A chatbot that captures leads collects personal data: names, phone numbers, email addresses and whatever the visitor types about their problem. If any of your visitors live in the European Union, the United Kingdom or California, privacy laws such as the GDPR and the CCPA apply, whatever the size of your business or where it is located. The rules are not designed to stop you collecting leads. They are designed to make sure you tell people what you are doing, collect only what you need, use it for stated reasons and give people control. A chat that does these things is also a better chat: visitors trust it more. This guide covers the essentials for lead capture in plain language: what counts as personal data, the legal basis for collecting it, what to say in the chat, how consent works for marketing, how long to keep data, how to handle requests and a practical checklist.
This is general information, not legal advice. Privacy law is detailed and depends on your facts, your location and your visitors' locations. Read the official guidance and ask a qualified adviser about your situation.
What counts as personal data in a lead
- Name, email address and phone number.
- IP address and device information.
- The content of the conversation, if it identifies a person.
- Location, if collected.
- A visitor identifier stored in the browser.
- Booking details and preferences.
Even a first name and an email address are personal data. Treat all of it with care.
The basics of GDPR for lead capture
| Principle | In practice |
|---|---|
| Lawful basis | Have a legal reason: legitimate interests, contract steps or consent |
| Transparency | Tell people what you collect, why, who processes it and how long you keep it |
| Purpose limitation | Use the data for the reason you gave, not something else |
| Data minimisation | Collect only what you need |
| Storage limitation | Delete data when you no longer need it |
| Security | Protect it appropriately |
| Rights | Let people see, correct and delete their data |
For most service business chats, replying to an enquiry and arranging a booking rest on legitimate interests or taking steps at the visitor's request, while marketing emails need separate consent. See the GDPR checklist for website chatbots for the full list.
The basics of CCPA and similar US laws
- California's law gives residents the right to know what is collected, to delete it, to correct it and to opt out of its sale or sharing.
- It applies to businesses meeting certain size or data thresholds, so many small businesses are out of scope, but state laws are spreading.
- It requires a privacy notice at or before collection and a clear way to make requests.
- It restricts selling or sharing personal information and requires honouring opt-outs.
- It has specific rules for children's data and sensitive data.
If you serve US visitors, check which state laws apply to you, and keep your notice accurate. Do not sell or share chat data for advertising unless you have handled the requirements.
What to say in the chat
- Say it is an AI assistant.
- Say what you collect and why, in one sentence, and link to your privacy policy.
- Ask for contact details only when relevant, and explain the purpose: 'What is the best number for the team to confirm your booking?'
- Do not add anyone to marketing lists by default.
- Offer a way to reach a person.
Example notice below the input: 'AI assistant. Conversations are stored to answer you and arrange bookings. Privacy policy.' Keep it short and visible.
Consent for marketing
- Ask separately, with a clear, unticked opt-in: 'Tick to receive occasional tips and offers. You can unsubscribe at any time.'
- Do not bundle it with booking or the chat itself.
- Record when and how consent was given.
- Make unsubscribing as easy as subscribing.
- Do not email people who only asked a question and did not opt in.
This matters in practice: many complaints about unsolicited email start with chat data used for marketing without consent.
Minimise what you collect
| Need | What is enough |
|---|---|
| Reply to an enquiry | Name and a way to reach them |
| Book an appointment | Name, contact method, service and time |
| Send a quote | Contact method and the job details |
| Qualify a lead | A few relevant answers, not a life history |
Discourage sensitive information: health, finances, identifiers. Add a line asking visitors not to share them in the chat.
Retention: how long to keep it
- Keep leads only as long as they are useful: for example, a set period after the last contact.
- Delete conversations you do not need, and leads that went nowhere.
- Keep records the law requires, such as invoices, in the right place.
- Write your retention period in your privacy policy.
- Use the tools to delete: Crescelo lets you delete leads, appointments and knowledge sources from the dashboard, and you can ask for everything to be deleted through a support ticket.
Handling requests from visitors
- Provide a contact route in your privacy policy.
- Verify the person's identity before sharing or deleting data.
- Find their data across your chat, email and CRM.
- Reply within the legal time, generally one month for the GDPR.
- Record the request and what you did.
A simple written procedure, and a named person, make this manageable.
Vendors and where data goes
- Your chatbot vendor, AI provider, email service and CRM may all process the data.
- Have data processing agreements in place; Crescelo publishes a data processing addendum and a list of sub-processors.
- Ask where data is stored and whether it leaves the UK or EU.
- With a bring-your-own-key setup, you choose the AI provider, so read its business terms.
- List processors in your privacy policy.
Cookies and browser storage
A chat widget may store an identifier in the visitor's browser so a conversation continues. Describe this in your cookie policy and check whether consent is needed where you operate. Analytics and advertising scripts generally need consent. See our cookie policy for how we describe ours.
A practical checklist
- Data map of what the chat collects and where it goes.
- Lawful basis noted for each purpose.
- AI disclosure and privacy notice visible in the chat.
- Marketing consent separate and unticked.
- Minimal fields; warning against sensitive details.
- Retention period set and deletion possible.
- Requests procedure and a contact route.
- Processor agreements and sub-processor list.
- Cookie policy matches the widget.
- Annual review.
Where to go next
The product pages explain the tools behind these practices: lead capture covers where leads go, and the AI assistant page explains how answers come only from your content. Together with a clear privacy notice, they let you capture leads without collecting more than you should.
Related guides
- Capturing phone and email in chat covers timing and wording.
- Why contact forms fail explains what chat can do better.
- Speed to lead shows why fast follow-up matters.
Frequently asked questions
Do GDPR and CCPA apply to my chatbot?
If you collect personal data from people in the EU, UK or California, yes, in most cases, wherever your business is based, subject to thresholds for the CCPA.
Do I need consent to capture a lead in chat?
Not always. Replying to an enquiry can rest on legitimate interests or steps requested by the visitor. Marketing needs separate consent.
Can I add chat leads to my newsletter?
Only with a clear, separate opt-in.
What should I tell visitors?
That it is an AI, what you collect and why, and where to read your privacy policy.
How long can I keep chat leads?
As long as needed for a defined purpose, then delete. Set a retention period.
How do I handle a deletion request?
Verify identity, find and delete the data across your systems, reply within the time limit and record what you did.
See conversational lead capture for design, read our tietosuojakäytäntö and try a lead conversation in the playground.
Further reading
- ICO: lawful basis for processing personal data: The UK regulator’s plain-English guide.
- European Commission: data protection: How EU data protection rules work.
VASTAA JOKAISELLE KÄVIJÄLLE. VARAA AIKA NIILLE, JOTKA OVAT VALMIITA.
Ota Crescelo käyttöön verkkosivustollasi 15 minuutissa
Opeta avustajasi hinnastoillasi, asiakirjoillasi ja palveluehdoillasi. Ota käyttöön lähteisiin perustuvat vastaukset ympäri vuorokauden ja päällekkäisyydettömät ajanvaraukset suoraan chatissa.