The GDPR-friendly chat widget — no cookie banner needed
Most chat widgets drop cookies, load tracking pixels, and force you to add a consent banner. GhostChat doesn't. Zero cookies, zero tracking, fully GDPR-friendly — out of the box.
Why most chat widgets trigger cookie consent
Third-party cookies
Most widgets set cookies to track visitors across sessions and sites
Tracking pixels
Hidden pixels that report visitor behavior back to the widget vendor
Third-party data sharing
Your visitors' data gets shared with ad networks or analytics partners
Cross-site fingerprinting
Browser fingerprinting techniques that persist even after clearing cookies
How GhostChat stays GDPR-friendly
No cookies
We use localStorage instead of cookies, and nothing is written until the visitor opens the chat — no cross-site tracking, no cookie banner needed. Data stays on the visitor's device and is never shared with third parties.
No tracking pixels
Zero external tracking scripts. We don't load analytics, pixels, or beacons from any third party.
No third-party data sharing
Your data stays between you and your visitors. We do not sell or share visitor data with third parties for advertising or marketing purposes.
No fingerprinting
No browser fingerprinting, no device profiling, no cross-site identification. The session ID is first-party and only ever links a visitor to their own conversation on your site.
What we do collect
- -Session ID — random and first-party, written only when the visitor opens the chat; it then stays in the browser so a returning visitor picks up the same conversation (tab-only in privacy mode)
- -Pages viewed — the page the chat was opened on, plus the pages viewed on your site before and after that (up to 50, with timestamps), shown to you as the page journey. Pages before the chat is opened are held in the page's memory only, never written to the browser, and not kept at all on sites in privacy mode
- -Country — the two-letter country from the Cloudflare request header, which Cloudflare derives from the IP address. We keep the country, not the IP
- -Chat messages — obviously
- -Name and email — only if the visitor types them, or your site passes them to the widget (setContext or identity verification)
No third-party trackers, no fingerprinting, no cross-site identifiers. The page history is first-party, limited to your own site, and only reaches us when a visitor opens the chat.
Where your data lives
We believe in being straight with you: GhostChat's database is hosted on AWS in N. Virginia (us-east-1), United States. Chat data is stored in a US-East-region PostgreSQL database (Supabase), and the widget runs on Cloudflare's global edge network.
Our GDPR posture comes from data minimization, not data location — we set zero cookies, run zero trackers, and collect only the handful of fields above. For most EU sites that's exactly what keeps you out of cookie-consent and profiling territory. We process data under GDPR's lawful bases and you can read the full breakdown in our Privacy Policy.
If your compliance requirements demand EU data residency or a signed DPA, get in touch — we're a small team and happy to talk through whether GhostChat fits your needs before you commit.
Typical chat widget vs GhostChat
| Typical Widget | GhostChat | |
|---|---|---|
| Sets cookies | Yes | No |
| Tracking pixels | Yes | None |
| Consent banner needed | Yes | No |
| Third-party scripts | Multiple | Zero |
| Data shared with third parties | Often | Never |
| GDPR-friendly by default | No (needs config) | Yes |
Frequently asked questions
Does GhostChat use cookies?
No. GhostChat uses localStorage instead of cookies, and writes nothing until the visitor opens the chat. There is no cross-site tracking and no cookie banner is needed. Data stays on the visitor's device.
Do I need a cookie consent banner with GhostChat?
No. Since GhostChat sets zero cookies and loads zero third-party tracking scripts, there is nothing that requires consent under GDPR. You can add live chat without a cookie banner.
Is GhostChat GDPR compliant?
GhostChat is GDPR-friendly by design. We collect what the chat needs to work: a random first-party session ID kept in the visitor's browser storage once they open the chat, the pages they view on your site before and after they open the chat (sent only once they open it), their country (Cloudflare derives it from the IP address; we store the country, not the IP), the chat messages, and a name and email address only if the visitor types them or the site passes them to the widget. No third-party trackers, no fingerprinting, no cross-site identifiers.
What data does GhostChat collect from visitors?
A random session ID (first-party, not linked to an identity), the page the chat was opened on plus the pages viewed on your site before and after that (up to the 50 most recent, with timestamps), the visitor's country, the chat messages, and a name and email address only if they type them or the site passes them to the widget (setContext or identity verification). Nothing about a visitor reaches us until they open the chat.
Related: Privacy Policy · Open Source Widget · Lightweight Widget · All Features · Best Privacy Tools
Add live chat in 30 seconds.
One script tag. No configuration. No credit card required.