What a chatbot adds to your privacy notice
A chat collects personal data as soon as visitors type about themselves: a name, an order number, sometimes much more. Article 13 of the GDPR asks for the information "at the time when personal data are obtained", so the notice must be one click from the chat before the first message. A clear link is enough: the Dutch regulator (AP) writes that a clear reference to the online privacy statement suffices when people enter data on a website.
Regulators are checking exactly this in 2026. On 19 March the European Data Protection Board (EDPB) launched a coordinated action in which 25 data protection authorities examine how organisations meet their information duties under Articles 12 to 14.
| Article 13 asks for | For a chat, say |
|---|---|
| Who you are, and your data protection officer if you have one (13(1)(a), (b)) | Your business is the controller, even though a vendor runs the software |
| Purposes and legal basis (13(1)(c)), and the interest if you rely on legitimate interest (13(1)(d)) | Answering questions, checking answers, keeping abuse out |
| Recipients (13(1)(e)) | The chat vendor, the AI model provider and other sub-processors; as good practice, who in your team reads chats |
| Transfers outside the EU (13(1)(f)) | Each step that runs elsewhere, the adequacy decision or safeguard that covers it, how to get a copy of a safeguard |
| Retention (13(2)(a)) | A period per type of record, or the criteria |
| Rights and complaints (13(2)(b) to (d)) | How to exercise them when the chat never asked who they are |
| Whether providing data is required (13(2)(e)) | The chat is optional; give another way to reach you |
| Automated decisions (13(2)(f)) | Usually none; say so |
Two things sit outside Article 13 but belong next to it: the AI notice inside the chat, and a request not to type sensitive details.
What one chatbot actually stores: a worked example
You cannot write this section from a template alone; you need your vendor's real data map. Here is an example: a chat powered by ChatterLab, taken from our Data and privacy documentation. Replace each row with your own vendor's facts, and treat the basis column as a starting point for your own assessment.
| What is stored | Why | Typical basis | How long (ChatterLab) | Who else handles it |
|---|---|---|---|---|
| The conversation: messages, answers, time, sources used, page asked from | Answer; check and correct answers | Legitimate interest; pre-contract steps for questions about your offer | Until you delete it | Cortecs writes answers; OpenAI turns each question into search vectors; your team |
| A random visitor number | Keep one visit's messages together | Legitimate interest | In the browser until the tab closes; with the conversation | As above |
| A thumbs up or down | Measure answer quality | Legitimate interest | With the conversation | ChatterLab only |
| Contact details, if the contact form is on | Contact the visitor; offers only with the tick box | Pre-contract steps or legitimate interest; consent for marketing | 3 years, or until you delete them | E-mailed to you through Resend |
| A ticket, if tickets are on: e-mail, name, question, replies | Answer by e-mail | Pre-contract steps, contract or legitimate interest | 2 years after it is solved | E-mail through Resend |
| Files a visitor sends, if allowed | Answer about the file | As the conversation | 30 days, then only the name | Cloudflare R2 stores them; their text goes to the model through Cortecs |
| The IP address | Not stored; a fingerprint enforces the message limit | Legitimate interest (abuse prevention) | 24 hours | ChatterLab only |
The widget sets no cookies and keeps nothing in the browser before the visitor uses the chat, unless your site passes their consent for a second nudge. Two steps run in the United States, OpenAI and Resend, which is why module D below is not optional for a ChatterLab chat.
Where ChatterLab fits, and what stays with you
ChatterLab acts as your processor and sends the data processing agreement on request. The contact form and the ticket card cannot be switched on without the address of your privacy notice, and both link to it. The Notice banner above the conversation takes simple markdown, so it can ask visitors not to share sensitive details (module E below) and link to your notice; a visitor can close it, so keep that request in your notice too.
