Can you embed ChatGPT on your website?
No. OpenAI answers the question in its own help centre. Custom GPTs, versions of ChatGPT configured for one purpose, are made to work inside ChatGPT: "They are not a way to embed ChatGPT in an external website or application." For an assistant inside a product of your own, OpenAI points to its API.
The same help centre adds three facts that close the door further:
- A visitor has to be signed in to ChatGPT to start a conversation with a GPT, and whoever built the GPT cannot see those conversations.
- Personal ChatGPT accounts (Free, Go, Plus and Pro) can no longer create or publish new GPTs.
- Custom GPTs are being retired. OpenAI has scheduled the retirement for 11 December 2026 and says the change affects every ChatGPT plan; Enterprise workspaces with an approved deferral have until 11 February 2027. After that date a GPT and its page can no longer be reached.
Note. Everything from OpenAI in this article was read on its own pages on 25 October 2026. Both help articles had been updated in the days before. OpenAI's GPTs page gives the date for Enterprise workspaces and expects other plans to follow, and OpenAI says the notice in your account counts if it gives another date.
What people usually mean by "ChatGPT on my website" does exist, though: a chat window on your own site that answers visitors from your own pages, with an OpenAI model, or another one, writing the answers. There are four ways to get there.
Four ways to put an OpenAI-powered chatbot on your site
| Route | Effort | Where a visitor's message goes | Your GDPR work | What to check |
|---|---|---|---|---|
| 1. A chatbot platform that answers from your content | Low: add your pages, paste a script tag | To the platform, and to the sub-processors it lists, often a model provider | A processing agreement with the platform; its sub-processor list, with countries | What it stores, for how long, and whether it trains on your data |
| 2. Your own build on OpenAI's API | High: a developer, a server, search over your content, logging and deletion | From your server to OpenAI, with no constraint on where it is processed unless you are approved for EU data residency | A processing agreement with OpenAI, retention settings, a transfer safeguard, the AI notice, a deletion process | OpenAI's storage defaults (next section), your API key, answers that stray from your content |
| 3. A plugin that wraps the API with your key | Low to medium | To OpenAI under your account, plus wherever the plugin stores the chats | As for route 2, plus an agreement with the plugin's maker if its servers see the chats | Whether it calls OpenAI from your server or from the visitor's browser, where it keeps chats, whether it is still maintained |
| 4. A link to a custom GPT | Very low | To ChatGPT, under the visitor's own account | Little: OpenAI is the controller of the visitor's use of ChatGPT | Visitors need an account, you see nothing, and GPTs are scheduled to retire on 11 December 2026 |
If nobody on your team writes code, the real choice is between routes 1 and 3. If someone does, route 2 gives you full control and every duty that comes with it. OpenAI's own embeddable chat interface, ChatKit, belongs there too: it needs a session created on your server, and OpenAI's documentation says Agent Builder, the hosted option behind one of its two setups, is scheduled to shut down on 30 November 2026. Route 4 is the only one where the conversations are not yours to look after, and the only one with an end date.
What OpenAI's own terms say
The terms below decide most of your GDPR work on routes 2 and 3, and they are worth knowing when a platform tells you it runs on OpenAI.
| Question | What OpenAI's documents say |
|---|---|
| Its role | A processor acting on your behalf, under its Data Processing Addendum, effective since 1 January 2026. For a business in the EEA or Switzerland, the contracting party is OpenAI Ireland Ltd. |
| Signing it | The addendum says it is incorporated into OpenAI's Services Agreement, which a customer accepts by clicking "I agree", accepting an order form or using the services. OpenAI also offers a form to sign it. |
| Training | Data sent to the API has not been used to train OpenAI's models since 1 March 2023, unless you opt in. |
| Default retention | Abuse-monitoring logs, which can hold prompts and responses, are kept for up to 30 days. |
| Storage that is easy to miss | The Responses API keeps response data for at least 30 days by default, or whenever its store setting is on. Conversations and ChatKit threads are kept until you delete them, and zero data retention does not cover them. |
| Zero data retention | Exists for eligible endpoints, after OpenAI approves it. |
| Transfers | When OpenAI Ireland sends data from the EEA to affiliates or others outside it, it relies on standard contractual clauses or a Commission adequacy decision (section 4.1). |
| Your share | You are responsible for configuration choices such as retention periods and deletion (section 3.3). |
EU data residency, precisely. OpenAI offers it for API projects in "Europe (EEA + Switzerland)": for supported endpoints and models, your content is stored at rest in Europe and the model runs there too. It comes with conditions. You ask OpenAI's sales team whether you are eligible. Outside the US region you must be approved for zero data retention or modified abuse monitoring, and sign a Modified Retention amendment. A region is set when you create a new project; regional processing can also be chosen per request, under the same eligibility and retention rules. It does not cover system data such as account details, usage statistics and billing. And models released from 5 March 2026 onwards cost 10% more on these endpoints.
