The short answer
The cookie rule is about more than cookies. It covers any information a website stores on a visitor's device, or reads from it: cookies, but also local storage, session storage and fingerprinting. Whether that information is personal data makes no difference, as the EU Court of Justice ruled in Planet49 in 2019.
Storing or reading needs the visitor's consent, with two exceptions. The one that matters for a chat widget covers what is strictly necessary to provide a service the visitor explicitly asked for. Regulators in France, Germany and Ireland have each written that a visitor asks for a chat when they open or use it, not when the page loads. In practice that gives three rules:
- Before the visitor opens the chat, the widget should store nothing on their device unless they have consented.
- Once they open or use it, the widget may generally keep what the conversation needs without consent. The EU opinion on this exemption (Opinion 04/2012) expects such values to expire when the session ends at the latest.
- Anything else, such as advertising or recognising a visitor who comes back next week, needs consent whenever it happens. Analytics generally does too: the Netherlands, by law, and France, under strict CNIL conditions, make room for limited measurement.
Consent is one obligation among several. Tell visitors what the widget stores even where no consent is needed: the Dutch and Belgian regulators require it, and the CNIL recommends it. A chat also often processes personal data, for example to keep a record of the conversation, as the CNIL points out, so your privacy notice has to cover it. Our chatbot privacy notice template helps with that, our GDPR page gives the wider picture, and where the conversations are stored is a question of its own.
The rule: Article 5(3) and its national versions
The rule is Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended in 2009). Storing information on a user's device, or gaining access to information already stored there, is allowed only with consent, given after "clear and comprehensive information". It does not apply to what is needed solely to transmit a communication, nor to what is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service".
The European Data Protection Board explains how far that reaches in its Guidelines 2/2023 (version 2.0, adopted 7 October 2024):
- The rule is not limited to cookies; it covers "similar technologies" (§1).
- There is no lower limit on how long information must stay on the device to count as stored (§37). A value the browser deletes when the tab closes has still been stored.
- JavaScript that makes the browser send information from the device to a server can be "gaining access" (§33).
- Information a script uses only inside the browser, as long as it does not leave the device, is not access (§44).
- Falling under the rule does not automatically mean consent is needed. Whether an exemption applies is assessed case by case (§56).
Germany's data protection authorities spell it out: local storage and session storage objects are storage under the German rule (DSK guidance, margin number 21). The Dutch and Belgian regulators name local storage in their guidance too.
Each country writes the rule into its own law, and its authorities interpret it:
| Country | Law | Regulator |
|---|---|---|
| Germany | § 25 TDDDG | The federal and state data protection authorities, whose joint conference (DSK) publishes guidance |
| France | Article 82 of the Loi Informatique et Libertés | CNIL |
| Netherlands | Article 11.7a of the Telecommunicatiewet | ACM for the cookie rule itself (article 15.1 of that law), AP for personal data collected with cookies |
| Belgium | Article 10/2 of the Law of 30 July 2018, in force since 10 January 2022 | Data Protection Authority (GBA/APD) |
| Ireland | Regulation 5(3) and 5(5) of S.I. No. 336 of 2011 | Data Protection Commission (DPC) |
The exemption reads much the same in all five. The differences lie elsewhere. Dutch law adds an exemption for measuring the quality or effectiveness of a service when that has little or no effect on privacy (article 11.7a(3)(b)). Belgium's authority says its law has no exemption for audience measurement, not even for first-party cookies.
Note. The rule may change. On 19 November 2025 the European Commission proposed, in its "Digital Omnibus" (COM(2025) 837), to move the rule for personal data into a new Article 88a of the GDPR: still with consent, with an exception for a service the person explicitly requested, refusal with a single click, and choices a browser can pass on in machine-readable form (Article 88b). As of 25 October 2026 the European Parliament's file shows it awaiting a committee decision. It is not law, and this article rests on the rules in force today.