It does not write your privacy notice, delete conversations by itself or answer visitors' requests for you. One more thing to watch: Improve answer turns a visitor's question into a question-and-answer source, and every visitor can be shown what is in your sources, so edit personal details out before you save. If you build agents for clients, your client is the controller, you are their processor and ChatterLab is yours. The chat itself can be tried on the Free plan.
Which legal basis fits a chatbot
None of the regulator texts cited here assigns one legal basis to every chatbot. You choose per purpose and must be able to show your reasoning (Article 5(2)). One basis is closed to public authorities: legitimate interest does not apply to processing they carry out in the performance of their tasks (Article 6(1), second subparagraph), so a council's chat needs another basis, such as a task carried out in the public interest (point (e)).
| If the chat... | A basis to consider | What the notice must then say |
|---|---|---|
| answers questions visitors choose to ask | Legitimate interest, Article 6(1)(f) | The interest, the right to object, that the assessment is available on request |
| answers questions about your products, prices or availability | Steps at the visitor's request before a contract, Article 6(1)(b) | That the data serve the steps the visitor asked for |
| handles an existing customer's order | Performance of the contract, Article 6(1)(b) | Which contract |
| sends news and offers to visitors who ticked a box | Consent, Article 6(1)(a) | How to withdraw it, as easily as it was given (Article 7(3)) |
| is meant for health or other sensitive topics | An Article 9(2) exception as well, such as explicit consent | The exception; a DPIA is then probably needed |
Legitimate interest needs a documented three-step test, set out in the EDPB's guidelines on Article 6(1)(f): a real interest, processing that is necessary for it, and a balancing test, in which the visitor's reasonable expectations weigh, that comes out in your favour. The guidelines warn against picking this basis because it seems "less constraining", and say people should be told they can obtain information on the balancing test on request. As of 25 October 2026 they are still version 1.0, the draft adopted for consultation on 8 October 2024.
Pre-contract steps cover more than formal quotes. The EDPB's guidelines on Article 6(1)(b) say that when someone contacts a business to enquire about its service offerings, processing their data to respond can rest on that basis. Unsolicited marketing is excluded.
The rest. E-mail marketing needs prior consent under Article 13(1) of the ePrivacy Directive, as transposed into your national law, with an exception for existing customers and similar products. Article 22 on automated decisions is not what an information chat does; the CNIL, the French regulator, names what would cross the line: a chat that on its own refuses online credit, applies a higher price or stops someone applying for a job.
Copy-ready text: a base paragraph and seven optional modules
Put the base paragraph in your main privacy notice under its own heading and add only the modules that match what your chat does. Replace everything in square brackets, and check the other sentences against your vendor too: they describe a chat like the example above. This is example wording to adapt; where your sector or audience raises the stakes, have it reviewed by your adviser.
Base paragraph (always).
Our chat assistant
Our website has a chat assistant that uses artificial intelligence (AI) to answer questions from information we gave it, such as our website and our documents. [Company name], [Address], is responsible for the personal data processed in the chat. You can reach us at [E-mail address]. [Our data protection officer: Name, E-mail address.]
When you use the chat, we record your messages, the assistant's answers, the time, the page you asked from and any rating you give. Your browser keeps a random visitor number, the number of the conversation and similar technical values until you close the tab, so that the messages of one visit stay together. The chat does not ask for your name or contact details.
We use the conversations to answer your questions and to check and correct the answers, on the basis of our legitimate interest in answering visitors quickly and correctly (Article 6(1)(f) GDPR). When you ask about our products, prices or an offer, we process your messages to take the steps you asked for before a possible contract (Article 6(1)(b) GDPR). You can ask us for the assessment behind our reliance on legitimate interest.
The chat runs on software from [Vendor], which processes the conversations on our behalf as our processor, with the providers named below. Our [Team or role] can read the conversations.
You do not have to use the chat: you can also reach us at [E-mail address or phone number]. The assistant answers questions; it does not take decisions about you.
Your right to object. You can object at any time, on grounds relating to your particular situation, to our use of the conversations based on legitimate interest. Write to [E-mail address].
