A GDPR checklist for AI chatbots

A chat widget collects personal data — the message text, often an email address, usually an IP. Adding AI puts a second processor in the chain. None of that is a problem, but it does mean a few things have to be true.

1. Tell people it is AI

Visitors should not have to guess whether they are talking to a person. A short, visible line does the job, and it is increasingly an explicit expectation in EU rules rather than just good manners.

2. Know your lawful basis

For answering a question someone typed, legitimate interest is usually the sensible basis. If you store the conversation for longer than the exchange, or use it for marketing, be able to explain why. If you require consent, gate the first message rather than burying it in a banner.

3. Name your processors

Your privacy policy should say that questions are sent to an AI provider, name it, and say roughly where it processes them. If your chatbot is a hosted widget, the vendor is a processor too — and their sub-processors are yours by extension.

4. Store less, and not forever

• Truncate IP addresses before storing them. Full precision buys you nothing.
• Set a retention period and let old conversations delete themselves.
• Keep internal notes out of anything a visitor can request or export.

5. Make erasure real

A visitor should be able to ask for their conversation to be deleted, and the deletion should reach everything: the transcript, the lead record, ratings, and any files they uploaded. A “we will look into it” mailbox is not a process.

6. Check what happens when you uninstall

Plugins that leave tables and options behind after deletion are leaving personal data behind. Either it removes everything on request, or you have to clean up manually — but you should know which.

Why self-hosting simplifies most of this

With a plugin, conversations sit in your own database under your own policy, and the only external processor is the AI provider you chose. With a hosted widget you inherit the vendor’s data location, retention and sub-processor list, and you have to document all of it anyway.

Questions