What regulators say about chat widgets
Three regulators have written about chat specifically. They agree on the moment that matters: the visitor asks for the chat by acting, not by loading the page.
| Regulator | Where | What it says |
|---|---|---|
| CNIL (France) | Its advice on chatbots, 19 February 2021 | Two options. Either the site gets consent before setting a cookie ahead of the chat being activated, or it sets the cookie only when the user activates the chatbot, for example by clicking the chat window or a button that opens it. The cookie is then strictly necessary and needs no consent, but only if it serves the chat alone: any other purpose needs consent. |
| DSK (Germany) | Guidance for providers of digital services, version 1.2, November 2024, margin number 76 | A chat, like a contact form or a map, is not wanted just because the visitor opened the page. Visitors want such functions once they use them, for example by clicking a chatbot. |
| DPC (Ireland) | Guidance note on cookies, April 2020, example 3 | Cookies used to deliver a chat "must not be deployed until the person explicitly requests to use the chatbot". The next sentence says such cookies do not meet the strictly necessary exemption, which reads stricter than the CNIL's version, or at least less clearly. If Irish visitors matter to you, read the example in full. |
The Article 29 Working Party, at the time the EU's independent advisory body on data protection, does not mention chat in its 2012 opinion on the exemption (Opinion 04/2012). It does describe "user-input" values that keep track of what a user enters "in a series of message exchanges with a service provider", set by the user's own action and expiring when the session ends at the latest, and it treats them as exempt. On a plain reading, a chat conversation fits that description. The same opinion says the test is what is strictly necessary "from the point of view of the user, not the service provider", and that a value used for several purposes is exempt only if every purpose is.
The cookie pages of the Dutch AP and the Belgian GBA, as we read them on 25 October 2026, say nothing specific about chat. Their general rules lead to the same place: storage strictly needed for what the visitor asked for needs no consent.
Decision table: which widget behaviour needs consent
These are typical readings of the guidance above, with the national differences where they exist. Use them as the start of your own assessment, and have your adviser look at anything that matters.
| What the widget does | Consent needed? (typical reading) | What to do |
|---|---|---|
| Loads a vendor script that sets cookies or storage when the page loads | Yes, for anything stored before the visitor has asked for the chat (CNIL, DSK, DPC) | Load the widget only after consent, or only after a click on your own placeholder button |
| Sets a cookie or storage value when the visitor opens or uses the chat, used only for the chat | Generally no, if it lasts no longer than the chat needs. Ireland's DPC example reads stricter, or at least less clearly | Name it in your cookie or privacy notice, with how long it lasts |
| Keeps the conversation together in session storage after the first message | Generally no, on the same reasoning. Session storage counts as storage, however briefly | Disclose it, and check that it is gone when the tab closes |
| Sends chat events to analytics or advertising tools | Generally yes. The Netherlands exempts measurement with little or no effect on privacy, and France audience measurement under strict conditions; Belgium has no such exemption | Put it under the statistics or marketing category of your consent tool |
| Recognises a returning visitor next week, with a lasting ID in a cookie or local storage | Generally yes. Exempt values are expected to end with the session or soon after. A clear "remember me" choice by the visitor can be that consent | Start a new conversation each visit, or offer remembering as the visitor's own choice |
| Times a proactive message by counting pages or time on the site, kept between pages | Generally yes: the value serves your timing, not something the visitor asked for | Tie it to a consent category. Without consent, show only what the page can decide on its own |
| Fetches its script and settings from the vendor's server, storing nothing | Unsettled. The EDPB reads "gaining access" broadly: a script that makes the browser send information from the device (§33), and in some cases the IP address (§55). It adds that this does not automatically mean consent (§56) | Name the vendor in your privacy notice, and have a processor agreement with it |
Check any chat widget in five minutes
A vendor's help page describes what the vendor intends. The browser shows what happens. In Chrome (other browsers have similar tools):
- Open a private window and press F12 (Cmd+Option+I on a Mac) to open DevTools. In the Network panel, tick Preserve log, so that requests stay listed when the page changes.
