Privacy & trust

GDPR chatbot checklist for EU online stores (2026)

A 13-point GDPR chatbot checklist for EU online stores: AI Act disclosure, legal basis, cookies, DPA, transfers, retention and vendor questions.

Ovebot Team
By Ovebot Team Published Updated 13 min read
Banner: GDPR-compliant chatbot, a chat bubble protected by a padlock shield inside the ring of EU stars, with cards for the AI notice, DPA, cookies, data deletion and EU data storage.

A GDPR chatbot for an online store is one that tells visitors they are talking to AI, has a legal basis for every purpose, collects only what it needs, deletes it on schedule, and runs on a vendor bound by a data processing agreement. None of that is exotic. Most of it is the same GDPR work you already did for checkout and email, applied to a new channel.

Two things changed recently. The EU AI Act’s transparency rule for chatbots has applied since August 2, 2026, and regulators have started fining chatbot companies directly. If you are still deciding whether a chatbot fits your store at all, start with our complete guide to ecommerce chatbots.

This checklist gives you 13 items in a table, then explains each one with the legal reference behind it. It closes with questions to send your vendor before you sign. It is practical guidance, not legal advice: for anything specific to your store, check with your data protection officer or a lawyer.

Key Takeaways

  • Visitors must be told they are chatting with AI. AI Act Art. 50(1) has applied since August 2, 2026.
  • Pick a GDPR legal basis per purpose: contract for order support, legitimate interest for general product questions.
  • Sign a DPA with the chatbot vendor and check that its sub-processor list names the LLM provider.
  • Set retention periods for chat logs and let visitors get or delete their transcripts.
  • Regulators act on chatbots: Italy’s Garante fined the company behind Replika €5 million in 2025.

The 13-point GDPR chatbot checklist

Use this table as a launch review for your chatbot. Each row is explained in the numbered sections below.

#ItemWhat to doLegal reference
1AI disclosureTell visitors they are chatting with AI when the chat opensAI Act Art. 50(1)
2Legal basis per purposeContract for order support, legitimate interest for general Q&AGDPR Art. 6
3Privacy noticeLink it from the widget, in plain languageGDPR Art. 12-13
4Cookies and local storageGet consent, or store only what is strictly necessary, or load the widget on clickePrivacy Art. 5(3), EDPB Guidelines 2/2023
5Minimization and retentionNo card numbers or health data in chat; delete logs on a scheduleGDPR Art. 5(1)(c), 5(1)(e)
6DPA and sub-processorsSign a DPA; check the list includes the LLM providerGDPR Art. 28
7Data location and transfersKnow where data sits and what covers transfers outside the EUGDPR Art. 44-46, EU-US DPF
8Access and erasureExport or delete a visitor’s transcripts on requestGDPR Art. 15, 17
9Human handoffRoute refunds, disputes and complaints to a personGDPR Art. 22 (limited scope)
10SecurityAccess control, encryption, staff accounts, incident processGDPR Art. 32
11DPIA where risk is highAssess risk before launch if the chatbot handles sensitive casesGDPR Art. 35, CNIL recommendations
12Staff AI literacyTake measures to promote AI literacy among the staff who configure and supervise the botAI Act Art. 4
13MinorsPlan for younger visitors in language and data collectionGDPR Art. 8, 12(1)

These four items decide what visitors see in the first second and whether your chatbot may process their messages at all.

1. Tell visitors they are talking to AI

Show a short AI notice when the chat window opens. Article 50(1) of the AI Act says AI systems that interact with people must let them know they are dealing with AI, unless that is obvious to a reasonably well-informed person. The Commission’s AI Act Service Desk summarizes the rule, and Article 113 sets August 2, 2026 as the date of general application.

The duty in Art. 50(1) sits with the provider, meaning the company that builds the chatbot. You still choose the settings, though. A bot with a human first name, a stock photo and no notice could undo a disclosure the vendor built in. One plain line works: “I am an AI assistant and can make mistakes.”

EU AI Act dates that matter for a store chatbot
Regulation (EU) 2024/1689 as amended in 2026. A store chatbot is normally not high-risk.

The Commission’s AI Act timeline puts the high-risk rules for Annex III systems on December 2, 2027. A store chatbot that answers product and order questions is normally not a high-risk system, so transparency and AI literacy are the AI Act duties most stores face.

Write down one legal basis per purpose, not one for “the chatbot.” GDPR Art. 6 lists six. Two cover most store chats:

  • Contract (Art. 6(1)(b)) for order support: tracking a parcel, changing an address, cancelling an order.
  • Legitimate interest (Art. 6(1)(f)) for general questions about products, shipping and returns. Document a balancing test: your interest, why chat is needed for it, and why the visitor’s interests and rights do not override it.

The CNIL’s recommendations on AI and GDPR, written for AI developers, use a conversational assistant as an example where legitimate interest can generally apply. Applying that reasoning to a store that deploys a vendor’s chatbot is our reading, not the CNIL’s. The EDPB’s Opinion 28/2024 (December 2024) explains how that test applies to AI models. Separate purposes, like adding a chat lead to your newsletter, follow their own rules and often need consent.

