Adding an AI chatbot means visitors type information into your website, and that information is processed by an AI provider. That’s fine, as long as you handle it responsibly. Here’s a plain-English overview. It isn’t legal advice; check with your own counsel for your specific situation.
What data does a website chatbot collect?
- The messages visitors type
- Contact details, if the visitor chooses to share them
- Technical data such as page URL and basic request information for security
Five principles to follow
1. Collect the minimum
For lead capture, name and email are usually enough. Don’t ask for dates of birth, ID numbers, card details or health information in chat.
2. Be transparent that it’s AI
Label the chatbot as an AI assistant. It builds trust, and several jurisdictions have rules about disclosing automated or AI interactions.
3. Update your privacy policy
Explain that chat messages are processed to answer questions, which provider processes them (for example Anthropic or OpenAI), how long you keep transcripts and how people can request deletion.
4. Choose providers that don’t train on your data
Commercial AI APIs from major providers don’t use API inputs to train their models by default. Confirm this in your provider’s terms and avoid consumer-grade tools for business chat.
5. Honor access and deletion requests
Under laws like GDPR and CCPA/CPRA, people can ask what you hold about them and ask you to delete it. Make sure you (or your chatbot provider) can find and delete transcripts and leads.
GDPR (EU and UK visitors)
- You need a lawful basis to process chat data. Answering a question the visitor asked is usually covered by legitimate interests or steps prior to a contract.
- Have a data processing agreement (DPA) with your chatbot provider.
- Be mindful of transfers outside the EU/UK; reputable providers offer standard contractual clauses.
CCPA/CPRA (California)
- Disclose the categories of personal information you collect through chat and why.
- Don’t sell or share chat data for advertising without the required notices and opt-outs.
HIPAA (US healthcare)
If you’re a covered entity, information a patient types about their health can be protected health information. A standard website chatbot should be configured to avoid collecting it: answer general questions, and direct anything clinical to a phone call or your patient portal. Collecting PHI through chat requires a HIPAA-compliant setup and a business associate agreement (BAA) with every vendor involved.
Chatbot privacy checklist
- Chatbot labeled as AI
- Privacy policy updated (purpose, provider, retention, rights)
- Minimal lead fields
- No sensitive data requested in chat
- DPA in place with your provider
- A process for deletion requests
- Guardrails against medical, legal and financial advice
Read how we handle this in our AI chatbot privacy & security overview.
FAQ
Do I need a cookie banner for a chatbot?
It depends on whether the chatbot sets non-essential cookies or trackers. Chatbots that only use session storage for the conversation generally don’t add tracking, but check with your consent tool and counsel.
Can visitors’ messages leak to other customers?
Not in a properly built chatbot. Each conversation is separate, and the AI answers from your business knowledge, not from other visitors’ chats.