- Load a page with the widget and touch nothing. Under Application, then Storage, open Cookies, Local Storage and Session Storage, and click every origin listed. Include the widget's own: a chat that runs in a frame keeps its storage under its own origin.
- In the Network panel, choose More filters and then 3rd-party requests. Note every host the page contacted before you did anything.
- Open the chat without typing, and look again.
- Send one message, and look again.
- Close the tab, open the page again and check what survived. A value in local storage, or a cookie that expires months from now, outlives the visit.
- Repeat the steps in a normal window after deleting the site's data. Chrome blocks third-party cookies by default in Incognito, so a widget can look cleaner there than in a normal window.
Write down each item as you find it:
| Name | Where | Origin | Appeared at | Expires | Purpose (ask the vendor) |
|---|---|---|---|---|---|
| Example: a visitor number | Session storage | The widget's domain | First message | When the tab closes | Keeps one visit's messages together |
Whatever appears at page load should be nothing, or covered by consent. Whatever appears later should serve the chat alone. For a fuller audit, the EDPB publishes a free, open-source website auditing tool, built for it by outside experts, that site owners can run on their own sites.
How the ChatterLab widget behaves
This is what the widget's code does on 25 October 2026. Run the test above on it rather than take our word for it.
- Before anyone clicks, the script draws the chat button and asks ChatterLab's server for the button's settings, such as its colour and texts, and for your button image if you uploaded one. The settings request carries no cookies, and the widget sets none. If your script tag has no
data-locale, the request also carries the visitor's preferred browser languages, cut down to the languages the widget itself speaks (you see them ashl=in its address), so that the button can speak the right one. Under the EDPB's broad reading of "gaining access", that alone may count; withdata-localeon the tag it is not sent. Nothing is kept in the visitor's browser at this point, unless your site passes your visitors' consent and the greeting or the second nudge below is on. - The chat itself is only loaded when a visitor opens it for the first time, and opening it stores nothing yet. With the iframe snippet, which puts the chat in the page itself, the chat loads with the page and also stores nothing until the visitor acts.
- The greeting, an optional message beside the button, works without a consent signal from your site. It then appears only on a page the visitor reached from another site, which the widget works out in the browser from where the visitor came from. Nothing is sent or kept for it.
- The second nudge, an optional invitation later in the visit, has to count pages or time from one page to the next, so it appears only if your site passes your visitors' consent. With that consent, and while either message is on, the button keeps one value in session storage under your site's own address,
chatterlab-visit-followed by your agent's id, until the tab is closed. Which consent category that falls under is yours to decide; our documentation calls it closer to marketing than to something the visitor asked for. - IP addresses are not stored. For the message limit we keep a fingerprint of the address for 24 hours, made with a key that changes every day.
- A Calendly booking page, if you connect one, opens inside the chat only when the visitor clicks to book. It is Calendly's own page, so test it too.
Once the visitor does more than open the chat, the chat keeps values in session storage under its own address (the one it is served from, not your site's). <id> is your agent's id:
| Key | Appears when | What it holds |
|---|---|---|
cl-visitor-<id> | The first message, file or contact form is sent | A random visitor number, so that one visit's messages and files stay together |
cl-conversation-<id> | The first answer arrives | The conversation's number, so that a reload or another page continues it |
cl-conversation-<id>-visitor | With the one above | An empty value or, if your site signs visitors in and passes their token, your own id for that visitor, so that a shared tab never shows one person's conversation to another |
cl-lead-<id> | Your contact form, if it comes before the first message, is sent or skipped | sent: with the lead's id, or skipped, so that the form is not asked again |
cl-ticket-<id> | A ticket is sent before the conversation has a number | The ticket's number |
All of them are gone when the tab is closed, so a visitor who comes back the next day starts a new conversation. That is deliberate. If a browser blocks this storage, the chat still works; only the memory between pages is lost.
What ChatterLab does not do: it is not a consent tool, it does not choose your categories, and it does not make your site compliant. Your visitors' conversations are yours as controller, and we process them on your behalf. Data and privacy lists what is stored about visitors, where and for how long; Install the widget and Greeting and nudge explain the tag and the consent signal. To run the five-minute test on a widget of your own, the Free plan is enough.
