GDPR for AI Chatbots: Do Conversations Require Consent?

Date: June 05, 2026 Author: GetCookies Team Category: Compliance Reading Time: 10 min

---

Every modern SaaS has an AI chatbot (Intercom Fin, Drift, or a custom LLM wrapper).

These bots are incredibly useful. They are also data vacuums. They collect:

• PII: "What is your email?"
• Behavior: Page history (to give context).
• Sentiment: User frustration levels.

The Big Question: Can you load the chatbot before the user clicks "Accept"?

The Legal Verdict

It depends on the Purpose.

Scenario A: The "Support" Bot (Functional)

• Purpose: Answering "Where is my order?" or "How do I reset password?"
• Classification: Functional / Essential.
• Consent: Not required (usually). You can argue Legitimate Interest (providing customer service).
• Condition: You must not use the chat logs to train your global AI model or retarget the user on Facebook.

Scenario B: The "Sales" Bot (Marketing)

• Purpose: Proactively popping up: "Hey! Want a 10% discount? Book a demo!"
• Classification: Marketing.
• Consent: REQUIRED.
• Implementation: The bot widget should not appear until the user accepts Marketing cookies.

The "Training" Trap

If you use chat logs to fine-tune your LLM (e.g., sending data to OpenAI with "Training: On"), you are processing personal data for a new purpose.

• GDPR: You need explicit consent for "AI Training."
• Solution: Enterprise contracts. Use "Zero-Retention" APIs where the LLM provider does not store or train on your data.

Implementing "Conditional Chat"

With GetCookies, you can conditionally load the chat widget.

window.addEventListener('getcookies:consent_updated', (e) => {
  if (e.detail.functional) {
    // Load Intercom Messenger
    Intercom('boot', { app_id: '...' });
  }
  
  if (e.detail.marketing) {
    // Enable "Proactive" sales messages
    Intercom('update', { show_sales_prompts: true });
  }
});

Conclusion

Don't let your AI bot become a compliance liability. Classify it strictly. If it's just for support, keep it essential. If it's selling, gate it behind consent. And never train on user chats without asking.