Website Chatbots and GDPR: What to Tell Visitors and What to Store

If you put an AI chatbot on your website and people in the EU or UK use it, GDPR applies to those conversations. In practice that means three things: you're responsible for the data as the controller, your privacy notice has to say what the chatbot collects and who processes it, and you should collect and keep no more than the chatbot actually needs.

I build ChatBento, an AI support chatbot for websites, so I've had to work through this for our own product. This is a practical reading of the rules for a small business, not legal advice. If you handle health, financial or children's data, or you're unsure, talk to a lawyer or your data protection authority.

Does GDPR apply to a website chatbot?

Almost always, yes. GDPR covers "personal data", which is any information about an identifiable person. A chat conversation easily contains some:

• A name or email typed into the chat or a contact form
• An order number, phone number or address
• Anything personal a visitor volunteers: "I'm pregnant, is this safe?", "my account under jane@..."
• Technical identifiers such as an IP address or a visitor ID stored in the browser

You can't control what visitors type. So plan as if every conversation might contain personal data, because some will.

Who is responsible: you or the chatbot vendor?

GDPR splits the roles:

• Controller: decides why and how personal data is processed. For the chatbot on your site, that's you, the business.
• Processor: handles the data on the controller's behalf. That's the chatbot vendor, and in turn the companies the vendor uses (hosting, the AI model provider, email delivery).

Under Article 28, a controller should only use processors that provide "sufficient guarantees" of appropriate security, and the processing has to be governed by a contract that requires, among other things, that the processor acts only on "documented instructions from the controller", keeps the data confidential and secure, and deletes or returns it when the service ends.

What that means for you as a small business:

1. Ask the vendor for its data processing terms (often called a DPA) and its list of sub-processors. A serious vendor has an answer.
2. Check where the data goes. If it leaves the EU, the vendor should say how the transfer is covered.
3. Check whether the AI provider trains on your conversations. You want the answer to be no.

For reference, here's how it works with ChatBento, from our privacy policy: when a visitor uses a ChatBento chatbot on your site, you're responsible for their data and we process it for you. Answers are generated by Anthropic, which does not train its models on this data. Our other providers are Cloudflare (hosting, database and search over your content) and Resend (lead notification emails).

What should your privacy notice say?

Article 13 lists what you have to tell people "at the time when personal data are obtained". For a chatbot, your existing privacy notice probably needs a short new section covering:

• That you use a chatbot and what it collects: messages, the page the visitor was on, any contact details they leave, and technical identifiers.
• Why: to answer questions and follow up on requests.
• The legal basis: commonly legitimate interests for answering questions, or steps toward a contract when someone asks about buying. Pick one honestly and state it.
• Who receives the data: the chatbot vendor and its sub-processors, by name or by category.
• International transfers, if any, and how they're covered.
• How long you keep it (more on this below).
• Visitors' rights: access, correction, deletion, objection, and the right to complain to a data protection authority.

Here's a plain example you can adapt:

Chat assistant. Our website has an AI chat assistant that answers questions using the content of our website. When you use it, we store your messages, the page you were on and a random ID kept in your browser so the conversation continues if you reload. If you leave your name and email, we use them to reply to you. Messages are processed for us by [vendor] and its providers, including [AI provider], to generate answers. We keep conversations for [period] and then delete them. You can ask us for a copy or deletion of your conversation at [email].

Keep it short and readable. Then link to it from the chat itself, or at least from the footer of every page the chat appears on.

Do you need consent for a chatbot?

Usually not for the chat itself. A visitor who opens the chat and types a question is asking you to answer it, and you can generally rely on legitimate interests or pre-contract steps for that. What needs more care:

• Cookies and similar storage. If the widget stores an identifier in the browser, check how your local ePrivacy rules treat it. Storage that's strictly necessary for the service the visitor asked for, such as keeping their own conversation going, is treated differently from tracking. If in doubt, ask your vendor exactly what it stores and why.
• Marketing. Using a chat email address to send newsletters is a different purpose. Ask separately, with a clear opt-in.
• Sensitive data. Health, religion, sexuality and similar "special category" data have stricter rules. If your business is near those areas, tell visitors not to share sensitive details in the chat, and hand those conversations to a person.

What should you store, and for how long?

Two GDPR principles do most of the work here. Article 5 says personal data must be "adequate, relevant and limited to what is necessary" (data minimisation) and kept no longer than necessary (storage limitation).

For a website chatbot, that translates to:

• Don't ask for what you don't need. A name and an email are enough for most follow-ups. Don't make the chat demand a phone number or company size before answering a question.
• Don't let the bot fish for data. An AI that asks "can I get your birthday?" to seem friendly is collecting data you'll have to justify.
• Pick a retention period and stick to it. Conversations are useful for improving answers for a few months. Years of chat logs are a liability. GDPR doesn't set a number, so choose a period you can justify, for example 90 days or a year, and write it in your privacy notice.
• Delete on request. Know how you'd find and delete one person's conversation when they ask.

With ChatBento, conversations and leads are kept until you delete them, delete the chatbot, or close your account, and deleting a chatbot removes its training data, conversations and leads. So the retention decision is yours to make, and to act on.

What does the chatbot itself need to show?

At minimum:

• That it's an AI. In the EU that's now also a separate legal requirement under the AI Act, covered in Does Your Website Chatbot Need an AI Disclosure?
• A link to your privacy notice, near the chat or in the footer of the page.
• A warning before collecting contact details, if your contact form asks for them: a line like "We'll use your email only to reply to this question."

ChatBento's widget labels itself "AI assistant" in the header, and its contact form asks only for a name, an email and a message.

Security basics to check

You're not expected to audit your vendor's servers, but you should know:

• Data is encrypted in transit. The widget and its API should only work over HTTPS.
• The bot can only be used on your site. Look for an allowed-websites setting, so someone can't embed your bot elsewhere and run up conversations in your name.
• Abuse is limited. Rate limits stop one visitor flooding your bot.
• IP addresses aren't kept longer than needed. ChatBento uses visitors' IP addresses only in hashed form to limit abuse and doesn't store them as-is.

A short checklist

• You know you're the controller, and your vendor is a processor
• You've read the vendor's processing terms and sub-processor list
• The AI provider doesn't train on your conversations
• Your privacy notice has a chatbot section (what, why, basis, who, how long, rights)
• The chat links to the privacy notice and says it's an AI
• The contact form asks only for what you need
• You've set a retention period and a reminder to delete old conversations
• You know how to find and delete one person's data on request

The short version

GDPR doesn't stop you running a chatbot. It asks you to be honest about it, to collect only what you need, and to clean up after yourself. Most of that is a paragraph in your privacy notice and a calendar reminder.

You can read exactly how ChatBento handles data in our privacy policy. The chatbot installs with one script tag on any platform (see the install guides), and the free plan lets you check how it works on your own site first.