Topic

Privacy & trust

GDPR, the EU AI Act and data security for chatbots on online stores and service websites: what the rules ask for and how to stay compliant.

1 article

Banner: GDPR-compliant chatbot, a chat bubble protected by a padlock shield inside the ring of EU stars, with cards for the AI notice, DPA, cookies, data deletion and EU data storage.

Privacy & trust

GDPR chatbot checklist for EU online stores (2026)

A 13-point GDPR chatbot checklist for EU online stores: AI Act disclosure, legal basis, cookies, DPA, transfers, retention and vendor questions.

October 22, 2026 13 min read Read more

Start today

See what Ovebot would answer on your own website.

Start the 14-day trial with no card, or ask for a free demo trained on your products or services.

Start free, 14 days, no card See a demo on your site

Live in 5 minutes No developer No card, cancel anytime

Try Demo Start for free

We use cookies

We use cookies to keep the site working, understand how it is used and improve your experience. You choose which categories to allow.

Read our Privacy & Cookie Policy for details.

Customize

Essential cookies

Required for the website to function (security, session and your cookie choices). These cannot be switched off.

ovebotai_cookie_consent

1 year

Stores your cookie consent preferences.
ovebot_website_session

2 hours

Identifies your browsing session.
XSRF-TOKEN

2 hours

Protects you and the site against cross-site request forgery.

More details

Analytics cookies

Google Analytics is on by default so we can understand how the site is used. You can switch it off here or at any time via "Manage cookies". Data is aggregated and IP addresses are anonymised. Microsoft Clarity (heatmaps and session recordings) runs only after you accept this category; what you type in forms is not recorded.

_ga

1 year

Google Analytics: distinguishes individual visitors.
_ga_K60TLF6G3L

1 year

Google Analytics: persists session state.
_gid

1 day

Google Analytics: distinguishes individual visitors.
_clck

1 year

Microsoft Clarity: stores the Clarity visitor ID and preferences, so visits from the same browser are linked.
_clsk

1 day

Microsoft Clarity: links the pages of one visit into a single session recording.
CLID

1 year

Microsoft Clarity: Microsoft cookie (clarity.ms) that recognises the browser across sites using Clarity.
MUID

1 year

Microsoft Clarity: Microsoft cookie (clarity.ms / bing.com) that identifies the browser across Microsoft services.

More details

Marketing cookies

Used to measure advertising and show more relevant content. They enable Google, Meta (Facebook/Instagram), TikTok, OpenAI (ChatGPT) advertising and remarketing signals.

_gcl_au

2 months

Google Ads: stores and measures advertising conversions.
_gcl_aw

2 months

Google Ads: stores and measures advertising conversions.
_gcl_gb

2 months

Google Ads: stores and measures advertising conversions.
__oppref

4 weeks

OpenAI (ChatGPT) Ads: stores the ad click identifier used to measure conversions.
__obref

4 weeks

OpenAI (ChatGPT) Ads: browser identifier used to match conversions.
_fbp

2 months

Meta (Facebook/Instagram) Ads: distinguishes visitors to measure ad conversions.
_fbc

2 months

Meta (Facebook/Instagram) Ads: stores the ad click identifier used to measure conversions.
_ttp

1 year

TikTok Ads: distinguishes visitors to measure ad conversions.

More details

All articles

GDPR chatbot checklist for EU online stores (2026)

See what Ovebot would answer on your own website.