# Is live chat GDPR-friendly? A practical checklist Source: https://frosvo.com/blog/live-chat-gdpr-checklist Published: 2026-10-24 **Short answer:** live chat can be used in a GDPR-friendly way, but the software alone does not make you compliant. You are responsible for telling people what you collect, having a legal basis, keeping data only as long as you need it, choosing processors carefully and answering requests. This is a practical checklist, not legal advice; ask a qualified adviser about your own situation. ## 1. What does a live chat collect? A live chat usually stores the messages people write, any name or email they give, their approximate location, the pages they browsed, and technical details such as browser and language. Write this list down for your own records, because you need it for your privacy notice and for data requests. A chat usually stores the messages people write, any name or email they give, their approximate location, the pages they browsed and technical details such as browser and language. Write this list down for your own records. Frosvo's [security page](/security) explains how it protects what it stores. ## 2. What should my privacy notice say? It should say that you use live chat, what it records, why, who processes the data and how long you keep it. Link the notice where people start a chat, so the information is in front of them at the moment they decide to write. Your privacy notice should say that you use live chat, what it records, why, who processes the data, and how long you keep it. Link it where people start a chat. ## 3. What legal basis do I need? Answering a question someone asks you is often covered by legitimate interest or by taking steps at their request. Tracking visitors who have not written, recording sessions or sending marketing needs more care and often consent. If your site has a consent banner, connect it to the chat so tracking waits for a yes. Answering a question someone asks you is often covered by legitimate interest or by taking steps at their request. Tracking visitors who have not written, recording their sessions or sending marketing needs more care and often consent. If your site uses a consent banner, connect it to the chat so tracking waits for a yes. Frosvo's widget can be told the visitor's consent choice, and proactive features wait for it. ## 4. How long should I keep chat data? Keep it only as long as you need it, and let old data be deleted automatically. Choose a retention period for conversations and anonymous visitors that matches your privacy notice. In Frosvo, owners set the number of days under Data and privacy, and the clean-up runs on its own. Set a retention period for conversations and anonymous visitors, and let old data be deleted automatically. In Frosvo, owners choose how many days to keep resolved conversations and anonymous visitors under [Data and privacy](/docs/privacy). ## 5. Which processors should I check? Check every service that handles chat data for you: the chat provider, your email provider and any AI provider. Look at where they process it, which safeguards they use and whether a data processing agreement is in place. Frosvo lists its subprocessors and data processing terms for review. The chat provider, your email provider and any AI provider process personal data for you. Look at where they process it, what safeguards they use and whether you have a data processing agreement in place. Frosvo publishes its [subprocessors and data processing terms](/legal) for you to review. ## 6. Is an AI assistant allowed to read chats? It can be, if you are careful. Check what is sent to the model, remove sensitive data first, label the assistant as AI and let visitors ask for a person. Frosvo masks card numbers, bank account numbers, passwords and keys before the model sees a conversation. If an AI assistant reads conversations, check what it sends to the model. Frosvo masks card numbers, bank account numbers, passwords and keys before the model sees a conversation, and the assistant labels its messages as AI. Tell visitors they can ask for a person. ## 7. How do I answer data requests? Know where chat data lives and how to export or erase one person's data. Frosvo lets owners export or erase a person's data and export or delete the whole workspace, and records those actions in the audit log, so you can answer a request without searching by hand. People can ask what you hold about them and ask you to delete it. Know where chat data lives and how to export or erase one person's data. Frosvo lets owners export or erase a person's data and export or delete the whole workspace, and records those actions in the audit log. ## 8. How do I keep access secure? Turn on two-step sign-in for owners, give each team member their own account, and limit what agencies and outsourced agents can see. Strong access control is part of protecting personal data, and it also makes it easy to see who changed what. Use two-step sign-in, give each team member their own account, and limit what agencies and outsourced agents can see. See [two-step sign-in](/docs/two-step-sign-in) and [outsourced agents](/docs/outsourced-agents). ## What is the short action list? Add live chat to your privacy notice, connect your consent banner, set a retention period, review your processors and agreements, turn on two-step sign-in for owners, and test a data export and an erasure once. Six small jobs, and most take less than an hour. 1. Add live chat to your privacy notice. 2. Connect your consent banner, if you use one. 3. Set a retention period. 4. Review your processors and agreements. 5. Turn on two-step sign-in for owners. 6. Test a data export and an erasure once. Frosvo's free plan includes live chat on one website. [Start free](/signup), then follow this list.