Put a privacy notice link inside the chat, next to the AI notice. Art. 13 requires you to tell people, at the time you collect their data, who the controller is, why you process it, the legal basis, recipients, transfers, retention and their rights. Art. 12 adds that this must be concise and in clear, plain language.

Your notice should name the chatbot vendor as a processor and say whether messages go to an AI model provider. A generic site policy that never mentions chat leaves visitors guessing.

4. Handle cookies and local storage

Check what the widget stores on the visitor’s device before the visitor clicks anything. ePrivacy Directive Art. 5(3) requires consent to store or read information on a device, unless it is strictly necessary for a service the user asked for. The EDPB Guidelines 2/2023 (version 2.0, October 2024) confirm the rule covers local storage and similar techniques, not only cookies.

You have three workable options:

  1. Load the chat only after the visitor clicks the chat button, so storage serves a service they requested.
  2. Limit the widget to a single first-party session identifier needed for the conversation, set only once the visitor opens the chat.
  3. Put the widget behind your consent banner if it sets analytics or advertising cookies.

Data handling: what you collect, keep and share

The next three items follow a chat message through your chatbot, from typing to deletion.

5. Collect less and delete on a schedule

Tell visitors not to type card numbers, passwords or health details, and don’t ask for them. GDPR Art. 5(1)(c) requires data to be limited to what is necessary, and Art. 5(1)(e) bars keeping it longer than needed. For order lookups, an order number plus the email or phone used at checkout is usually enough.

GDPR sets no fixed retention period, so you set one and justify it. An example policy, not a legal rule: delete general Q&A transcripts after a set number of months, and keep order-related chats as long as the order records they support. Then confirm the vendor actually deletes on that schedule, including backups.

6. Sign a DPA and read the sub-processor list

Sign a data processing agreement (DPA) with the chatbot vendor before going live. Under GDPR Art. 28, you are the controller and the vendor is your processor. The DPA must cover instructions, confidentiality, security, sub-processors, assistance with rights requests, and deletion at the end of the contract.

Open the sub-processor list and look for the large language model (LLM) provider. If messages go to an AI model company and it is not listed, ask why.

7. Know where data is stored and how transfers are covered

Ask where chat data is stored and processed, and what legal tool covers any transfer outside the EU. GDPR Art. 44-46 allow transfers to countries with an adequacy decision or with safeguards such as standard contractual clauses. For the US, the European Commission adopted the EU-US Data Privacy Framework adequacy decision on July 10, 2023. It covers transfers to US companies certified under the framework, so check the certification, not just the country.

Storage location and model inference location are often different. A vendor can keep transcripts in the EU while sending each message to a model hosted elsewhere.

Visitor rights and human oversight

Visitors keep their GDPR rights in the chat, and some decisions should stay with your team.

8. Export or delete transcripts on request

Make sure you can find, export and delete one visitor’s chats. GDPR Art. 15 gives people a right of access to their data, and Art. 17 a right to erasure. Your chat setup needs a tested path for both. Before launch, search for a session, export it, delete it, and check in the admin panel that no messages or personal data are left in it. A self-service option in the widget can also cut the number of requests your team handles by email.

9. Hand refunds, disputes and complaints to a person

Route money decisions and complaints to a human. GDPR Art. 22 limits decisions based solely on automated processing that produce legal or similarly significant effects. Most chatbot answers, like a size recommendation, fall outside it. A fully automated refusal of a refund or warranty claim gets closer to that line.

Our recommendation is simple: let the bot collect facts and pass the case to your team. A handoff also limits the damage from wrong answers, covered in our guide to AI hallucinations in customer support.

Security, risk and your team

The last four items protect chat data, assess risk before launch, and prepare the people and visitors involved.

10. Secure the chat and the admin panel

Treat chat transcripts like order data. GDPR Art. 32 requires security appropriate to the risk. In practice that means:

  • Separate admin accounts per staff member, with roles and strong authentication.
  • Encryption in transit and at rest.
  • An incident process that covers the chat vendor.
  • Limits on what the bot can do in your store without verification.

That last point matters more as bots gain the ability to act, not just answer. Our explainer on what an AI agent is covers why actions need stronger checks than answers.

11. Run a DPIA when risk is high

Do a data protection impact assessment (DPIA) if your chats touch sensitive situations. GDPR Art. 35 requires one when processing is likely to result in a high risk. The CNIL recommends DPIAs for AI systems where risk is high. Those recommendations are written for AI developers; applying them to a store deploying a vendor’s chatbot is our reading. A pharmacy, an adult store or a shop for children’s products should take this step seriously.

The EDPB Support Pool of Experts report on LLM privacy risks (April 2025) uses a customer-query chatbot as its first use case. It is not an official EDPB position, but it is a useful template for listing risks and mitigations.