Loading a widget only after consent
If a widget does set something before the visitor uses it, or you decide to treat it that way, there are two ways to hold it back.
- In your consent tool. Consent tools often offer to block data collection until the visitor has consented, as the AP notes. Put the widget under the category that matches what it actually stores, then repeat the five-minute test. The AP also warns that consent tools' default settings often fall short of the law, and that the site owner stays responsible.
- Behind a click. Show your own button, styled like a chat button, that loads the vendor's script only when clicked. The AP describes the same idea for social media buttons: inactive grey buttons that visitors click on purpose to switch the plug-in on. For a chat, that click is also the moment the CNIL and the DSK treat as the visitor asking for it. Whatever the script then sets for other purposes still needs consent.
The first way has a cost: a visitor who declines, or ignores the banner, never sees the chat. Belgium's GBA also writes that a visitor may not be refused services or advantages because they declined non-functional cookies, a reason not to make the chat depend on accepting everything. The second way keeps the chat open to everyone, as long as the script sets nothing beyond what the chat needs. And a widget that only stores what the chat needs once it is opened may need no holding back at all.
When you do ask for consent, say how long each item lasts and whether third parties can access it: the EU Court of Justice required both in Planet49. With ChatterLab, a site that loads every script only after consent adds data-consent="true" to the tag, and a banner can pass the visitor's choice at any moment with ChatterLab("consent", true) or false. Greeting and nudge has the details, with an example for Cookiebot.
Common mistakes
- Treating session storage as exempt because it is short-lived. The EDPB sets no minimum duration. What makes a value exempt is what it is for, with a lifetime to match; being short-lived is not enough.
- Calling the whole widget "strictly necessary". The visitor asks for the chat when they use it, so anything the chat sets at page load generally needs consent.
- One identifier for two jobs. A visitor ID that also feeds your analytics is exempt only if every purpose is.
- Values that never expire. Ireland's DPC writes that a session cookie with a lifespan of "forever" is not proportionate.
- Trusting the defaults. The AP writes that consent tools' standard settings often do not meet the law. A vendor calling its own cookie "functional" is a label, not an assessment.
- Consent that is not consent. Pre-ticked boxes (Planet49) and carrying on browsing or scrolling (AP, GBA) are not valid consent. In July 2024 the AP announced a fine of 600,000 euros for the company behind Kruidvat.nl, for tracking cookies behind pre-ticked boxes, with many steps needed to refuse; the company has objected to the decision.
- Leaving exempt storage out of your notice. No consent does not mean no information: the AP and the GBA want visitors told about it, and the CNIL recommends it.
Questions site owners ask
Do I need a cookie banner just for a chatbot?
Not necessarily. If the widget stores nothing before the visitor opens it, and afterwards only what the conversation needs, regulators' guidance generally treats that storage as exempt from consent, although you still describe it in your cookie or privacy notice. You generally need consent, and so a way to ask for it, as soon as the widget stores anything earlier, or uses storage for advertising, recognising returning visitors or most analytics. Check with the five-minute test rather than rely on a vendor's description.
Is sessionStorage covered by the cookie rules?
Yes. The rule covers any information stored on the device, and the EDPB's guidelines set no minimum time it has to stay there; Germany's authorities name session storage explicitly. What decides whether you need consent is the purpose. A value kept only to hold a conversation together after the visitor opened the chat is generally exempt. The same storage used to time marketing messages, or for most analytics, is not.
What about the visitor who never opens the chat?
For that visitor, a well-built widget stores nothing on the device, so there is no storage to consent to. The script that draws the button is still fetched from the vendor's server, which receives the visitor's IP address, and an IP address can be personal data. Whether that request alone falls under the consent rule is unsettled. Either way, name the vendor in your privacy notice and have a processor agreement with it.
Does the AI notice need consent?
