Can you use an AI chatbot on your website under GDPR?

Yes, you can use an AI chatbot on your website in the EU. Thousands of businesses do, from online shops to clinics and law firms. But a chatbot is not just a widget: it collects whatever your visitors type, sends it to an AI provider, often outside the EU, and keeps transcripts that can contain anything from an email address to a medical history. Under GDPR, and since August 2026 under the EU AI Act, that comes with specific duties.

This guide explains what you need to have in place, the questions to ask your AI provider, and how to design a chatbot that is useful without becoming a privacy problem.

Two laws apply at the same time

GDPR applies because a chatbot processes personal data: names, emails, phone numbers, IP addresses, and anything visitors choose to share in their messages.

The EU AI Act applies because the chatbot is an AI system that talks to people. Since 2 August 2026, its transparency rules require that people are told when they are interacting with an AI, unless it is obvious. Our EU AI Act guide for websites covers the AI Act side in detail. This article focuses on GDPR.

Who is responsible for what

On a typical website:

• You are the controller. You decide that the chatbot exists, what it is for and what happens to the conversations.
• The AI provider (OpenAI, Anthropic, Google, Mistral or a platform built on them) and the chatbot platform are usually processors, handling data on your instructions.

As controller, the obligations land on you. "The provider handles it" is not an answer a regulator accepts.

The GDPR checklist for a website chatbot

1. A clear purpose and legal basis

Write down what the chatbot is for: answering questions about services, qualifying leads, booking appointments, customer support. Then pick the legal basis:

• Answering a visitor's own question or helping them book is usually covered by steps at the visitor's request before a contract, or by legitimate interest.
• Using conversations for marketing, profiling or training models needs a separate basis, often consent.

2. Tell visitors before they type

Under GDPR (Article 13) and the AI Act, visitors should know, before or at the start of the conversation:

• That they are talking to an AI
• Who runs the chatbot (your business)
• What happens to their messages and for how long they are kept
• Where to find the full privacy policy

A short line in the chat window does most of the work: "You're chatting with our AI assistant. Messages are stored for 30 days to answer your request. Please don't share sensitive personal information. Privacy policy." Adjust the details to your real setup.

3. A data processing agreement with every provider

You need a data processing agreement (Article 28) with the chatbot platform and the underlying AI provider. Business offerings from the major providers include one. Free consumer accounts usually do not, which is one reason not to build business tools on them.

4. Check training and retention settings

Ask, and get it in writing:

• Is our data used to train the provider's models? For business APIs the answer is usually no by default, but check the specific product and plan.
• How long does the provider keep inputs and outputs? Many keep them for a limited period for abuse monitoring. Some offer zero-retention options.
• Can we delete transcripts on request, for example when a visitor exercises their right to erasure?

5. Lawful international transfers

If the provider processes data outside the European Economic Area, the transfer needs a legal basis. For US providers certified under the EU-US Data Privacy Framework, the adequacy decision covers it. Otherwise you need standard contractual clauses and a transfer assessment. Several providers now offer EU data processing or hosting options, which simplify this. Name the providers and transfers in your privacy policy.

6. Minimise what the chatbot collects

The safest data is data you never receive:

• Do not ask for more than the task needs. A lead qualification bot needs a name and an email, not a date of birth.
• Tell visitors not to share sensitive data, and design flows that move sensitive topics to a secure channel or a person.
• Mask or filter obvious sensitive data (card numbers, ID numbers) before it reaches logs, where your platform allows it.

7. Set a retention period for transcripts

Transcripts are useful for improving answers, but they should not live forever. Set a period that matches the purpose, such as 30 or 90 days, delete or anonymise afterwards, and limit who in your team can read them.

8. Respect visitors' rights

Visitors can ask for a copy of their conversations, correction or deletion, and they can object. Make sure you can actually find and delete a specific person's transcripts, which is harder than it sounds if the chatbot stores everything as anonymous sessions in a provider dashboard.

9. Avoid automated decisions with real consequences

Article 22 of GDPR limits decisions based solely on automated processing that have legal or similarly significant effects on a person. A chatbot that answers questions is fine. A chatbot that alone decides who gets a loan, a job interview or access to a service is a different matter, and may also be high-risk under the AI Act. Keep a human in the loop for decisions that matter.

10. Run a risk assessment when the stakes are high

If the chatbot processes health data, data about children or large volumes of personal data, a data protection impact assessment (DPIA) is likely required. Even when it is not, a short written assessment of risks and safeguards is good practice and useful if a regulator ever asks.

Regulators are paying attention

European data protection authorities have been active on AI from the start. Italy's Garante temporarily restricted ChatGPT in 2023 and in late 2024 fined OpenAI €15 million over legal basis, transparency and other issues. In March 2026 a court in Rome annulled that fine because it found the Italian authority was not competent under GDPR's one-stop-shop rules, without ruling on the substance. The European Data Protection Board has since published its own work on ChatGPT and on AI models. Those cases concern the AI providers, but the questions they raise (is there a legal basis, are people properly informed, is data used for training) are the same questions a regulator would ask about your website chatbot.

Design matters as much as paperwork

A chatbot that is honest about what it is and what it can do is not only compliant, it converts better. Visitors trust an assistant that:

• Says it is an AI in the first message
• Answers from your own content and admits when it does not know
• Hands over to a person smoothly, with the context of the conversation
• Does not pretend to be a doctor, lawyer or financial adviser
• Does not ask for personal details before it has been useful

The worst outcome is a bot that confidently invents an answer about your prices or services. Grounding the assistant in your real content (often called RAG, retrieval-augmented generation) and testing it against tricky questions before launch matters as much as the privacy setup.

Questions to ask before you choose a chatbot provider

1. Do you sign a GDPR data processing agreement?
2. Where is our data processed and stored? Is there an EU option?
3. Is our data used to train models? Can we switch that off contractually?
4. How long do you keep inputs, outputs and logs? Can we set retention ourselves?
5. Can we export and delete a specific visitor's conversations?
6. How does the widget show the AI disclosure required by the AI Act?
7. Is the widget accessible with a keyboard and screen reader?
8. Can the assistant hand over to a human, and how?

How we build AI assistants

We build AI assistants and voice agents, such as fraxBOT, that answer only from your approved content, disclose that they are AI, hand over to your team when they should and store conversations under retention rules you control. If you want a chatbot on your site, or a review of the one you already have, see our AI integration service or contact us.