Chat Widgets & GDPR on WordPress (2026): Consent, Data & Compliance
Every chat widget on a WordPress site collects personal data. A pre-chat form asking for a name and email, visitor tracking that logs page and country, and stored conversation transcripts all fall under the GDPR when you have visitors in the European Economic Area. Chat needs a lawful basis, a privacy policy naming your chat provider as a processor, and a way for visitors to exercise their rights. This guide covers what chat widgets collect, who is responsible, and what to ask any vendor (including us). It is practical guidance, not legal advice.
Download: techpad-click-to-ai-chat.zip — free, WordPress 6.0+, PHP 7.4+.
Start Free — No Credit Card
The Click to AI Chat plugin from The Tech Pad is free, the account is free with no credit card, and the web chat widget plus AI replies stay free forever. The only optional charge is a one-time $10 per domain to remove the small "Powered by The Tech Pad" link; automated WhatsApp messages pay only Meta's per-message rate (roughly ₹0.10–0.30 per utility message in India). Sign up at thetechpad.com/wa/ to inspect what the widget collects — or browse our best WordPress chat plugins for 2026 for the wider category.
What Data a Chat Widget Collects
| Data collected | Example | Why it is personal data |
|---|---|---|
| Pre-chat form answers | Name and email entered before chat | Direct identifiers of a person |
| Visitor tracking | Page URL, UTM source, country, device | Can identify a returning visitor; builds a behavioral profile |
| Conversation transcript | Order numbers, addresses, complaints | Message content routinely contains personal data |
| Cookies / local storage | Session identifiers, widget state | Identifiers tied to a browser or device |
Transcripts are free text, and tracking runs on every page the widget loads, not just when someone chats. Keep the pre-chat form off and tracking minimal, and the footprint shrinks to what visitors type voluntarily.
Lawful Basis and the Cookie Question
For chat, two lawful bases usually apply:
- Consent — the visitor agrees to a specific purpose, such as receiving a transcript by email. It must be freely given, specific, and easy to withdraw.
- Legitimate interest — answering a customer who just messaged you is defensible, but you must weigh it against the visitor's privacy and document the balancing test.
Cookie rules (such as ePrivacy) are often stricter: cookies that are not strictly necessary require consent before they load. If a chat script drops tracking cookies on page load, link the widget to your cookie banner. A chat that opens only when the visitor clicks the button reduces exposure — nothing runs until the visitor initiates it. Check each plugin's actual script behavior rather than assuming.
Controller vs Processor: Who Is Responsible
- You are the controller. You choose the tool, decide what the pre-chat form asks, and control whether tracking is on. The GDPR holds you responsible.
- A hosted chat provider is a processor. It stores conversations and runs the widget on your behalf, under your instructions.
- You need a Data Processing Agreement (DPA). Article 28 requires one whenever a processor touches personal data on your behalf.
Most hosted chat vendors — tawk.to, Crisp, Zendesk and The Tech Pad included — provide a DPA or state processor terms in their privacy policy. Ask any vendor for their DPA and check four things: (1) what they process, (2) where data is stored and whether transfers rely on valid safeguards, (3) retention and deletion procedures, and (4) sub-processors, especially if AI routes data to third-party model providers.
AI Chat: What to Ask the Vendor
Two questions deserve answers before you enable anything:
- What is the AI trained on? The lowest-risk pattern answers only from a knowledge base you build — your FAQs, policies and product info — and never learns from visitor conversations. The Tech Pad's Auto-Pilot follows that pattern: it answers from the knowledge base you write, not from chats, and does not train public models on your conversations.
- What happens to the conversation? Prompts and transcripts may reach the model provider behind the AI. Ask whether chat content leaves the vendor's platform, how long it is retained, and whether deletion requests reach the AI layer too.
Match the answers to your own privacy commitments — a vendor that trains on customer conversations may suit some businesses and disqualify others.
