Live chat, cookies and GDPR: what to check in your chat widget

A chat widget runs on every page of your website and talks to your visitors, so it's fair to ask what it does with their data. If you have visitors in the EU or the UK, GDPR and the cookie rules make that question more than curiosity.

This post explains, in plain English, what a chat widget typically stores, why "no cookies" is good news but not the whole story, and what to ask any live chat provider before you add it to your site.

Please note: this is general information, not legal advice. The rules depend on your country, your business and how you use the chat, so check your own setup with a privacy professional.

What a chat widget stores in the browser

To work, a chat needs to remember a few things on the visitor's device. At the very least: which conversation belongs to this browser, so the chat carries on when the visitor moves to another page. Without that, every page would start a new, empty chat.

There are two common places to keep it: cookies, which are sent to a website with every request, and the browser's own storage (local storage and session storage), which stays on the device. Some widgets also store more: analytics IDs, advertising tags, or identifiers that follow people across other websites.

Why "no cookies" isn't the whole story

A widget that sets no cookies, and carries no advertising or analytics trackers, keeps much less personal data in play. That's a real difference, and worth choosing.

But the EU's cookie rules (the ePrivacy rules, which sit alongside GDPR) aren't really about cookies by name. They cover storing or reading information on someone's device in general, and browser storage counts too. Storage that's strictly necessary for a service the visitor asked for can be treated differently from storage that isn't.

Whether your chat needs consent, and how you ask for it, is a judgement for your business. Many sites list the chat in their consent tool or cookie notice; others treat it as necessary. The safe habits are the same either way:

• Know exactly what your chat stores, and why.
• Mention the chat in your privacy notice, with who provides it.
• Get any consent the law requires, if your advisor says you need it.

What a chat collects on the server

Beyond the browser, a chat keeps the conversation itself so your team can read and answer it. That usually means:

• The messages, and any files or pictures sent.
• A name and email, if the visitor gives them.
• Details that help you answer: the page they're on, pages they've seen, where they came from, their device, and their country and local time.

That's personal data under GDPR, which is fine: it's how support works. What matters is that it's used only to answer the visitor, kept no longer than needed, protected, and deletable.

Questions to ask any live chat provider

1. Does the widget set cookies? If so, which, and what for?
2. What does it keep in browser storage? A good provider can list it.
3. Does it load advertising or analytics trackers, or third-party code like fonts from other companies?
4. Are chats ever sold, or used for advertising or to train someone else's products?
5. How long are chats kept, and can your team delete one for good when a customer asks?
6. What happens to the data when you leave? How soon is it deleted?
7. Will they sign a data processing agreement (DPA), and tell you which service providers they use?
8. Who on your side can see chats? Roles help you give each person only the access they need.

How Quarito answers them

Here's our own list, so you don't have to dig. The details are in our Privacy Policy.

• No cookies. The chat widget doesn't set any.
• A short list in browser storage: a random ID for the visitor's browser, so a chat carries on across pages and visits; whether a chat is open; choices like muted sounds; and, for this visit only, when it began, the page the visitor came from and how many pages they've seen. The full list.
• No advertising or analytics trackers, and the widget doesn't load fonts or code from other companies.
• Chats are never sold or used for ads.
• History you control: on Free, chats are deleted for good 15 days after their last message; on Premium they're kept until your team deletes them.
• Deleted when you leave: close your account and your data is deleted within 30 days.
• A data processing agreement on request: ask us.
• Roles for your team: agents answer chats, managers run the settings, admins look after the plan. Roles explained.

Our Terms ask you to have a lawful reason for the data you collect through the chat, and to get any consent the law requires, including for the widget's browser storage. "No cookies" makes that conversation shorter, but it's still yours to have.

What to add to your privacy notice

A short paragraph is usually enough. Something like:

Live chat: our website has a chat provided by Quarito. If you use it, we receive your messages, any files you send, the name and email you give us, and details such as the page you're on, your device and your country, so we can answer you. The chat keeps a random ID and a few settings in your browser's storage so the conversation carries on across pages. It sets no cookies and no advertising or analytics trackers. See Quarito's privacy policy: https://quarito.com/privacy-policy

Adjust it to how you actually use the chat, how long you keep conversations, and your own legal basis, and have it checked if you're unsure.

In short

Choose a chat that stores little, tracks nothing and lets you delete what you don't need. Then be open about it in your privacy notice, and ask for consent where your advisor says you should. Try Quarito free, or read what else to check in a free live chat tool.