The right to object has its own line because Article 21(4) asks for it to be presented clearly and separately from other information. Drop the Article 6(1)(b) sentence if the chat never discusses your offer. If you add module A or B, end the second paragraph with "unless you use the contact form or hand your question to our team, as described below". If your site tells the chat who a signed-in visitor is, add that the conversation is kept with the customer number your site passes on. If an agency built the chat for you, it is your processor too: name it.
Module A (optional): contact details left in the chat.
Contact details you leave in the chat. If you fill in the contact form in the chat, we use the details you enter ([Name, e-mail address, phone number]) to contact you about your question, as you asked. Our legal basis is [the steps you asked for before a possible contract, Article 6(1)(b) GDPR / our legitimate interest in answering you, Article 6(1)(f) GDPR]. We keep these details for [Period], unless you ask us to delete them sooner. We send you news and offers only if you tick the box for it (Article 6(1)(a) GDPR); you can withdraw that consent at any time by [How].
ChatterLab deletes contact details after 3 years by itself, never ticks the news box in advance, and keeps the words the visitor saw with the lead.
Module B (optional): questions answered by e-mail.
Questions we answer by e-mail. If you hand your question to our team in the chat, we use your e-mail address, your name if you give it, your question and the page you asked from to answer you by e-mail. Your replies are added to the same request. We keep a request for [Period] after it is solved. [E-mail provider] sends and receives these e-mails on our behalf.
ChatterLab keeps a ticket 2 years after it is solved, and an unsolved one until you delete it.
Module C (optional): files visitors send.
Files you send in the chat. You can attach a document or a picture to a question. The assistant reads it to answer that question. We keep the file and the text read from it for [Period]; after that, only its name stays with the conversation. Please send only what your question needs, and no identity documents or medical records.
ChatterLab keeps such files 30 days and sends their text to the model with the question, not to OpenAI.
Module D (needed whenever a step runs outside the EEA): the AI provider and transfers.
Who processes the text, and where. [Vendor] stores the conversations in [Location]. The answers are written by [Model provider or gateway], which receives your question, the recent conversation and the passages of our information that were found. To search our information by meaning, the text of each question is converted into numbers by [Provider] in [Country]. Transfers outside the European Economic Area take place under [an adequacy decision of the European Commission / the European Commission's standard contractual clauses / Other safeguard]; you can ask us for a copy of the safeguards at [E-mail address]. [Vendor] does not use the conversations to train AI models.
Write the last sentence only if your vendor's terms say so, and name another provider in it only where that provider's terms say the same; visitors may look for it, since Spain's regulator, the AEPD, advises chatbot users to check whether a chatbot keeps learning from their conversations. ChatterLab trains no models on your conversations, and the middle below covers OpenAI. Cortecs' own documentation says that by default data sent through it is not used for AI training (read on 25 October 2026); ask your vendor to confirm which settings apply to your chat. For a ChatterLab chat, the middle reads:
We use ChatterLab, which stores the conversations in the EU. The application runs at Vercel in Frankfurt, Germany, and files you send are stored with Cloudflare R2 under EU jurisdiction. The answers are written through Cortecs, a European model gateway. To search our information by meaning, the text of each question is turned into numbers by OpenAI in the United States, under its data-processing terms; OpenAI does not use this data to train its models. E-mails about contact requests and tickets go through Resend in the United States, under the EU-US Data Privacy Framework and standard contractual clauses.
Article 13(1)(f) asks you to say, for each transfer, whether an adequacy decision covers it or which safeguard does, and how to get a copy of that safeguard, so ask your vendor which one covers each step. ChatterLab sends its data processing agreement on request: management@sri-group.eu.
Module E (recommended where visitors may share personal matters): sensitive details.
Please keep sensitive details out of the chat. The chat is for questions about [Subject]. Please do not type health information, financial or identity details, or information about other people. If such details reach us anyway, we delete the conversation when we find them. We check conversations [Frequency].