12. Train the staff who run the bot

Take measures to promote AI literacy among the people who set up and supervise the chatbot. AI Act Art. 4 on AI literacy has applied since February 2, 2025. After the 2026 amendment, providers and deployers must “take measures to promote” AI literacy among their staff. It is an obligation to take measures, not to guarantee a set level of knowledge. A short internal guide works: what the bot can and can’t do, how to review its answers, and when to take over.

13. Plan for minors

Assume some visitors are young, especially if you sell games, fashion or school supplies. GDPR Art. 12(1) asks for extra clarity in information addressed to children. Art. 8 sets 16 as the default age for consent to online services, which member states can lower to 13. Keep the AI notice simple, avoid collecting extra details, and don’t rely on consent from young visitors for marketing.

What enforcement looks like

Italy’s Garante fined Luka Inc., the company behind the Replika chatbot, €5 million in a decision dated April 10, 2025. According to the EDPB’s report on the fine, the breaches involved GDPR Art. 5(1)(a), 6, 12, 13, 5(1)(c), 24 and 25(1). In plain terms: legal basis, transparency, minimization, accountability and data protection by design.

Replika is not a store, but the case turned on the same basics as this checklist: a clear legal basis, a proper notice and limited data.

Questions to ask your chatbot vendor

Send these before you sign. The answers show whether a product can meet these requirements in your store, and written replies are easy to file as evidence of your due diligence.

  1. Does the widget show an AI disclosure when the chat opens, and can we accidentally turn it off?
  2. Can you send your DPA and current sub-processor list? Is the LLM provider on it?
  3. Where are transcripts stored, and where is each message processed by the model?
  4. What covers transfers outside the EU: DPF certification, standard contractual clauses, or both?
  5. Are personal details like emails and phone numbers removed before messages reach the model?
  6. Is our chat data used to train your models or anyone else’s?
  7. What does the widget store on the visitor’s device before and after they open the chat?
  8. Can we set retention periods, and does deletion include backups?
  9. Can visitors download or delete their own conversations? Can we export or delete one session?
  10. How does handoff to a human work, and what happens outside our working hours?
  11. Which security measures protect the admin panel, and how will you notify us of an incident?

What this looks like in practice

One vendor, Ovebot (the company that publishes this blog), handles several items on the list as shown below. It is one example, not the only way to meet them.

A GDPR chatbot widget that opens with the notice "I am an AI assistant and can make mistakes" and a link to the privacy policy above the welcome message.
The chat opens with an AI disclosure and a privacy policy link before the first message (items 1 and 3).
The chat widget menu open on the three-dot icon, showing options to download the conversation or delete the conversation.
Visitors can download or delete their own conversation from the widget menu (item 8).
An admin panel session view after a deletion request: a red Deleted (GDPR) banner, no country, and the messages replaced by the deletion marker.
After a visitor deletes their conversation from the widget, the admin panel shows the session marked "Deleted (GDPR)", with the messages replaced and the personal data removed (item 8).

Behind the screens, Ovebot stores data in EU data centers and filters personal identifiers such as emails, phones and addresses before messages reach the global LLM providers it uses. The widget sets a single first-party session token, with no advertising cookies. A public DPA and sub-processor list cover item 6.

Frequently asked questions

Is a chatbot GDPR compliant if it uses a US LLM?

It can be, if the transfer is covered by the EU-US Data Privacy Framework or standard contractual clauses and the model provider appears on your vendor’s sub-processor list. See item 7.

Do I need cookie consent for a chat widget?

Not if the widget loads on click, keeps only one session identifier set once the visitor opens the chat, and doesn’t read other information from the device before the visitor opens the chat. Analytics or advertising cookies need consent. See item 4.

Does the AI Act require telling customers they talk to a bot?

Yes, since August 2, 2026, unless it is obvious. A short notice when the chat opens covers it. See item 1.

How long can I keep chat logs?

GDPR sets no fixed number. Set and document your own periods (item 5), and keep chats linked to an open dispute or warranty claim until that case is closed.

Do I need a DPA with my chatbot provider?

Yes. The vendor is your processor, so GDPR Art. 28 requires a written contract. See item 6.

Your next step

A compliant chatbot rests on the same basics as the rest of your store: tell people what happens, keep only what you need, and sign the right contracts. Start with the vendor questions above, then work through the table one row at a time before launch.

About this guide: written by the Ovebot team, the developers, ecommerce specialists and support staff who build the product and talk with store owners every day. Facts are checked against the sources listed below. About us · Contact

Sources

This article was written with the help of artificial intelligence and reviewed by a human editor.

Share
Ovebot Team

About the author

Ovebot Team

The people who build Ovebot at AWeb Design: developers, ecommerce specialists and the support team that talks to store owners every day. We write about what we see in real conversations between shops and their customers.

Keep reading

Start today

See what Ovebot would answer on your own website.

Start the 14-day trial with no card, or ask for a free demo trained on your products or services.

Start free, 14 days, no card See a demo on your site
Live in 5 minutes No developer No card, cancel anytime
Try Demo Start for free