At minimum, you’re dealing with privacy, AI-transparency, consumer-protection, cookie/tracking, and possibly children’s-privacy laws. The exact obligations depend on where your company is established, its size, what the model does, and which vendors receive the chats.

For California:

- The CCPA/CPRA applies if you do business in California and meet a threshold—roughly $25 million in annual revenue, processing personal information of 100,000 California consumers or households, or earning at least half your revenue from selling or sharing personal information. It requires notices, access/deletion/correction rights, opt-outs, and contracts with service providers.
- Even below those thresholds, CalOPPA generally requires a conspicuous privacy policy for commercial online services collecting Californians’ personal information.
- California’s bot-disclosure law can apply when a bot is used deceptively to encourage purchases. Clearly identifying the chatbot as AI is the safe approach.
- If chat data is provided to advertising or analytics companies, that may constitute “sharing,” requiring an opt-out and recognition of Global Privacy Control.
- Recording or allowing a third-party chat vendor to intercept conversations without adequate notice can raise California communications-privacy issues. Give notice before collection begins.
- If you sell or share minors’ data, California requires opt-in authorization for users under 16, with parental authorization under 13.

For Germany:

- The EU GDPR applies because you offer services to people in the EU. Chat messages, account details, IP addresses, identifiers, and model-generated profiles can all be personal data.
- You need a lawful basis for each use. Handling a customer’s support request can often rely on contract necessity or legitimate interests; optional analytics, marketing, or unrelated model training may need a different basis and sometimes consent.
- Germany’s BDSG supplements the GDPR, including rules affecting data-protection officers.
- Cookies or similar storage used by the chatbot are also subject to Germany’s TDDDG. Nonessential analytics and advertising technologies normally require prior consent.
- The EU AI Act requires people interacting with an AI system to be informed that it is AI unless that is already obvious. It also requires appropriate AI literacy for staff operating it. An ordinary support bot is normally not “high-risk,” unless it is used for consequential decisions in a regulated area.

For the UK:

- The UK GDPR and Data Protection Act 2018 impose requirements similar to the EU GDPR, but compliance and international-transfer mechanisms must be handled separately.
- PECR governs cookies, similar tracking, and electronic marketing.
- The UK Children’s Code matters if the service is likely to be accessed by anyone under 18, even if children are not the intended audience.

Not checking ages does not make children’s laws disappear. In the US, COPPA applies if the service is directed to children under 13 or you have actual knowledge that a user is under 13. In Germany, parental authorization can be required below age 16 when consent is the basis for an online service; the UK threshold is 13. You should assess whether children are realistically likely to use the store. If they are, either implement proportionate age assurance and parental-consent processes or design the chatbot to meet child-protective standards for everyone. A terms clause saying “18+” is not necessarily enough.

Before launching, you should:

1. Show a notice before the first message stating that the customer is speaking with AI, that the conversation will be stored and reviewed, why it is retained, and where to find the privacy notice.

2. Publish a privacy notice covering the chat data, purposes, lawful bases, retention periods, recipients, international transfers, user rights, and whether conversations are used to train or improve models.

3. Decide whether transcripts are used only for support and quality review or also for model training, advertising, profiling, or marketing. Treat those as separate purposes; do not assume that agreeing to support also authorizes training.

4. Set a specific retention period and automate deletion. “We may keep chats indefinitely” is difficult to justify. Preserve particular records longer only where needed for an active dispute, legal obligation, fraud investigation, or documented business need.

5. Sign data-processing agreements with the model provider, hosting company, and chat vendor. Require confidentiality, security, deletion, breach reporting, controlled subprocessors, and contractual prohibitions on unauthorized training, advertising, sale, or sharing.

6. Address international transfers. EU data sent outside the EEA may require Standard Contractual Clauses and a transfer assessment. UK data may require the UK IDTA or UK Addendum. A non-EU or non-UK company may also need local representatives.

7. Build processes for access, deletion, correction, objection, restriction, portability, and California opt-out requests. Make sure deletion reaches vendors and backups as appropriate.

8. Minimize sensitive information. Tell users not to enter payment-card numbers, passwords, government IDs, health information, or other unnecessary sensitive data. Add automated redaction where practical.

9. Secure the system with encryption, restricted staff access, audit logs, vendor controls, prompt-injection defenses, testing for leakage between customers, and an incident-response process.

10. Provide human escalation, especially for refunds, account closure, fraud accusations, warranty rights, or other decisions with meaningful consequences. Do not let the bot invent store policies or deny statutory consumer rights.

11. Perform and document a privacy impact assessment if the system involves extensive monitoring, profiling, sensitive information, children, or other high-risk processing. Also document any legitimate-interests assessment.

12. Check the chatbot’s cookies and SDKs through your consent-management system. Do not load nonessential trackers before valid consent in Germany or the UK.

A sensible default is: disclose the AI immediately, use transcripts only for support and tightly controlled quality review, disable vendor training and advertising, retain chats briefly, avoid sensitive data, provide human escalation, and apply strong privacy settings to every user until you have a defensible age-handling process. Have privacy counsel confirm the final design, particularly the CCPA thresholds, children’s access, cross-border transfers, and any use of chats for training or profiling.