The CNIL recommends this pair for sensitive data nobody planned to collect: a warning before the chat is used, and a purge, immediate or at least regular. Put the warning in the chat as well.
Module F (optional): retention.
How long we keep chat data. We keep conversations for [Period] after the last message and then delete them. A conversation that becomes a complaint, an order or a claim is kept as long as that file. Contact details: [Period]. Questions answered by e-mail: [Period] after they are solved. Files: [Period].
Only promise what happens. ChatterLab does not delete conversations by itself: you erase them one at a time with Delete in Activity, or over the API from the Studio plan up.
Module G (recommended): rights in a chat without accounts.
Your rights. You can ask us what we hold about you and for a copy, and ask us to correct or delete it, to limit its use, or to stop using it where we rely on our legitimate interest. Where the law gives that right, you can also receive your data in a commonly used format. You can withdraw consent at any time. The chat does not ask who you are, so tell us roughly when you chatted and something you wrote; we may ask for a detail that shows the conversation is yours. Write to [E-mail address]; we answer within one month. You can also complain to the data protection authority of the country where you live, work or think your rights were infringed: [Authority name and website].
This follows Articles 12, 15 to 21 and 77 of the GDPR.
Wording to leave out
- "We may use your chats to improve our services." The transparency guidelines of the former Article 29 Working Party, endorsed by the EDPB, list "may", "might", "some" and "possible" as qualifiers to avoid. Say what you do: "we read conversations to correct wrong answers".
- "No data leaves the EU." Untrue as soon as one step, such as search vectors or e-mail, runs elsewhere, and Article 13(1)(f) requires you to name the transfer.
- "The chat is anonymous." The CNIL notes that a chatbot often processes personal data, for example to keep a record of the conversation, even when nobody creates an account.
- "By sharing sensitive information, you consent to its use." A published chatbot notice we read says much the same: a visitor who volunteers sensitive information gives explicit consent. For sensitive data nobody planned to collect, the CNIL's advice is a warning and a purge, not consent.
- "Please check this page regularly for changes." The same guidelines call this "not only insufficient but also unfair", and treat new recipients or a new transfer outside the EU as a change to announce effectively.
- A link to the vendor's privacy policy instead of your own text. You are the controller and the duty to inform is yours. ChatterLab's own privacy notice tells visitors to ask the website they were talking to.
How long to keep chat logs
The GDPR sets no period. Article 5(1)(e) allows no longer than the purpose needs, recital 39 asks the controller to set time limits for erasure or periodic review, and Article 13(2)(a) asks you to state the period or the criteria. The CNIL adds a distinction: a chat that helped with a purchase should be erased when the conversation ends, while a complaint about a product bought may justify keeping it longer.
The example choices below are illustrations, not legal norms:
| Record | What sets the clock | Question to answer | Example of a choice |
|---|---|---|---|
| Chats that ended with an answer | Answering, then reviewing answers | How often do you review conversations? | Three months, if you review them monthly |
| Chats that became a complaint or order | That case | How long can the matter come back? | Copy what you need into the case file, then delete |
| Contact details from the chat | Contacting the visitor; marketing with consent | When is a lead no longer worth contacting? | ChatterLab default: 3 years |
| Questions answered by e-mail | Answering and follow-up | How long after solving does a reply still arrive? | ChatterLab default: 2 years after solving |
| Files visitors send | Reading them for the answer | Do you need the file once answered? | ChatterLab default: 30 days |
| Sensitive details nobody asked for | None | None | Delete when found |
Write the number into module F and give someone the task of deleting on schedule.
The AI notice belongs in the chat itself
Article 50(1) of the EU AI Act requires that people interacting with an AI system are told so, and Article 50(5) says clearly and at the latest at the first interaction. It has applied since 2 August 2026; the Digital Omnibus on AI of 8 July 2026 kept that date and, within Article 50, postponed only machine-readable marking for generative systems already on the market. A sentence in your privacy notice cannot do this job: the notice is not part of the conversation. Our guide to AI notice wording has texts to copy; in ChatterLab, "You're chatting with an AI assistant" opens every conversation in the widget's language and cannot be removed. The wider rules are on our AI Act page.
