Live chat and chatbot widgets can be problematic from a data protection perspective. They typically transfer personal data to external providers, often without website visitors being aware of this or having given their explicit consent. For website operators, this means that anyone using such a widget bears data protection responsibilities that require proactive action. The following questions highlight the key aspects of live chat data protection and the GDPR-compliant integration of chat widgets.
What data do live chat and chatbot widgets typically collect?
Live chat and chatbot widgets typically collect a combination of user data entered actively and technical information collected passively. This includes name, email address and chat content, as well as IP addresses, browser type, device information, page views and behavioural data such as time spent on the site or scroll depth.
Many providers go beyond what is strictly necessary for the actual operation of the chat function. Often, as soon as the widget loads – even before a visitor types a single message – cookies are set and data is transmitted to the provider’s servers. Some services link this data to existing user profiles in order to analyse behaviour across multiple websites.
The following data categories are particularly relevant to chat widget data protection:
- Identification data: Name, email address, telephone number (if provided voluntarily)
- Communication data: The complete chat history, timestamps, response times
- Technical metadata: IP address, browser version, operating system, screen resolution
- Behavioural data: Which pages were visited before the chat, how long was the user scrolling, which elements were clicked
- Tracking data: Cookies and tracking pixels that enable cross-session tracking
It is precisely the combination of behavioural data and communication content that makes chat widgets a tool that goes far beyond a simple contact function.
Why do chat widgets pose a data protection risk for websites?
Chat widgets pose a data protection risk because they load external scripts and third-party resources that are beyond the website operator’s control. This involves data transfers to third countries, a lack of or insufficient consent, and an often unclear data processing relationship.
The GDPR requires that personal data may only be processed if there is a legal basis for doing so. For cookies and tracking technologies requiring consent, prior consent is generally necessary. In the case of data transfers to third countries, the requirements of Articles 44 et seq. of the GDPR must also be met.
There are also structural risks:
- Transfers to third countries: Many popular chat providers are based in the USA. For data transfers to the USA, a suitable legal basis in accordance with Articles 44 et seq. of the GDPR is required, such as an adequacy decision or appropriate safeguards like standard contractual clauses.
- Lack of data processing agreements: Anyone integrating a chat service is generally the data controller in a data processing arrangement. A corresponding data processing agreement (DPA) with the provider is mandatory.
- Lack of transparency in data processing: Many widgets load additional scripts that are not mentioned in the privacy policy.
- Automatic loading without consent: If the widget loads immediately upon page loading, data is transferred before the user has even had the opportunity to consent or refuse.
When is consent required before a chat widget is loaded?
Whether consent is required before loading a chat widget depends on the technologies used and the specific data processing involved. If consent is required, it must be informed, voluntary, specific and actively given – in other words, not via pre-ticked boxes or simply by continuing to browse.
In practical terms, this means that cookies and similar technologies requiring consent may only be used once consent has been given. The transfer of personal data also requires an appropriate legal basis. In practice, technical implementation via a consent management tool (CMP) is the standard approach to meeting these requirements.
The following points must be clarified before integration:
- What data does the widget transfer, and to whom?
- Does data processing take place in a third country?
- Which cookies are set, and are they technically necessary or subject to consent?
- Is the chat provider correctly described in the privacy policy?
- Is there a data processing agreement in place with the provider?
Important: Consent must also be revocable. Users must have the option to withdraw their consent at any time without suffering any disadvantages as a result.
How do live chat providers differ in terms of their GDPR compliance?
Live chat providers differ significantly in terms of how much data they collect, whether they operate servers in the EU, whether they offer data processing agreements, and how transparent their data protection documentation is. European providers with servers located in the EU are generally easier to use in a GDPR-compliant manner than US-based services.
When selecting a chatbot or live chat provider, website operators should check the following criteria:
Server location and data transfer
An EU server location can reduce transfers to third countries. However, the decisive factor is whether personal data is also accessible from third countries or transferred there. In the case of US providers, it must be checked on what basis personal data is transferred to the US, for example under the EU-US Data Privacy Framework or appropriate safeguards in accordance with Article 46 of the GDPR. Although the EU-US Data Privacy Framework has provided a new framework, its long-term stability remains legally contentious.
Availability of a data processing agreement
Reputable providers make a data processing agreement available, often as a standardised document in the customer portal. Where data processing on behalf of a controller takes place, a corresponding agreement in accordance with Article 28 of the GDPR is required. You should also check whether the data processing agreement actually covers the processing activities of the widget and does not merely contain general statements.
How can a chat widget be integrated into a website in a manner that complies with data protection regulations?
A chat widget can be integrated in a manner that complies with data protection regulations if the necessary consents are obtained, the data protection requirements are met, and the widget is restricted to the necessary data processing.
The key practical steps:
- Set up a consent management tool: If the chat widget requires consent, it must be accounted for accordingly in the consent management tool and may only be activated once consent has been given.
- Conclude a data processing agreement: If data processing is carried out on behalf of another party, conclude a data processing agreement with the provider before the widget goes live.
- Update the privacy policy: Describe the chat service in full: provider, purpose, types of data, legal basis, retention period and, where applicable, transfers to third countries. Our privacy policy generator can help you create tailor-made texts.
- Check the technical configuration: Ensure that the widget does not use any cookies or similar technologies requiring consent before the necessary consent has been given
- Configure data minimisation: Many chat providers allow you to disable optional tracking functions. Make use of this option to collect only the data that is actually required.
Regular monitoring is also important, as providers may change their scripts and data processing practices without explicit notice.
How can you tell if a chat widget on a website is causing GDPR issues?
There may be indications of data protection issues if a chat widget sets cookies requiring consent or transmits personal data without an appropriate legal basis. An automated GDPR website scan can quickly identify many technical anomalies. Contractual and legal requirements must also be checked.
Typical indicators of data protection issues with a chat widget:
- The widget sets cookies requiring consent or loads relevant services before the user has given their consent
- Data transfers to the chat provider are already visible in the browser’s Network tab before the required consent has been given
- The chat provider is missing from the privacy policy or is only described there incompletely
- A chat service requiring consent is not appropriately accounted for in the consent banner
- In the case of data processing on behalf of a client, there is no required data processing agreement in place with the provider
Manual checks are time-consuming and prone to errors, particularly when several websites need to be checked regularly. Automated scanning tools can significantly speed up this process and help to systematically identify vulnerabilities.
How decareto supports the checking of chat widgets
At decareto, we have developed a SaaS platform that automatically scans websites for precisely the kind of data protection issues caused by live chat and chatbot widgets. Specifically, decareto helps with the following:
- Detection of services requiring consent: Our scanner detects whether a chat widget sets cookies or establishes external connections before the user has given their consent, and highlights this risk in the report.
- Consent banner analysis: We automatically check whether an existing consent management tool is configured correctly and whether the chat widget is loaded before the required consent is given.
- Continuous monitoring: Hundreds of websites can be monitored on an ongoing basis. If the behaviour of a chat widget changes – for example, because the provider has updated its script – you will automatically receive a notification.
- Structured reports: The results are presented clearly and accompanied by specific recommendations for action, enabling data protection officers, agencies and compliance teams to take targeted action.
- Privacy policy generator: Our generator helps to correctly integrate chat services into the privacy policy, in 24 languages and always based on the services actually detected.
decareto is not a substitute for legal advice and cannot guarantee that all possible data protection breaches will be detected. However, we help you to systematically identify vulnerabilities and significantly reduce the effort involved in website audits. Test your website now and find out whether your chat widget is causing data protection issues: Get started for free now.
