Your biggest exposures are privacy law, for the transcripts, and the AI-disclosure rules. The age-check question is mostly a non-issue for a support bot, with one caveat below. My research leaned on law-firm and vendor write-ups rather than the statutes themselves, so confirm the specifics with counsel before you rely on them.

**Germany (EU): GDPR and the EU AI Act**

- **GDPR applies to the transcripts.** They contain personal data (names, addresses, order details, anything customers type). You need:
  - a lawful basis, probably legitimate interests or contract performance for support, and a documented reason for reviewing transcripts;
  - a privacy notice that mentions the chatbot, the transcript review, and your LLM provider;
  - a written data processing agreement (Article 28) with the LLM vendor, covering purposes, data types, retention and sub-processors;
  - a transfer mechanism if the vendor processes data outside the EU or EEA;
  - a retention period you can justify, with deletion after it. Don't keep transcripts indefinitely "just in case";
  - a way to handle access and deletion requests that reach into the transcripts.
- **Consider a DPIA** (data protection impact assessment). Routine support chat probably isn't high risk on its own. Do one if you start profiling customers or using transcripts to train models.
- **EU AI Act, Article 50.** Sources I found say the chatbot disclosure duty has applied since 2 August 2026. Customers must be told at or before first interaction that they are talking to an AI, unless that is obvious. A short line such as "You're chatting with an AI assistant" at the start of the chat does it. The sources disagree on some Article 50 timing, but only for the machine-readable marking of AI-generated content (Article 50(2)). That is the provider's job, not yours as a deployer of a support bot. A support bot is not a high-risk system under the Act. Penalties for transparency breaches are reported as up to €15 million or 3% of turnover.
- **German-specific:** Germany has its own ePrivacy and telemedia rules on storing or reading information on a user's device (the TTDSG/TDDDG). If your chat widget sets cookies or similar storage that isn't strictly necessary, you may need consent. I did not research this in detail.

**UK: UK GDPR and the Data Protection Act 2018**

The rules are essentially the same as the EU GDPR points above: lawful basis, transparency, a processor contract, a lawful route for any international transfer, and storage limitation. The ICO's guidance on purpose limitation, data minimisation and storage limitation is the baseline for how long you keep transcripts. I could not find ICO guidance specific to chatbot transcripts, and I did not confirm what the Data (Use and Access) Act 2025 changes here. The UK has no AI-specific statute with a chatbot disclosure rule. Consumer-protection law still applies, so don't present the bot as a human or mislead customers. You may need a UK representative or a separate registration step, depending on how you're set up. Check this.

**California**

- **CCPA/CPRA.** This applies only if you meet the thresholds (roughly $25M+ in revenue, or data on 100,000+ consumers, or most of your revenue from selling or sharing data). Verify the current figures. If it applies:
  - give a notice at collection that covers the chat data;
  - disclose the categories of data in your privacy policy;
  - honor access, deletion and opt-out requests;
  - have a contract with your LLM vendor that restricts it to a service-provider role, with no selling or sharing of the data.
  The California Privacy Protection Agency has also written rules on automated decision-making technology. I could not confirm their current status or dates, and they look aimed at significant decisions rather than support chat.
- **Wiretap claims (CIPA).** This is the practical California risk for chat transcripts. Plaintiffs have sued websites under California Penal Code sections 631 and 632.7, and also under a "pen register" theory (section 638.51), arguing that a third-party chatbot vendor intercepts conversations. Statutory damages are $5,000 per violation. The case law is mixed and the material I found was mostly from 2023 to 2024, so I can't tell you where it stands now. Reduce the risk by:
  - disclosing at the start of the chat that it is an AI and that conversations are recorded and shared with your service provider;
  - using a vendor that is contractually barred from using the chat data for its own purposes;
  - getting a clear acknowledgement from the customer where practical.
- **Bot disclosure.** California's older bot law (SB 1001, 2018) requires disclosure when a bot is used to influence a purchase or a vote and the person could be misled into thinking it's human. I'm going from memory on that one. The same "tell them it's AI" line covers you.
- **SB 243 (companion chatbots).** This is the new California chatbot law, in effect since 1 January 2026. It does not apply to you. It exempts bots used solely for customer service, business operations or technical support. That also covers the age and minors provisions, which is why not checking ages is generally fine here. It would matter if the bot started acting like a companion or friend. It has a private right of action.

**What to do**

1. Put an AI disclosure at the start of every chat. Add a line saying conversations are recorded and processed by a service provider, linked to your privacy policy.
2. Update the privacy policy for the chatbot, the transcript review and the LLM vendor, with notices that fit the EU, UK and California.
3. Sign a data processing agreement or service-provider contract with the LLM vendor. Check training opt-outs, sub-processors, data location and the retention it applies. Use business or API terms, not consumer terms.
4. Set and enforce a transcript retention period. Restrict who can read transcripts, and consider redacting payment card numbers and other sensitive details automatically. Tell customers not to share card numbers in chat.
5. Give people a human option and a route to make data requests.
6. Keep a short record of your assessment: lawful basis, transfers, retention, vendor review, and whether a DPIA was needed.
7. Stop the bot from handling anything outside support. If it gets into health, vulnerable users or personalized decisions, revisit all of this. On age, nothing requires checks for a store support bot, but if minors might use the store, take extra care with what the bot collects and says.

If you tell me the LLM vendor, where it processes data, how long you keep transcripts and your rough revenue, I can narrow this down.