In a joint call on 2 October 2025, the Dutch data protection authority (AP) and consumer authority (ACM) said that organisations using chatbots must always offer people a way to talk to an employee. The base paragraph's line about another way to reach you serves that end. Whether the chat needs cookie consent is a separate ePrivacy question: see chatbots and cookie consent.
When a visitor asks what you hold about them
- Ask for the when and the what: roughly when they chatted, the page, a phrase they typed. In ChatterLab the visitor number only links one visit's messages and says nothing about who the person is. If your site tells the chat who a signed-in visitor is, the conversation carries your own id for that visitor.
- Check it is theirs. Article 12(6) lets you ask for more information when you have reasonable doubts about identity; do not hand a stranger's chat to someone who guessed a date. If you cannot identify them, Article 11(2) asks you to say so.
- Answer within one month (Article 12(3)), extendable by two months where the complexity or number of requests makes it necessary.
- Send a copy that holds only theirs (Article 15(3)). In Activity, Export PDF covers every conversation in the dates you pick, so check the file before you send it.
- Name the recipients. In case C-154/21 (12 January 2023) the Court of Justice held that the right of access covers the actual identity of recipients, unless that is impossible or the request is manifestly unfounded or excessive.
- Erase when asked (Article 17). Delete at the top of a conversation erases it with its messages, its lead, its files and its ticket, for good. Delete file removes one file; Leads and Tickets have their own Delete.
ChatterLab does not answer such requests in your place: the data, and the reply, are yours.
Does a chatbot need a DPIA?
Article 35 requires a data protection impact assessment where processing, "in particular using new technologies", is likely to result in a high risk. The EDPB-endorsed DPIA guidelines list nine criteria and say that in most cases two of them call for a DPIA. For a chat the relevant ones are sensitive or highly personal data, large scale, vulnerable people such as children or patients, and innovative use of technology; in its recommendations on developing AI systems, the CNIL counts generative AI whose behaviour cannot be anticipated in every case as innovative use. On that reading, a generative chat plus health questions, a young audience or very large volumes points to a DPIA. That is an interpretation, not a rule written in the GDPR.
A small shop's chat about delivery and returns, with no accounts, no sensitive topics and short retention, meets one criterion at most, so a DPIA is not presumed. The guidelines still recommend one where it is unclear, and documenting your reasons where you decide against it. National lists under Article 35(4) add cases: Belgium's covers large-scale or systematic processing of communication data not strictly necessary for a service the person asked for, and Ireland's Data Protection Commission calls a DPIA good practice for any major new project.
Checklist before you publish the new notice
- The chat shows the AI notice and links to the privacy notice before the first message. Article 13(1) GDPR and Article 50(5) AI Act.
- The controller, a contact address and any DPO are named. Article 13(1)(a) and (b).
- Every recipient is named, including the AI provider and sub-processors, and a data processing agreement is signed. Articles 13(1)(e) and 28(3).
- Every transfer outside the EEA is listed with its safeguard. Article 13(1)(f).
- Each purpose has a legal basis, and a legitimate interest is spelled out with the right to object. Articles 13(1)(c), (d) and 21.
- Every retention period is one you enforce. Article 5(1)(e); with ChatterLab, you delete conversations yourself or over the API.
- The chat asks visitors not to share sensitive details, and someone purges what arrives anyway. The CNIL's advice.
- The request route is tested once: find a test conversation, copy it, delete it. Articles 12(3), 15 and 17.
For the wider picture, see our GDPR page, the EU hosting checklist and the data processing agreement checklist.
Questions about chatbot privacy notices
Do I need to update my privacy notice when I add a chatbot?