No. The consent rule is about storing or reading information on the visitor's device, and a line of text saying they are talking to an AI does neither. The notice comes from a separate duty: Article 50 of the EU AI Act requires AI systems that talk with people to be designed so that people are told they are interacting with an AI, unless that is obvious. Our AI notice wording guide has examples you can adapt.
Can I load the widget before consent?
Generally yes, if it stores nothing until the visitor uses it: the chat guidance of the CNIL, the DSK and the DPC is about what is set before the visitor asks for the chat, and in that case nothing is. If the widget sets cookies or other storage on page load, load it only after consent, or only after a click on your own placeholder button. The request to the vendor's server itself remains an open question, which the EDPB leaves to case-by-case assessment.
Can a chatbot remember me across visits without consent?
Generally not. Exempt storage may last no longer than its purpose, and regulators expect values that hold a conversation together to end with the session or soon after. A lasting identifier that recognises a visitor next week goes beyond what the visitor asked for, so it needs consent. A visitor's own clear choice, such as ticking a box marked "remember this conversation", can serve as that consent, as Opinion 04/2012 said of "remember me" boxes.
Sources
- Directive 2002/58/EC on privacy and electronic communications, consolidated text of 19 December 2009, Publications Office of the European Union, read on 25 October 2026.
- Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, European Data Protection Board, read on 25 October 2026.
- Opinion 04/2012 on Cookie Consent Exemption (WP 194), Article 29 Data Protection Working Party, read on 25 October 2026.
- Judgment in Case C-673/17, Planet49, 1 October 2019, Court of Justice of the European Union, read on 25 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50, Publications Office of the European Union, read on 25 October 2026.
- Chatbots : les conseils de la CNIL pour respecter les droits des personnes, CNIL, read on 25 October 2026.
- La loi Informatique et Libertés (article 82), CNIL, read on 25 October 2026.
- Délibération n° 2020-091 du 17 septembre 2020, lignes directrices « cookies et autres traceurs », CNIL, read on 25 October 2026.
- Délibération n° 2020-092 du 17 septembre 2020, recommandation « cookies et autres traceurs », CNIL, read on 25 October 2026.
- § 25 TDDDG, gesetze-im-internet.de, read on 25 October 2026.
- Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von digitalen Diensten, version 1.2, Datenschutzkonferenz, read on 25 October 2026.
- Telecommunicatiewet (BWBR0009950), articles 11.7a and 15.1, wetten.overheid.nl, read on 25 October 2026.
- Cookies, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Cookies en uw organisatie: zorg voor een goed beleid, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Heldere cookiebanners, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Trackingcookies, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Boete van 600.000 euro voor tracking cookies op Kruidvat.nl, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Wet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens, article 10/2, Federal Public Service Justice (Justel), read on 25 October 2026.
- Cookies en andere traceringsmiddelen, Gegevensbeschermingsautoriteit, read on 25 October 2026.
- Cookie checklist, Gegevensbeschermingsautoriteit, read on 25 October 2026.
- S.I. No. 336/2011, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, Irish Statute Book, read on 25 October 2026.
- Guidance note on cookies and other tracking technologies, April 2020, Data Protection Commission, read on 25 October 2026.
- Proposal for a Digital Omnibus Regulation, COM(2025) 837 final, proposed Articles 88a and 88b GDPR, European Commission, read on 25 October 2026.
- Procedure file 2025/0360(COD), Digital Omnibus, Legislative Observatory, European Parliament, read on 25 October 2026.
- EDPB website auditing tool, European Data Protection Board, read on 25 October 2026.
- Open Chrome DevTools, Chrome for Developers, read on 25 October 2026.
- View, add, edit, and delete cookies, Chrome for Developers, read on 25 October 2026.
- View and edit local storage, Chrome for Developers, read on 25 October 2026.
- View and edit session storage, Chrome for Developers, read on 25 October 2026.
- Network features reference, Chrome for Developers, read on 25 October 2026.
- Browse in Incognito mode, Google Chrome Help, read on 25 October 2026.
- Window: sessionStorage property, MDN Web Docs, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.