Shopxare Team
Short answer: A live chat can be used in line with the GDPR, but no tool is "GDPR compliant" on its own. Compliance depends on how you set it up. You need a data processing agreement with the chat provider, a privacy policy that names the chat, a decision on when the chat script loads (on page view, after cookie consent or on click), a retention rule for old conversations and, since 2 August 2026, a chatbot that people can recognise as AI. The ten checks below take about an afternoon for a small online store.
Most pages on this topic were written for the GDPR's start in 2018. Three things have changed since then: German regulators now say a chat box is an add-on and not part of the page a visitor asked for (2024), the transparency rule for AI chatbots in the EU AI Act applies from 2 August 2026, and the UK relaxed some cookie rules in February 2026. This checklist covers all three.
This is a practical summary, not legal advice. If you process health data, run a large shop or sell to children, talk to a data protection lawyer.
What the law asks of a website chat
| Rule | What it means for your chat | Source |
|---|---|---|
| GDPR Art. 6(1)(b) and (f) | Answering order and product questions is usually covered by "contract" or "legitimate interest". You rarely need consent for the conversation itself. | GDPR text |
| GDPR Art. 13 | Your privacy policy must say who receives chat data, why, on which legal basis, for how long and whether it leaves the EU. | GDPR |
| GDPR Art. 28 | You need a written contract (DPA) with the chat provider. | GDPR |
| GDPR Art. 44–46 | Data sent outside the EU needs an adequacy decision or safeguards such as standard contractual clauses. | GDPR |
| ePrivacy Directive Art. 5(3) | Storing or reading anything on the visitor's device needs consent, unless it is strictly necessary for a service the visitor asked for. | Directive 2002/58/EC |
| EU AI Act Art. 50(1) | From 2 August 2026, people must be told when they talk to an AI system, unless it is obvious. | European Commission FAQ, July 2026 |
The 10-point checklist
1. Sign a data processing agreement with your chat provider
Your chat provider stores your customers' messages for you, which makes it a processor under Art. 28 GDPR. The contract must bind it to your instructions, confidentiality, security measures, rules for sub-processors, help with data requests, and deletion when you leave. Most providers offer a standard DPA you can accept online. Save a copy with the date. If a provider offers no DPA at all, choose another provider.
2. Know where the data goes
Ask three questions: in which country are conversations stored, which sub-processors see them (hosting, email, AI model), and on what basis data goes outside the EU.
For US providers, the EU–US Data Privacy Framework has been in place since July 2023 (Implementing Decision (EU) 2023/1795). The EU General Court upheld it on 3 September 2025 in Latombe v Commission (T-553/23), and an appeal is pending at the Court of Justice as case C-703/25 P (Official Journal notice, December 2025). US tools are allowed today if the provider is certified. Keep in mind that the framework could fall, as its two predecessors did.
3. Decide when the chat script loads
This is where most stores get stuck. A chat widget loads a script from the provider's server, which sends the visitor's IP address to that server, and it usually stores something in the browser so the conversation survives a page change.
Germany's data protection authorities wrote in their guidance on digital services (version 1.2, November 2024) that chat boxes are add-on features. A visitor who opens a page has not asked for the chat yet. Storage that the chat needs can count as strictly necessary only once the visitor actually uses it, for example by clicking it (DSK Orientierungshilfe Digitale Dienste, para. 74–80). That is the strictest published reading in the EU, and it is a safe standard if you sell into Germany.
| Load on every page view | Load after cookie consent | Load when the visitor clicks a chat button | |
|---|---|---|---|
| Visitor data reaches the provider | As soon as the page opens | After the visitor accepts | After the click |
| Who can start a chat | Everyone | Only visitors who accepted | Everyone, with one extra click |
| Proactive messages, live visitor list | Yes | Only after consent | Not before the click |
| Risk under a strict reading | Highest | Low | Low |
Our view: for a store selling in the EU, load the chat after consent or on click. Click-to-load keeps the chat open to every visitor; consent-gated loading keeps proactive messages for those who said yes. If you install the chat through Google Tag Manager, you can switch its trigger from "All Pages" to the consent event your banner sends (how to add the chat through Tag Manager).
In the UK, the Data (Use and Access) Act 2025 added new cookie exemptions, including one for website functionality where you inform visitors and give them a simple way to object. They apply from 5 February 2026 (Schedule 12). A UK-only store has more room than an EU one.
4. Add the chat to your privacy policy
Write a short section, in plain words, with what Art. 13 GDPR requires:
Live chat. When you use the chat on our website, we process your messages, your name and email address if you give them, your IP address and the pages you visited. We use this to answer your questions (Art. 6(1)(b) GDPR) and, for visitors without an order, on the basis of our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The chat is provided by [provider, address], which processes the data on our behalf. Data is stored in [country]. [If AI answers: Some answers are written by an AI assistant; your message is sent to [AI provider] for this.] We delete conversations [12] months after the last message.
If your team can see what visitors type before they press send (a "typing preview"), mention it there too.