What the documents do not say. Neither the addendum nor OpenAI's EU privacy policy mentions the EU-US Data Privacy Framework, and the framework's official list showed no participant named OpenAI when we searched it on 25 October 2026. The Commission's adequacy decision for the United States covers only organisations on that list. As far as OpenAI's own documents go, the safeguard left to name in your privacy notice is the standard contractual clauses. Whether a chatbot needs EU hosting at all is a separate question, worked through in our EU-hosting checklist.
The GDPR questions each route raises
You are the controller. You decide why the chat exists and what happens to what visitors type, which makes you the controller (Article 4(7) of the GDPR). A platform or OpenAI processes the messages on your behalf as a processor (Article 4(8)), and Article 28(3) requires a contract that sets out what it may do with them. When a platform uses OpenAI, OpenAI is the platform's sub-processor. Route 4 is the exception: the visitor uses OpenAI's own service, and OpenAI's EU privacy policy names OpenAI Ireland Limited as the controller for its users in the EEA. Our DPA checklist lists what the agreement must contain.
Visitors will type personal data. Take this message: "Hi, it's Anna. Order 10442 never arrived and I move house on Friday, can you check?" A name, an order that leads to an address, a detail of her life. The EDPB's ChatGPT taskforce wrote, about ChatGPT itself, that a public chatbot should expect people to enter personal data, and that a clause making users responsible for their input does not shift the responsibility to them (report of 23 May 2024, paragraphs 24 and 25). In our reading that holds for the chat on your site too: say what not to share, and plan as if people will share it anyway.
A legal basis for each purpose. Of the six in Article 6(1), the two usually weighed for a chat that answers questions are point (b), steps the visitor asked for or a contract, and point (f), legitimate interests after a balancing test. Which one fits depends on what your chat does, so write down the choice and the reasoning. Reusing chats for another purpose, such as training a model or marketing, runs into Article 5(1)(b). And if the chat invites sensitive details, as a clinic's would, check whether Article 35 requires an impact assessment.
Tell visitors where their words go. Article 13 requires that people are told, when their data is collected, the purpose and legal basis (13(1)(c)), who receives the data (13(1)(e)), whether it goes to a third country and under which safeguard (13(1)(f)), and how long it is kept (13(2)(a)). For a route 2 build with store switched off and OpenAI's default abuse monitoring, a paragraph like this covers the chat. It is an example to adapt and have checked:
Our website has a chat assistant that answers questions with an AI model from OpenAI. We use what you type to answer your question, on the legal basis of [your legal basis]. It is sent to OpenAI, which processes it on our behalf under a data processing agreement and may keep it for up to 30 days to detect misuse. OpenAI may process it outside the European Economic Area, under the European Commission's standard contractual clauses. We keep conversations for [your retention period] and then delete them. Please do not share health or financial details in the chat. To see or delete your conversation, write to [your contact address].
If OpenAI also stores the chats (store on, Conversations or ChatKit threads), the third sentence must say for how long. With zero data retention or EU data residency, change the third and fourth sentences. A complete notice is in our chatbot privacy notice template.