Yes, if the chat records what visitors type, which almost every chat does. Article 13 of the GDPR requires you to tell visitors, when you collect their data, who you are, why you process it and on which legal basis, who receives it, any transfer outside the EU, how long you keep it and what their rights are. A notice written before the chat existed names neither the chat vendor nor the AI provider.
Which legal basis applies to a website chatbot?
No regulator text cited here assigns one basis to every chatbot. For a chat that answers questions visitors choose to ask, legitimate interest (Article 6(1)(f)) is the usual candidate, provided your documented three-step test holds; public authorities cannot use it for their tasks. Questions about your products or an offer can rest on pre-contract steps (Article 6(1)(b)), which the EDPB accepts for enquiries about a service. Marketing needs consent, and sensitive topics need an Article 9 exception.
Do I need consent to use a chatbot on my website?
Usually not for the conversation itself: legitimate interest or pre-contract steps can cover answering questions. Consent comes in for marketing, since e-mail marketing needs prior consent under the ePrivacy Directive, and for health or other sensitive topics you plan to handle in the chat. Whether the widget's storage in the browser needs consent is a separate question under the ePrivacy rules on cookies and similar technologies.
How long may I keep chatbot conversations?
The GDPR sets no period. Article 5(1)(e) allows no longer than the purpose needs, and recital 39 asks you to set deadlines for deletion or periodic review. The CNIL distinguishes chats that should be erased when the conversation ends from chats you may keep longer, such as a complaint about a purchase. Choose a period per type of record, write it in your notice and make sure something actually deletes on time.
Do I have to name the AI provider in my privacy notice?
Article 13 allows "recipients or categories of recipients", but the transparency guidelines endorsed by the EDPB say named recipients are generally the most meaningful for people, and processors count as recipients. A visitor who asks for access is entitled to the actual identity of the recipients, as the Court of Justice held in case C-154/21 in January 2023. Naming the chat vendor and the AI provider now saves you that answer later.
Do I need a separate privacy notice for the chatbot?
No. A section in your main privacy notice works, as long as the chat links to it before the first message and the section is easy to find. Regulators encourage layered information: a short line in the chat, and the full section one click away. A separate page can help when one chat runs on several websites, or when the chat processes data the rest of your site does not touch.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, read on 25 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, read on 25 October 2026.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, read on 25 October 2026.
- Directive 2002/58/EC (ePrivacy Directive), consolidated text, Official Journal of the European Union, read on 25 October 2026.
- Judgment in case C-154/21, Österreichische Post, 12 January 2023, Court of Justice of the European Union, read on 25 October 2026.
- Guidelines on transparency under Regulation 2016/679 (WP260 rev.01), Article 29 Working Party, endorsed by the EDPB, read on 25 October 2026.
- Guidelines on Data Protection Impact Assessment (WP248 rev.01), Article 29 Working Party, endorsed by the EDPB, read on 25 October 2026.
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0, European Data Protection Board, read on 25 October 2026.
- Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR, European Data Protection Board, read on 25 October 2026.
- CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR, European Data Protection Board, read on 25 October 2026.
- Chatbots : les conseils de la CNIL pour respecter les droits des personnes, CNIL, read on 25 October 2026.
- IA : Réaliser une analyse d'impact si nécessaire, CNIL, read on 25 October 2026.
- Recomendaciones para usuarios en la utilización de chatbots con inteligencia artificial, Agencia Española de Protección de Datos, read on 25 October 2026.
- Recht op informatie, Autoriteit Persoonsgegevens, read on 25 October 2026.
- AP en ACM: chatbot mag mens niet volledig vervangen bij klantenservice, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Décision n° 01/2019 du 16 janvier 2019 (list of processing that requires a DPIA), Belgian Data Protection Authority, read on 25 October 2026.
- Data Processing Operations that require a Data Protection Impact Assessment, Data Protection Commission (Ireland), read on 25 October 2026.
- Data Governance & Controls, Cortecs, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.