Consent for Chat Widgets: The Conversation Starts After Permission
Chat widgets sit in an awkward spot in consent law. The widget itself loads a script, sets cookies, and often starts collecting a transcript the moment the page renders, long before the visitor has agreed to anything that is not strictly necessary. Support is not strictly necessary in the way a cart cookie is. A chat tool that fires on page load, fingerprints the visitor for its own analytics, and stores the conversation on a third party's servers is a data sharing arrangement wearing a help button's clothes.
The order of operations is the whole issue. Consent has to come before the sharing, not after the first message. Most sites get this backwards because the widget is installed through a tag manager with the same trigger as everything else, and nobody separates the chat vendor's loader from the chat vendor's interface. The button can be yours. The data collection is theirs, and it starts when their script runs, not when the visitor clicks.
What the chat vendor actually receives
Read the loader, not the sales page. A typical chat script sets its own cookies, reads the page URL and referrer, and opens a connection that logs the visit even if the visitor never opens the chat panel. If the visitor does chat, the transcript, email address if they give one, and any files they upload go to the vendor's infrastructure, often in another jurisdiction. Under state privacy laws that is sharing personal information for the vendor's own purposes when the vendor reuses it, and under European rules it is a transfer that needs a lawful basis before it happens.
None of that makes chat unusable. It makes it a consent category of its own, not a strictly necessary tool that rides along with the page. Put the widget behind the same gate as your other non-essential scripts: the interface stub can render so the page layout does not jump, but the vendor script, its cookies, and its network calls wait for the visitor's choice. Global Privacy Control signals and a recorded opt out have to suppress it too, which is the test most installations fail, because the widget was added by the support team and never told the consent platform exists.
The transcript problem nobody budgets for
Visitors tell chat things they would never put in a form: account numbers, health details, complaints that name employees. That transcript is a record your business now holds through a vendor, with retention set by the vendor's defaults unless someone changed them. Consent language that covers cookies but says nothing about conversation records leaves the most sensitive part of the arrangement undocumented. Your privacy notice should name the chat provider, what a transcript contains, and how long it is kept, in the same plain terms you would want read back to you in a complaint.
Set retention deliberately. Support rarely needs transcripts older than the window for chargebacks and warranty disputes, and keeping them forever is liability without a use. While you are in the vendor settings, turn off the proactive greeting that opens the panel uninvited on return visits. It feels helpful and it reads as surveillance to the visitor who declined tracking yesterday and is greeted by name today.
A check you can run in ten minutes
Open your site in a clean browser profile, decline everything on the banner, and watch the network tab while you load three pages. If the chat vendor's domain appears before you have clicked anything, the widget is firing without consent, whatever the banner says. Then send a Global Privacy Control signal and reload: if the widget still loads, your opt out plumbing stops at the banner and never reaches the tag manager. Both failures are configuration, not malice, and both are fixable in an afternoon once someone owns them.
Related reading: Consent on Newsletter Signup Forms Is Not the Cookie Banner, Embedded Checkout Widgets Consent to Their Own Trackers, Not Yours, Consent for Embedded Maps and Videos: The Third Parties Inside Your Pages.
Frequently asked questions
Is a chat widget strictly necessary, so it can load before consent?
No. A cart or security cookie is necessary to provide what the visitor asked for. Chat is an optional support channel, and its vendor script collects and shares data from page load, so it belongs behind the same consent gate as other non-essential tools.
What data does a chat widget collect before anyone chats?
Typically its own cookies, the page URL and referrer, device and browser details, and a visit record on the vendor's servers. Once a conversation starts, the transcript and any contact details or files the visitor shares are stored by the vendor too.
Does an opt out or Global Privacy Control signal have to stop the chat widget?
Yes, where the widget shares personal information for the vendor's own purposes. If your consent tool records the opt out but the tag manager still fires the chat loader, the opt out is not being honoured in practice.
How long should chat transcripts be kept?
Only as long as a named business need lasts, usually the dispute and warranty window for your orders. Vendor default retention is often indefinite, so set a shorter period yourself and say what it is in your privacy notice.