Accuracy is a data protection duty. Article 5(1)(d) requires personal data to be accurate. The taskforce noted that users are likely to take ChatGPT's answers as fact, including what it says about individuals, and that warning them does not by itself meet the accuracy principle (paragraphs 30 and 31). OpenAI's own privacy policy tells users not to rely on the factual accuracy of its models' output. A chat that answers only from your pages, and says so when they do not cover a question, narrows the room for invented answers. It does not close it, so test before launch.
The AI notice comes with the chat, not with the model
Article 50(1) of the AI Act requires providers to design AI systems that talk with people so that those people are told they are dealing with an AI, unless that is obvious. Article 50(5) adds that this must happen clearly and at the latest at the first interaction. The rule has applied since 2 August 2026.
Embedding does not make the duty disappear; it decides who carries it. The Act calls whoever develops a system and puts it into service under their own name the provider (Article 3(3)), and whoever uses it under their authority the deployer (Article 3(4)). On a platform, the platform provides the chat and should build the notice in; as deployer you should not hide or undo it. On the usual reading of Article 3(3), building your own chat on OpenAI's API makes you its provider. The notice is then yours to build, and so is the machine-readable marking of its answers that Article 50(2) asks of systems that generate text (a system already on the market before 2 August 2026 has until 2 December 2026 for the marking, under Article 111(4)). In that reading, the OpenAI model underneath does not move either duty to OpenAI.
Provider or deployer works through the cases, our AI notice examples give wording you can use, and the AI Act page summarises the rule.
A checklist before you go live
Ten checks for any of the four routes, each with its reason, so you can see which ones your setup already answers.
- Draw the path of one message. From the visitor's browser to every service that stores or reads it, with the country of each. Your privacy notice starts from this (Article 13(1)(e) and (f)).
- A processing agreement with every processor. OpenAI's addendum for route 2, the platform's agreement for route 1, and the plugin maker's if its servers see the chats (Article 28(3)).
- Training off, confirmed. The API does not train on your data by default; a consumer ChatGPT account may. Check every service in the path.
- Retention set on purpose. OpenAI keeps abuse-monitoring logs for up to 30 days, and the Responses API stores responses unless store is off. Choose your own period and delete on schedule (Article 5(1)(e)).
- Transfers named. Which steps leave the EEA, and the safeguard for each (Articles 44 to 46). Ask a platform for its sub-processors and their countries; our GDPR page lists ours.
- A legal basis, written down. One per purpose, with the reasoning (Article 6(1)).
- The AI notice at the first message. Inside the chat, not only in your privacy notice (AI Act, Article 50(1) and (5)).
- Answers from your own content, tested. Ask questions you know the answers to and questions it should decline, and read every answer (Article 5(1)(d)).
- One person's chat, found and deleted. Visitors may ask for access or erasure (Articles 15 and 17); on route 2 that is a feature someone has to build.
- Nothing stored in the browser without need. Storing or reading information on a visitor's device needs consent unless it is strictly necessary for a service they asked for (ePrivacy Directive, Article 5(3)). Chatbots and cookie consent has the details.
How ChatterLab does it
ChatterLab is route 1: a platform that answers from your own content. Briefly, and with what it does not do:
- Roles. You are the controller and ChatterLab is your processor. A data processing agreement is sent on request: write to management@sri-group.eu. We do not train models on your content or on your visitors' conversations.
- The model. Answers are written through Cortecs, a European model gateway. You choose the model per agent from a list of models by several makers, so an agent is not tied to ChatGPT or to any one model.
- The two steps in the United States. To search by meaning, the text of your sources and of each question is turned into search vectors at OpenAI in the United States, under its data-processing terms; OpenAI does not use this data to train its models. OpenAI's published default is to keep abuse-monitoring logs of such requests, which can contain the text, for up to 30 days. The e-mails we send go through Resend, also in the United States. The application, the database and file storage run in the EU. Data and privacy lists every step.
- Answers from your sources. The model is told to answer only from the passages found in your sources and from your instructions, and to say so when they do not contain the answer. Each answer carries a confidence score, and answers not flagged as weak also get a grounding check; you see both, visitors do not. Training a chatbot on your own data explains how.