5. Ask only for what you need
A pre-chat form that asks for name, email, phone and company before the first message collects more than most questions need. Ask for an email only if you want to answer by email when nobody is online. For "where is my order", the order number is enough.
6. Keep card numbers and passwords out of the chat
Customers paste card numbers and passwords into chat windows. Tell them not to in the greeting of your payment pages, and turn on masking if your tool has it. In Shopxare, Settings → General → Hide card numbers and passwords masks card numbers (all but the last 4 digits), security codes and passwords in customer messages (workspace settings).
7. Set a retention period and handle erasure requests
Art. 5(1)(e) GDPR says you keep data no longer than necessary, and Art. 17 gives customers the right to have it erased. Pick a period that matches why you keep chats, for example the end of the return and warranty window, write it into your privacy policy and delete older conversations on a fixed date every quarter. When a customer asks for deletion, delete the contact and the conversations together, then confirm it to them in writing.
8. Make the AI recognisable as AI
From 2 August 2026, Art. 50(1) of the AI Act requires that people are told they are talking to an AI system unless it is obvious. The duty is placed on the provider of the AI system, and the EU's "Digital Omnibus" did not postpone it (Regulation (EU) 2026/1744). As the store, you control the name and the first line. Don't call your bot "Anna" with a stock photo. Call it "AI assistant" and say in the first answer that a person can take over. We covered the difference between bots and agents in AI agent vs chatbot.
9. Control what the AI sends to the model provider
An AI agent sends the customer's message to a language model provider. Check who that provider is, whether it is listed as a sub-processor, and whether personal data can be removed first. In Shopxare, Are AI has a setting Hide personal data from the AI provider that replaces emails, phone numbers and card numbers before the text is sent. You can also choose who the AI answers: everyone, only visitors, or only logged-in users.
10. Limit who can read what
A support inbox holds addresses, orders and complaints. Give each teammate the role they need, and use identity verification so nobody can pretend to be a logged-in customer and read their conversations (roles and permissions, identity verification).
Example: a small German shop going through the list
A two-person shop in Leipzig sells tea on Shopify, mostly to Germany and Austria. The chat has been loading on every page since 2023, the privacy policy doesn't mention it, and Are AI answers shipping questions at night.
In one afternoon they accept the provider's DPA and file it, move the chat snippet into their consent tool so it loads only after "Accept", and add a "Chat with us" link in the footer that loads it on click for everyone else. They add the chat paragraph above to the privacy policy with "12 months" as the retention period, rename the AI from "Lena" to "AI assistant" and turn on masking for card numbers. A visitor asks at 23:10: "Do you sell the Darjeeling loose?" The AI assistant answers from the product pages and says a person will reply in the morning if needed.
Where Shopxare helps, and what you still do yourself
| Check | In Shopxare | Your job |
|---|---|---|
| DPA | Data processing addendum offered on the security page | Sign and file it |
| Data location | Hosted at UpCloud in a European data center, with encrypted copies in a second data center | Name it in your privacy policy |
| Cookies on your domain | The Messenger runs in an isolated frame and sets no cookies on your domain | Decide with your consent tool when the script loads |
| Pre-chat form, typing preview | Settings → Messenger → Features (customize the Messenger) | Ask only what you need, mention typing preview |
| Masking | Hide card numbers and passwords | Turn it on |
| AI data | Hide personal data from the AI provider, name shown to customers | Name the AI as AI |
| Deletion and export | Delete people and their conversations, export contacts to CSV | Set and follow a retention period |
"No cookies on your domain" does not settle the consent question on its own: the ePrivacy rule covers any storage or access on the device, and loading the script sends the visitor's IP address to the provider. That decision stays with you and your consent tool.
When this checklist is not enough
If customers send you health information (a pharmacy, supplements with medical questions), ID documents or data about children, you need more than ten checks: possibly a data protection impact assessment and a data protection officer. The same goes for shops that record calls or use the chat for credit decisions. Ask a specialist.
FAQ
Do I need cookie consent for a live chat?
It depends on the country and on what the chat stores in the browser. Under the strict German reading (DSK, 2024), a chat counts as requested only once the visitor uses it, so load it after consent or on click. A UK-only store has more room since February 2026.
Do I need a data processing agreement with my chat provider?
Yes. The provider stores customer messages on your behalf, which makes it a processor under Art. 28 GDPR, and that requires a written contract.
Must I tell customers they are chatting with an AI?
In the EU, from 2 August 2026, people must be told they are interacting with an AI system unless it is obvious (AI Act Art. 50(1)). The simplest way is a clear name like "AI assistant" and a first line that says a person can take over.
Can I use a US-based chat tool under the GDPR?
Yes, if the provider is certified under the EU–US Data Privacy Framework or offers standard contractual clauses. The framework was upheld by the EU General Court in September 2025, and an appeal is pending.
How long can I keep chat transcripts?
As long as you need them for a stated purpose, such as the return and warranty period, and no longer. Write the period into your privacy policy and delete older conversations on a schedule.
If you want a chat that runs in an isolated frame, is hosted in Europe and lets you hide personal data from the AI, Shopxare has a free plan.