Auditing Any Chat Plugin
"GDPR-friendly" is not a label you can trust at face value — plugin types have very different postures:
- WhatsApp button (wa.me) plugins send the visitor to WhatsApp: minimal data on your site, with Meta's terms applying after the click-through.
- Self-hosted chat keeps data on your own server: you control retention and security — and bear the risk.
- Hosted chat widgets store transcripts on the vendor's servers — check DPA, data location, retention, and deletion tooling.
- Hosted chat with AI adds the model provider — check training policy, sub-processors, and prompt retention.
Checks for every plugin: does it set cookies or track before consent? Is the chat visitor-initiated or does tracking fire on every page load? Can you turn off the pre-chat form and visitor tracking? Can a visitor get a conversation deleted, and can you export it?
The Click to AI Chat plugin stores only your settings locally in WordPress; conversations live on The Tech Pad platform like any hosted chat tool.
A Privacy-Friendly WordPress Chat Setup
Using the Click to AI Chat plugin as the worked example:
1. Install the plugin and connect a free account. The plugin stores only your settings; no visitor data lives in your WordPress database.
2. Let the visitor start the chat. The window opens when the visitor clicks the launcher, and visitors never need an account.
3. Keep the pre-chat form optional and minimal. If you ask for a name or email, say why — a privacy note in the greeting covers it:
Hi {{1}} — thanks for reaching out! Just so you know: this chat is for answering your questions, we keep only what you type plus anything you share in the form, and you can ask us to delete this conversation at any time. How can we help?
4. Disclose visitor tracking in your privacy policy. Visitor context (page, UTM, country, device) is on by default — name it in your policy and link to the web chat feature details for what is collected.
5. Tie the widget to your cookie banner where non-essential cookies apply, so nothing loads before consent.
6. Handle data subject requests. Know how to export and delete conversations in whatever platform you use.
The same checklist works for any hosted provider — only the vendor's answers differ.
FAQ
Does GDPR apply to a chat widget on my WordPress site? Yes, whenever the chat can collect personal data — a pre-chat form asking for a name or email, visitor tracking (page, UTM, country), or stored conversation history. You need a lawful basis (typically consent or legitimate interest), a privacy policy that names the chat provider as a processor, and a way for visitors to request their data.
Do I need a cookie banner for a chat widget? Depends on what the widget loads. If the chat script sets non-essential cookies or tracking runs before consent, the widget must wait for consent (link it to your cookie banner). Chat that only loads after the visitor clicks the button — a common privacy-friendly pattern — reduces the exposure. Check each plugin's script behaviour rather than assuming.
Where is chat data stored, and who is the processor? Hosted chat tools store conversations on their servers: the chat provider is a data processor and you are the controller — you need a Data Processing Agreement with them (most, including tawk.to, Crisp and The Tech Pad, provide one or state terms in their privacy policy/DPA). Self-hosted open-source options like Chatwoot keep data on your own server instead.
Is the AI in chat widgets a GDPR problem? AI chat raises two points: what the AI is trained on (The Tech Pad answers from the knowledge base you build — your content, not visitor conversations — and does not train public models on your chats) and what happens to conversation data (same as any hosted tool: processor terms, retention, deletion rights). Ask both questions of any AI chat vendor.
What should I check before picking a GDPR-friendly chat plugin? Four things: (1) does it set cookies before consent, (2) is there a pre-chat form or tracking that needs disclosure (visitor tracking shows page, UTM, country), (3) does the vendor provide DPA/processor terms and clear retention, (4) can a visitor get their conversation deleted. The Tech Pad's plugin stores only your settings locally; conversations live on the platform with standard processor terms — and visitors never need an account to chat.
Get the Free Plugin and Start Clean
Test the pattern on a staging site first. Download techpad-click-to-ai-chat.zip, create your free account at thetechpad.com/wa/ — no credit card — and run the checklist against the real widget: web chat and AI replies are free forever, the only optional charge is a one-time $10 per domain to remove the "Powered by" link, and WhatsApp automation pays only Meta's per-message rate. Then audit what you already run, and ask every vendor for their DPA.