An AI chatbot is more than a bubble on a page
An AI chatbot can help a visitor understand an offer, find information, prepare a request or get a first answer. But as soon as it collects or processes personal information, it becomes a matter of compliance, trust and responsibility.
The aim is not to frighten businesses. It is to set clear limits on the tool to avoid unpleasant surprises: sensitive data typed into the chat, answers that are too assertive, missing information, unclear retention, or a visitor who does not know how to reach a person.
What the regulatory framework says
The GDPR applies to any chatbot that processes the personal data of people in the European Union. National data protection authorities have started to spell out what that means for AI systems. On 22 July 2025, the CNIL, the French data protection authority, published its first recommendations on applying the GDPR to the development and use of AI systems, chatbots very much included. They stress three points that apply directly to a chatbot on a business website:
Transparency: users must be told they are interacting with an AI chatbot, not a person.
Traceability and documentation: the data processing carried out by the chatbot must be documented.
No dark patterns: making people believe the bot is human is explicitly contrary to the GDPR.
The risk is not theoretical: a business that processes personal data through AI without respecting this framework faces fines of up to 20 million euros or 4% of worldwide turnover. In practice that ceiling is applied in proportion to the seriousness of the breach and the size of the business, but it shows how much weight the regulation gives the subject.
The CNIL warns in particular about a risk that is often overlooked: the unplanned collection of sensitive data through free-text fields. A visitor who spontaneously types medical, financial or personal information into a conversation creates data processing that the business must be able to justify and secure, even though it never asked for it.
Questions to ask before integration
What data does the chatbot collect?
Name, email, phone number, free text, conversation history, IP address or browsing data may all be involved depending on the tool and its configuration.
What is the data used for?
Answering a request, understanding a prospect's need, booking a call, improving the knowledge base: each use must be clear.
Where is the data processed?
The provider, its subcontractors, the countries of processing and the retention periods must all be checked.
Is the visitor informed?
They must understand they are talking to an assistant, know what data may be passed on, and have another way to get in touch.
Good practice
Load the chatbot only after a deliberate action where possible.
Inform users in the privacy policy.
Avoid asking for sensitive data in the chat, and warn users not to share any spontaneously.
Provide a button or link to a human contact, always visible.
Limit the knowledge base to approved content.
Set the assistant's tone and limits so it never lets anyone believe it is a person.
Test answers on sensitive cases: prices, lead times, guarantees, legal, health, safety.
Check the provider's contract and documentation, including its alignment with the guidance published by European data protection authorities, such as the CNIL recommendations of July 2025.
Consent, cookies and transparency
Not all chatbots work the same way. Some set trackers or send data to third-party services as soon as they load; others can be configured to activate only on click. The right configuration depends on the tool, the level of tracking and the intended use.
In every case, visitors must understand what is happening. A clear privacy policy, controlled activation and an email or call-booking fallback stop a useful tool from becoming a point of friction, and a compliance risk.
What changes in practice for a small business
For a small business with no in-house lawyer, applying these recommendations comes down to simple, verifiable actions: a clear mention in the privacy policy, a chatbot welcome message stating that it is an AI, a human contact button visible at all times, and a check that the chosen chatbot provider documents its processing properly. It is not a heavy legal project, but a series of concrete checks to build into the initial setup.
AI must stay within limits
A chatbot must not promise what the business cannot guarantee. On a professional website it should guide, clarify and qualify, but know when to hand over. Human fallback is not an admission of weakness: it is a mark of seriousness, and it is now an explicit expectation of regulators too.
An example of a welcome message
A compliant welcome message can simply say: "This assistant is an automated chatbot. It can point you in the right direction and answer common questions. For any specific request, a person is available at any time via [this link]." On its own, this wording ticks several requirements: transparency about the nature of the tool, and visible access to a human contact.
What to ask your provider
A chatbot's compliance depends not only on its configuration but also on the choice of provider. Many mass-market solutions process conversations on servers outside the European Union, keep them for a long time or reuse them to train their models, all points that engage the responsibility of the business deploying them. Before signing, a few simple questions help sort them out.
Where are conversations hosted and processed, and in which countries? How long are they kept, and can that period be adjusted? Is the data used to train the provider's model, and can you opt out? Is the tool aligned with current European guidance on AI and the GDPR? A serious provider answers these questions directly and supplies clear documentation. Conversely, a vague answer about where data is located or how it is reused should ring alarm bells before any commitment: it is often a sign that compliance has not been thought through.
No exemption for small businesses
It would be tempting to think a small website escapes these obligations. It does not: the GDPR does not scale its rules to the size of the business. A poorly controlled chatbot exposes a very small company to the same kind of non-compliance as a large group, except that a small business rarely has a lawyer on hand to put things right.
The good news is that making a chatbot compliant is nothing like a heavy legal project. For a small or medium-sized business it comes down to a handful of concrete steps: a mention in the privacy policy, a welcome message that states what the bot is, human contact always visible, and a provider that documents its processing. These are common-sense checks, to build in at setup rather than fix after a formal notice.
A tool of trust, not a data trap
Well designed, an AI chatbot strengthens the customer relationship: it answers quickly, guides clearly and always leaves the door open to a person. Poorly configured, it becomes a risk, for visitor trust as much as for the company's compliance. The difference lies not in the technology but in a few simple principles held from the start: say what you are, collect only what is necessary, secure what you gather and know when to hand over. Regulators ask for nothing more than what commercial common sense already recommends: transparency.
That is the approach of our AI Boost package and our AI chatbots and assistants service: useful, restrained AI, connected to approved content, designed to strengthen the customer relationship rather than replace it. Contact us to prepare your project.
Sources: CNIL, AI system development: CNIL's recommendations to comply with the GDPR · CNIL, GDPR: preparing in 6 steps