Short version: a support chatbot on an LLM that stores transcripts and serves customers in California, Germany and the UK is mainly a **privacy and consumer-protection** problem. The AI-specific rules are lighter than people expect, though a few apply. This is general information, not legal advice. Have counsel check the details before launch.

## Laws that likely apply

**Germany (EU)**
- **GDPR**, plus the German BDSG. This is the heaviest obligation for you. Chat transcripts are personal data, and customers often type names, addresses, order details and sometimes health or payment information.
- **EU AI Act.** A customer-facing chatbot is generally a limited-risk system. The main duty is **transparency**: users must be told they are talking to an AI unless that is obvious. That duty applies from August 2026 (check current timelines, since the EU has discussed delaying parts of the Act). You are probably a "deployer" of someone else's model. You also need basic AI literacy among the staff who run it.
- **ePrivacy / TTDSG (now TDDDG).** Cookies, chat-widget scripts and similar tracking need consent in Germany.
- **Consumer law.** Don't mislead customers, and keep the right to reach a human for contract matters. Withdrawal and warranty information has to be correct.

**UK**
- **UK GDPR and the Data Protection Act 2018.** This is essentially the same as the EU rules, with the ICO as regulator.
- **PECR** covers cookies and similar tech.
- **Consumer rights law** (Consumer Rights Act and the Digital Markets, Competition and Consumers Act). There are no AI-specific statutes for chatbots yet.
- The **Online Safety Act** is mostly aimed at user-to-user and search services. A one-to-one support bot is usually out of scope, but check that it can't be used as a platform for user content.

**California**
- **CCPA/CPRA.** It applies if you meet the thresholds (roughly $25M+ revenue, or data on 100,000+ consumers/households, or 50%+ of revenue from selling or sharing data). You'd need a privacy notice, notice at collection, access, delete and correct rights, and opt-outs from sale or sharing.
- **CalOPPA** requires a privacy policy for any commercial site collecting data from Californians, regardless of size.
- **California Invasion of Privacy Act (CIPA).** This is a real litigation risk. Plaintiffs have sued companies over chat widgets and third-party chat vendors "eavesdropping" on conversations without consent. Disclose recording up front and get consent. Be careful about which vendors can see transcripts.
- **California's bot disclosure law (SB 1001)** prohibits using a bot to mislead people about its artificial identity in order to influence a purchase or vote. Disclosing it is the safe route anyway.
- **Newer AI laws** (for example the AI transparency and companion-chatbot rules) mostly target large model developers or companion bots. They probably don't reach you, but check them.

## The age issue

Not checking ages is the weak spot.
- **GDPR / UK GDPR:** children get special protection. In Germany, consent from a child under 16 is not valid on its own. In the UK the age is 13. If you rely on consent, you need a way to handle minors.
- **UK Age Appropriate Design Code (Children's Code):** it applies to services likely to be accessed by children. An online store may or may not qualify.
- **California:** you can't sell or share data of consumers you know are under 16 without opt-in. The California Age-Appropriate Design Code is in litigation.
- **US federal COPPA:** this applies if you have actual knowledge you're collecting data from children under 13.
- **Practical approach:** you don't have to verify ages if the store isn't aimed at kids. State in your terms that the service is for adults, don't market to minors, and have a process to delete data if you learn a child used the bot. If you sell age-restricted goods (alcohol, knives, vapes), you have other age obligations anyway.

## What to do

1. **Tell users it's an AI.** Put a clear label at the start of the chat, such as "You're chatting with an AI assistant. Chats are saved for quality review." Offer a path to a human.
2. **Update your privacy notice** to cover chat data: what you collect, why, legal basis (usually legitimate interests or contract, not consent), retention, who receives it (the LLM provider, hosting), international transfers, and user rights. Do this for GDPR, UK GDPR, CCPA/CPRA and CalOPPA.
3. **Pick a legal basis and document it.** For the EU and UK, write a short legitimate interests assessment for transcript review. Keep a record of processing activities. Do a DPIA if you do large-scale monitoring or profiling.
4. **Sign a data processing agreement with your LLM vendor.** Confirm they don't train on your data (or that you've disclosed it and have a basis), and check where data is processed. For transfers to the US, use the EU-US Data Privacy Framework if the vendor is certified, or standard contractual clauses, and the UK addendum or UK-US data bridge.
5. **Minimize and set retention.** Set a fixed period (say 30 to 90 days, or what you can justify), then delete or anonymize. Redact card numbers and credentials before storage. Tell the bot not to ask for sensitive data it doesn't need.
6. **Handle rights requests.** Be able to find and delete one person's transcripts for access, deletion, correction and opt-out requests. GDPR gives you one month to respond, and CCPA 45 days.
7. **Control the vendors and cookies.** Get cookie consent in Germany and the UK before loading chat scripts that set trackers. Audit which third parties see transcripts (CIPA exposure).
8. **Limit what the bot can do.** Don't let it make binding promises about refunds or prices without guardrails. Courts have held companies to what their bots said (the Air Canada case). GDPR Article 22 limits solely automated decisions with legal effect, such as refusing a refund automatically with no human review.
9. **Secure it.** Use encryption, access controls for staff reviewing transcripts, logging, and a breach response plan (72-hour notification to German and UK regulators).
10. **Test for prompt injection and data leakage,** so one customer can't pull out another's order data.
11. **Name a contact.** Because you serve people in the EU and UK, check whether you need an EU and UK representative if you have no establishment there. Appoint a DPO if your core activities require it.

## Priorities

If you're short on time, do these first: the AI disclosure, an updated privacy notice, a DPA with the LLM vendor, a retention limit, and consent and notice for chat recording to cover CIPA. Then handle the age gap with an adults-only statement and a deletion procedure.

If you tell me your revenue, whether you're established in the EU or UK, and which LLM vendor you use, I can narrow this down.