- The AI notice. Built into the widget in the widget's language. No plan or setting removes it, and answers are marked as AI-generated in the page's code.
- What stays yours. Your privacy notice, your legal basis and your retention period. Conversations are kept until you delete them; nothing deletes them automatically.
The Free plan has 100 credits a month, enough to try it on your own pages.
Questions about ChatGPT on a website
Is ChatGPT GDPR compliant?
There is no simple yes or no. Compliance depends on how a service is used, not on the product alone, and European regulators were still investigating ChatGPT when their joint taskforce published preliminary views on legal basis, transparency and accuracy in May 2024. For your website the useful question is whether your own setup complies: a processing agreement, a legal basis, named transfers, a retention period and an AI notice, as in the checklist above.
Can I use the free version of ChatGPT for my customers?
Not on your website: ChatGPT cannot be embedded, and a custom GPT needs the visitor's own ChatGPT account. Pasting customers' messages into a personal account raises a different problem. On consumer plans, Free included, OpenAI says conversations may be used for training unless the user opted out, and OpenAI acts as controller under its own privacy policy. It offers its data processing addendum for ChatGPT Business, ChatGPT Enterprise and the API.
Does OpenAI train on my visitors' chats?
Not through the API, by default. OpenAI's documentation says data sent to the API has not been used to train its models since 1 March 2023 unless you opt in, and data from ChatGPT Business and Enterprise is not used by default either. Consumer accounts differ: there, conversations may be used for training unless the user has opted out. Check this for every service your chat passes through, a platform included.
Do I need a data processing agreement with OpenAI?
If your own build sends visitors' personal data to OpenAI's API, yes: OpenAI then processes it on your behalf, and Article 28(3) of the GDPR requires a contract. OpenAI's addendum says it is incorporated into its Services Agreement, which you accept by using the services, and there is a form to sign it. On a platform, your agreement is with the platform; if it uses OpenAI, OpenAI belongs on its list of sub-processors.
Is a ChatGPT chatbot on my website legal in the EU?
Yes, a chatbot that answers visitors' questions is allowed, within two sets of rules. The GDPR asks for a legal basis, clear information, a processing agreement and a safeguard for any transfer out of the EEA. The AI Act asks, since 2 August 2026, that people are told they are talking to an AI at the latest at the first interaction. Using it to screen job applicants or score creditworthiness falls under the high-risk list in Annex III.
What is the cheapest way to add ChatGPT to a website?
In money, a platform's free tier; OpenAI's API itself is priced per million tokens. In work, the API costs most: someone has to build the search over your content, the chat window, logging, deletion and the AI notice, and set OpenAI's retention options. A platform does that once for many customers. ChatterLab's Free plan has 100 credits a month, enough to test an agent on your own pages first.
Sources
- GPTs in ChatGPT, OpenAI Help Center, read on 25 October 2026.
- Custom GPT retirement and migration FAQ, OpenAI Help Center, read on 25 October 2026.
- Data controls in the OpenAI platform, OpenAI, read on 25 October 2026.
- ChatKit, OpenAI, read on 25 October 2026.
- Pricing, OpenAI, read on 25 October 2026.
- OpenAI Data Processing Addendum, OpenAI, read on 25 October 2026.
- Enterprise privacy at OpenAI, OpenAI, read on 25 October 2026.
- EU Privacy Policy at OpenAI, OpenAI, read on 25 October 2026.
- Data Privacy Framework List, U.S. Department of Commerce, read on 25 October 2026.
- Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, EUR-Lex, read on 25 October 2026.
- Report of the work undertaken by the ChatGPT Taskforce, European Data Protection Board, 23 May 2024, read on 25 October 2026.
- Regulation (EU) 2016/679, the General Data Protection Regulation, EUR-Lex, read on 25 October 2026.
- Regulation (EU) 2024/1689, the AI Act, consolidated text of 27 July 2026, EUR-Lex, read on 25 October 2026.
- Directive 2002/58/EC, the ePrivacy Directive, consolidated text, EUR-Lex, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.