GDPR and AI chatbots
Quick definition
An AI chatbot that talks with people in the EU processes personal data, so the business running it must apply the General Data Protection Regulation (GDPR) to its conversations. That data includes names, emails, order details and whatever users type.
On this page
What personal data a chatbot handles
Even a simple support chatbot collects personal data: identifiers such as an email or phone number, order and delivery details, the content of messages, and technical data such as an IP address. Because users can type freely, they may also share information the business never asked for, including sensitive data such as health details. France's data protection authority, the CNIL, recommends warning users before the conversation not to share sensitive data unless it is needed.
This page gives general information about the GDPR (Regulation (EU) 2016/679). It is not legal advice; for your own situation, consult your data protection officer or a lawyer.
Main obligations for the business
The business that decides why and how the chatbot is used is generally the controller. It needs a legal basis for each purpose — for example performing a contract when answering a customer's order question. It must inform users (Articles 13 and 14): who the controller is, purposes, legal basis, recipients, retention period and rights. It should collect only what the purpose requires, set retention periods, and let people exercise their rights of access, rectification and erasure.
The chatbot provider usually acts as a processor and must be bound by a contract that meets Article 28. If personal data is sent to a country outside the EU — for example to a model provider in the United States — the transfer rules of Chapter V apply.
Points specific to AI
Check whether conversation data is used to train or improve models, by whom, and whether that can be switched off. Know where the language model runs, since prompts contain personal data. Be careful with decisions that have legal or similarly significant effects — refusing a refund, for instance — taken solely by automated means, which Article 22 restricts. For larger deployments, a data protection impact assessment may be required.
The European Data Protection Board's Opinion 28/2024 adds that AI models trained on personal data are not automatically anonymous, which matters when choosing model providers. The EU AI Act separately requires telling people they are talking with an AI.
How AI SmartTalk approaches it
AI SmartTalk is a French company and hosts the platform in France. Assistants use AI models hosted in the European Union by default; an administrator can choose a non-EU model such as OpenAI or Anthropic, and the application asks for explicit consent each time one is selected. Conversation data is kept until the assistant or account is deleted, with permanent deletion 30 days after an account deletion request, as described in the privacy policy. Businesses remain responsible for informing their own visitors.
Frequently asked questions
Is it legal to use an AI chatbot under the GDPR?
Yes. The GDPR does not ban chatbots; it sets rules for the personal data they process: a legal basis, information to users, minimisation, security, retention limits and respect for people's rights.
Do I need consent to use a chatbot on my website?
Not necessarily for the conversation itself, which can often rely on another legal basis such as answering a request. Cookies or trackers used by the chat widget may need consent under ePrivacy rules. Check with your data protection adviser.
Can customer conversations be sent to a US AI provider?
Only in line with the GDPR's rules on international transfers, for example under an adequacy decision or appropriate safeguards, and with users informed. Choosing an EU-hosted model avoids the question.
Does the GDPR require telling users they are talking to an AI?
The GDPR requires transparency about how personal data is processed. The specific duty to disclose that a person is interacting with an AI comes from the EU AI Act, which applies from 2 August 2026.