Website chatbots and the GDPR: a practical guide for the EU, Germany and Switzerland

This guide is general information for businesses adding an AI chatbot to their website, based on the official texts listed under Sources as checked in October 2026. It is not legal advice. The rules depend on your sector, your country and what your chatbot does, so check your setup with your data protection officer or a lawyer before you go live.

The GDPR (Regulation (EU) 2016/679) applies to businesses established in the EU and, under Article 3(2), to businesses elsewhere that offer goods or services to people in the EU. A chatbot on your website is part of that offer, so its conversations with visitors in the EU are covered.

Storing or reading information on a visitor's device is a separate question. Article 5(3) of the ePrivacy Directive requires consent unless the storage is strictly necessary for a service the visitor explicitly requested. Germany applies this rule through § 25 TDDDG, formerly the TTDSG.

Switzerland has its own law: the revised Federal Act on Data Protection (FADP, in German nDSG), in force since 1 September 2023, with cookies covered by Article 45c of the Telecommunications Act. Swiss businesses with visitors from the EU often need to consider the GDPR as well.

For AI specifically, the Swiss Federal Data Protection and Information Commissioner (FDPIC) states that the FADP applies directly to AI-supported processing and that people have the right to know whether they are talking to a machine. In the EU, Article 50 of the AI Act (Regulation (EU) 2024/1689) requires AI systems that interact with people to tell them so, unless it is obvious.

List what the chatbot actually processes. For most website chatbots that means:

Under Article 6(1) GDPR, each purpose needs a legal basis: consent, a contract or steps before a contract at the person's request, a legal obligation, vital interests, a public task, or legitimate interests. Decide the basis for each purpose separately and write it down.

Legitimate interests are a common basis for answering questions visitors choose to ask. The EDPB's Guidelines 1/2024 set three cumulative conditions: a legitimate interest, processing that is necessary for it, and no overriding interests or rights of the visitor, taking their reasonable expectations into account. Someone who types a question expects an answer, not sales prospecting.

Health data and the other special categories in Article 9 need an exception such as explicit consent. The simplest approach is not to collect them: ask visitors in the welcome message not to share sensitive details, and instruct the chatbot never to request them.

Swiss law starts elsewhere. The FADP does not require a legal basis for each processing activity by a private business, but processing must follow its principles, such as good faith, proportionality, purpose limitation and transparency. A justification such as consent is needed where processing would otherwise infringe a person's privacy.

Article 13 lists what visitors must be told, and Article 12 asks for clear and plain language. For a chatbot, cover at least:

The FADP's duty to inform (Article 19) is similar but stricter on transfers: according to the FDPIC, you must name the destination countries, whether or not they offer adequate protection, and the safeguards used.

In the chat itself, a short welcome message can say that the visitor is talking to an AI assistant, that answers can be wrong, and that sensitive details should not be shared.

Article 5(1)(c) limits data to what is necessary, and Article 25 GDPR and Article 7 FADP require privacy by design and by default. For a chatbot, that is mostly configuration:

Your chatbot provider processes visitor data on your behalf, so it is usually your processor. Article 28 requires a contract that covers the subject matter, duration, nature and purpose of the processing and the types of data and people concerned, and binds the processor to your documented instructions. Further processors need your written authorization. Swiss law allows the same by contract (Article 9 FADP), provided the processor handles data only as you may and keeps it secure.

AI chatbots rely on further providers. intoCHAT, for example, uses an OpenAI model to create embeddings of your content and to generate answers, so visitor messages and relevant passages of your content are sent to OpenAI. Name each provider in the chain in your records and privacy notice.

Transfers outside the EU need an adequacy decision or safeguards such as the European Commission's standard contractual clauses (Articles 44 and 46). Switzerland uses a Federal Council list of countries with adequate protection, and the FDPIC recognizes the EU clauses for other countries. Ask your provider:

Article 5(3) of the ePrivacy Directive is not limited to cookies. The EDPB's Guidelines 2/2023 confirm that it also covers local storage and similar technologies, whether or not the information is personal data.

Like most chat widgets, intoCHAT's widget keeps a random session identifier in a cookie and in local storage so a conversation continues across pages. Whether that is strictly necessary for a service the visitor requested depends on how and when it is set, so discuss it with your adviser. If you need consent, most consent tools can hold back a script until the visitor agrees.

Valid consent must be freely given, specific, informed and unambiguous. Scrolling is not consent, and withdrawing must be as easy as giving it (EDPB Guidelines 05/2020).

In Switzerland, Article 45c of the Telecommunications Act requires you to inform users about processing on their devices and tell them they can refuse it. The FDPIC's cookie fact sheet (March 2026) adds that explicit prior consent is needed where processing is unexpected, high-risk or involves sensitive data.

Article 5(1)(e) lets you keep personal data only as long as the purpose requires, and the FADP likewise requires deleting or anonymising data that is no longer needed. Set a period for transcripts and one for leads, publish them in your privacy notice, and apply them on a schedule.

In intoCHAT you can delete individual conversations in the chat logs and individual leads in the leads table, so a regular review is enough.

Visitors can request access, correction, erasure, restriction and portability, and can object to processing based on legitimate interests (Articles 15 to 21). You must respond within one month, extendable by two months for complex or numerous requests (Article 12(3)). In Switzerland, the FDPIC states that access must in principle be given free of charge within 30 days. Prepare the steps now:

No software makes a chatbot compliant on its own, and intoCHAT holds no data protection certification. What it gives you is control over the parts that matter:

Official texts and guidance, checked in October 2026: