GDPR for AI Chatbots: Do Conversations Require Consent?

# GDPR for AI Chatbots: Do Conversations Require Consent? **Date:** June 05, 2026 **Author:** Rachel Torres, Privacy Counsel **Category:** Compliance **Reading Time:** 10 min --- Every modern SaaS has an AI chatbot (Intercom Fin, Drift, or a custom LLM wrapper). These bots are incredibly useful. They are also data vacuums. They collect: * **PII:** "What is your email?" * **Behavior:** Page history (to give context). * **Sentiment:** User frustration levels. **The Big Question:** Can you load the chatbot before the user clicks "Accept"? ## The Legal Verdict It depends on the **Purpose**. ### Scenario A: The "Support" Bot (Functional) * **Purpose:** Answering "Where is my order?" or "How do I reset password?" * **Classification:** **Functional / Essential.** * **Consent:** Not required (usually). You can argue Legitimate Interest (providing customer service). * **Condition:** You must *not* use the chat logs to train your global AI model or retarget the user on Facebook. ### Scenario B: The "Sales" Bot (Marketing) * **Purpose:** Proactively popping up: "Hey! Want a 10% discount? Book a demo!" * **Classification:** **Marketing.** * **Consent:** **REQUIRED.** * **Implementation:** The bot widget should *not appear* until the user accepts Marketing cookies. ## The "Training" Trap If you use chat logs to fine-tune your LLM (e.g., sending data to OpenAI with "Training: On"), you are processing personal data for a new purpose. * **GDPR:** You need explicit consent for "AI Training." * **Solution:** Enterprise contracts. Use "Zero-Retention" APIs where the LLM provider does not store or train on your data. ## Implementing "Conditional Chat" With GetCookies, you can conditionally load the chat widget. ```javascript window.addEventListener('getcookies:consent_updated', (e) => { if (e.detail.functional) { // Load Intercom Messenger Intercom('boot', { app_id: '...' }); } if (e.detail.marketing) { // Enable "Proactive" sales messages Intercom('update', { show_sales_prompts: true }); } }); ``` ## Conclusion Don't let your AI bot become a compliance liability. Classify it strictly. If it's just for support, keep it essential. If it's selling, gate it behind consent. And *never* train on user chats without asking.