AI) are expected to help users find the best deals online, possibly also acting on behalf of the user after gaining the user's trust. To achieve such functionality in enhancing the user experience, VPSAs will have to collect and manage highly personal data about the users. We review possible architectures for VPSAs, privacy implications and ethical considerations, especially in view of the European Union's General Data Protection Directive (GDPR). There is a concern that compliance with GDPR will limit the data companies can collect, thus interfering with marketing activities. Because VPSAs are owned by users and are expected to keep the user's data private, they might be the technological solution to reducing the GDPR compliance burden for online sellers, while providing some or more of the marketing information sellers traditionally developed.