A GDPR compliant chatbot: what the rules actually require of your website chat

Who is responsible

On your website, you are normally the controller of the chat data: you decide why and how it is used. The chatbot vendor and the AI provider usually act as processors on your behalf, which means you need a written data processing agreement (DPA) with each of them (GDPR Article 28).

A plugin that runs inside your WordPress and stores conversations in your own database reduces the number of processors: the AI provider remains one, the plugin vendor may not be. A chatbot added to any website with one line of code is a hosted service, so its vendor is a processor too. HolaReply works both ways: on any website with one line of code, where your team works in HolaReply Desk, and on WordPress as a free plugin. A Shopify app is coming soon.

The checklist

1. A lawful basis

Answering a visitor’s question about your products usually rests on taking steps at their request (Article 6(1)(b)) or on legitimate interests (Article 6(1)(f)). The European Data Protection Board gives “a conversational agent to assist users” as an example that can rely on legitimate interest, but only where the processing is strictly necessary. Marketing follow-up to captured leads usually needs consent.

2. Tell people, before they type

Your privacy notice should cover the chatbot: who you are, why you process the chat, the legal basis, who receives it (including the AI provider), transfers outside the EEA, how long you keep it and people’s rights (Articles 12–13). France’s CNIL recommends explaining this and warning users before they use the chatbot, including a warning not to share sensitive data.

3. Say it is an AI

Article 50 of the EU AI Act requires that people interacting with an AI system are informed of it, in a clear and distinguishable way, at the latest at the first interaction, unless it is obvious. The European Commission says this applies from 2 August 2026 with no grace period for chatbots. Label the chat as an AI assistant and say so in its first message.

4. Send the AI only what it needs

Data minimisation (Article 5(1)(c)) and privacy by design (Article 25) point the same way: the AI needs the question, not the visitor’s identity. HolaReply removes names, email addresses, phone numbers and company names from every question before it is sent to the AI provider.

5. Keep it for a set time

Decide how long conversations are kept and delete them automatically (Article 5(1)(e)). The CNIL gives the example of deleting a conversation once its purpose is met, while keeping what you need for complaints. HolaReply deletes conversations after 90 days by default; you choose the period.

6. Answer people’s requests

Visitors can ask to see, correct or delete their data (Articles 15–22). Know where chat data lives and how you will find a person’s conversations and enquiries. The CNIL also notes a chatbot conversation alone should not make decisions with legal effect, such as on credit or pricing.

7. Transfers outside the EEA

If your AI provider processes data in the US, transfers rely on the EU-US Data Privacy Framework (upheld by the EU General Court in September 2025, with an appeal pending) or on Standard Contractual Clauses. Check your provider’s terms. With Google’s Gemini API, Google’s own terms require a paid (billing-enabled) key for services offered to users in the EEA, Switzerland or the UK.

8. Browser storage and consent

The ePrivacy rules cover cookies and also local storage. Storage that is strictly necessary for a service the visitor asks for is exempt from consent. The CNIL applies this to chatbots specifically: storage set only when the visitor opens or uses the chat is exempt; set before that, or used for anything else such as analytics, it needs consent. HolaReply writes its conversation token only once the visitor sends a message.

Accuracy is a data protection issue too

GDPR requires personal data to be accurate, and consumer law holds businesses to what their chatbots say. In 2026 a German court treated a clinic chatbot’s invented claims as the company’s own statements. A chatbot that answers only from your content, shows its sources and says when it doesn’t know is easier to defend. See our guide on stopping chatbot hallucinations.

Questions to ask any chatbot vendor

• Where are conversations stored, and in which country?
• Which AI provider is used, and does it use our visitors’ messages to train or improve its models?
• Is personal data removed before it reaches the AI?
• Can we set a retention period, and is deletion automatic?
• How do we export or delete one person’s data on request?
• Is there a data processing agreement, and which sub-processors are involved?
• Does the widget say clearly that it is an AI?
• What does it store in the visitor’s browser, and when?

Questions people ask

Sources

Checked on 25 September 2026. Prices and features change; tell us in the chat if something here is out of date and we will fix it.

1. GDPR (Regulation (EU) 2016/679), EUR-Lex
2. EDPB Opinion 28/2024 on AI models
3. EDPB Guidelines 1/2024 on legitimate interest
4. CNIL: chatbots, advice to respect people’s rights
5. EU AI Act, Article 50 (AI Act Service Desk)
6. European Commission FAQ: transparency obligations under Article 50
7. EDPB Guidelines 2/2023 on the technical scope of Article 5(3) ePrivacy
8. ICO: exceptions to the storage and access rules
9. European Commission: EU-US Data Privacy Framework adequacy decision
10. Gemini API Additional Terms of Service
11. OLG Hamm, 12 May 2026, 4 UKl 3/25