Does a chatbot need a privacy policy? What to tell the people who chat

Usually, yes. A chat window collects personal data: what visitors type, often a name or email, and an IP address. Article 13 of the GDPR says a business that collects personal data tells people, at that moment, who it is, why it wants the data, who receives it, how long it keeps it and their rights.

California's privacy law asks the larger businesses it covers for a similar notice. Below is what the official texts and the UK regulator's guidance say, read on 13 October 2026, and a checklist for the chat part of your notice. This is not legal advice.

Is chat data personal data?

In most chats, yes. Article 4 of the GDPR defines personal data as any information relating to an identified or identifiable person, including by “an online identifier”. People give a name, an order number or an address in their messages, a pre-chat form asks for an email, and the software sees the IP address, browser and page and stores a cookie or ID to keep the conversation together. Some chat tools also remember returning visitors or record the pages they view.

What does a privacy notice need to include under GDPR?

The list is in Article 13 of Regulation (EU) 2016/679, which covers data “collected from the data subject”, as in a chat. EUR-Lex still shows the 2016 text as current; two 2025 amendment proposals have not changed it. At the time the data are obtained, the business (the controller) provides:

• its identity and contact details, and those of its data protection officer or representative where it has one;
• the purposes of the processing and the legal basis for it;
• the legitimate interests it pursues, where that is the basis;
• the recipients or categories of recipients;
• any transfer to a country outside the EU, with the safeguard used;
• how long the data will be stored, or the criteria used to decide;
• the rights of access, rectification, erasure, restriction, objection and data portability, the right to withdraw consent where consent is the basis, and the right to complain to a supervisory authority;
• whether giving the data is a statutory or contractual requirement, and what happens if someone does not give it;
• any automated decision-making, including profiling, with legal or similarly significant effects, as Article 22 describes it.

Article 12 sets the style: “a concise, transparent, intelligible and easily accessible form, using clear and plain language”. Article 13(4) lets a business leave out what the person already has.

Which lawful basis covers a chatbot?

The notice names a legal basis for each purpose, and Article 6(1) offers six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Point (b) includes steps taken “at the request of the data subject prior to entering into a contract”, and point (f) covers legitimate interests unless they are “overridden by the interests or fundamental rights and freedoms of the data subject”. Answering a question, taking a booking and sending marketing later can rest on different bases, so settle each with whoever advises you on data protection.

Who are the recipients when a chatbot uses AI?

An AI chat usually passes messages to at least two outside companies: the one that runs the chat software and the one whose model writes the replies. The GDPR defines a recipient as anyone personal data are disclosed to, “whether a third party or not”. If either company handles the data outside the EU or the UK, Article 13(1)(f) adds that transfer and its safeguard to the notice.

A company that handles data “on behalf of the controller” is a processor. Under Article 28 a contract governs its work: it acts “only on documented instructions from the controller” and brings in another processor only with the controller's written authorisation. In an AI chat, that other processor is often the model provider.

When and where should visitors see it?

The UK regulator says it plainly in its right to be informed guidance: “You must provide privacy information to individuals at the time you collect their personal data from them.” A page on your website can do it, “but you must make individuals aware of it and give them an easy way to access it.” The ICO calls it good practice “to use the same medium you use to collect personal data to deliver privacy information”, and suggests layered and just-in-time notices. The page notes it is under review after the Data (Use and Access) Act.

For a chat, a layered notice is one short line in the chat window or the pre-chat form, saying who runs the chat, with a link to your full privacy notice. Whether that line should also say the replies come from an AI is a separate question, covered in our post on chatbot disclosure laws.

What California's CCPA asks for at collection

The California Consumer Privacy Act, as amended by the CPRA, covers for-profit businesses that do business in California and meet one of three thresholds in Civil Code section 1798.140: annual gross revenues above $25 million, as adjusted under the Act; buying, selling or sharing the personal information of 100,000 or more consumers or households; or earning half or more of annual revenue from selling or sharing it.

A business it covers “shall, at or before the point of collection, inform consumers” of the categories of personal information it collects and why, whether that information is sold or shared, the same for any sensitive personal information, and how long it intends to keep each category. That is section 1798.100, which also asks for an agreement with each service provider that receives the data. The Attorney General's CCPA page, updated on 28 August 2026, adds that the notice links to the business's privacy policy, includes a Do Not Sell or Share link if the business sells personal information, and that a link to it might appear “on a webpage where you place an order or enter your personal information”.

Checklist: what a notice covering your chat should say

1. Who runs the chat. Your business name and contact details, plus your data protection officer or EU or UK representative if you have one.
2. What it collects. Messages, any name, email or phone number, IP address, browser, the page, and the cookie or stored ID. Say whether it remembers returning visitors or records pages viewed.
3. Why, and on what basis. Each purpose, such as answering questions, bookings or sales follow-up, with its lawful basis, and the interests you pursue if you rely on legitimate interests.
4. Who receives it. The chat software company, the AI provider that writes the replies, and any tool the chat sends data on to, such as your CRM, email service or WhatsApp.
5. Where it goes. Countries outside the UK or EU, and the safeguard, such as standard contractual clauses.
6. How long you keep it. A period for chat transcripts, or the rule you use to decide.
7. Their rights and how to use them. The GDPR rights listed above, and the address to write to.
8. What is optional. Whether a visitor has to give an email to get an answer, and what happens if they do not.
9. For California. Categories, purposes, whether anything is sold or shared, how long each category is kept, a link to the privacy policy and, if you sell, the Do Not Sell or Share link.
10. What not to type. A line asking people not to send card numbers, passwords or health details in the chat.

Questions to ask your chat provider

• Which AI providers receive visitors' messages, and in which countries?
• Does anyone train AI models on the chats?
• Is there a data processing agreement, and a list of sub-processors you hear about before it changes?
• Can you delete a conversation, and export or erase everything about one visitor?

If your chat runs on MagizAI

MagizAI's privacy policy lists what passes through the chat window: messages, any name, email or phone a visitor gives, the page, the browser, the IP address and a cookie that keeps one conversation together. Under the data processing addendum, your business is the controller and MagizAI the processor, and telling your visitors about the chat in your own privacy notice stays with you. The sub-processors page says who receives what: OVHcloud runs the server in Singapore, and on plans with AI included the replies come from OpenAI or Anthropic in the United States, or from DeepSeek in China when a chatbot is set to a DeepSeek model. On a BYOK plan the AI provider is your own supplier. Conversations are kept while your workspace exists, and Settings, then Privacy, exports or erases everything about one visitor. One thing to cover in your notice or switch off: “Remember returning visitors” is on when a new chatbot is created.