Law, privacy & accessibility
An assistant processes input from visitors — which brings data protection and transparency obligations.
- articles
- 16
- min average read
- 13
- Law, privacy & accessibility
What a Chat Assistant May Say About Prices
If an assistant quotes a price, it is advertising with a price. What belongs in the same reply, when the 30-day rule applies and why prices come from the shop.
13 min read
- Law, privacy & accessibility
Cancellation Button and Chat: Handling Requests to Cancel
What Sec. 312k BGB requires for the cancellation button and confirmation, and how a chat assistant guides requests to cancel onto that path without obstacles.
13 min read
- Law, privacy & accessibility
Chat Widget and Cookie Banner: What Section 25 TDDDG Requires
When a chat widget needs consent under Sec. 25 TDDDG, what it may store before the first message and how banner, withdrawal and records fit together.
13 min read
- Law, privacy & accessibility
CRA reporting: is your chat assistant in scope?
Article 14 of the Cyber Resilience Act has applied since 11 September 2026. Check whether a chat assistant is in scope and which deadlines start on awareness.
15 min read
- Law, privacy & accessibility
DPIA for a chat assistant: when it is required
When Article 35 GDPR requires a data protection impact assessment for your chat assistant: the three cases in paragraph 3, the authority list and the structure.
14 min read
- Law, privacy & accessibility
Contact data from chat: getting consent right
When a chat needs consent and when pre-contractual steps carry it: legal bases under the GDPR, TDDDG and UWG, plus records and withdrawal at a glance.
13 min read
- Law, privacy & accessibility
AI Literacy under Art. 4 AI Act: Roles, Records
Article 4 of the AI Act requires AI literacy from providers and deployers. Four roles around a website assistant, and the records that evidence them.
13 min read
- Law, privacy & accessibility
Right of access to chat data under the GDPR
What a visitor may learn about their chat transcript under Article 15 GDPR: deadline, copy, origin, recipients, redaction and access without an account.
13 min read
- Law, privacy & accessibility
Setting Retention Periods for Chat Logs
How long chat logs may be kept: storage limitation under Article 5 GDPR, erasure under Article 17, anonymisation and when commercial retention duties apply.
13 min read
- Law, privacy & accessibility
Data processing agreement for an AI assistant
Article 28 GDPR in plain terms: when a provider is a processor, which eight duties the contract carries and what applies to a third-party language model.
14 min read
- Law, privacy & accessibility
Chatbot Liability: What the OLG Hamm Ruling Means
On 12 May 2026 the OLG Hamm ruled that companies are liable for misleading statements made by their AI chatbot. What the judgment means for operators.
12 min read
- Law, privacy & accessibility
Accessible AI Chat Assistant: WCAG and the EAA
The EAA has applied since 28 June 2025: what an accessible AI chat assistant needs - keyboard operation, screen readers, visible focus and WCAG 2.2 AA.
12 min read
- Law, privacy & accessibility
EU AI Act 2026: Chatbot Disclosure Duties Explained
From 2 August 2026, Article 50 of the AI Act applies: users must be able to tell they are chatting with an AI, not a human. What it means for your website chat.
11 min read
- Law, privacy & accessibility
GDPR-Compliant AI Chat: Hosting and Data Protection
What makes an AI chat assistant GDPR-compliant: hosting in Germany, a data-processing agreement, data sovereignty, a deletion concept and no sharing.
12 min read
- Law, privacy & accessibility
Prompt Injection: Securing Your AI Assistant
Why prompt injection tops the OWASP Top 10 for LLM applications, what direct and indirect attacks are, and which guardrails protect your AI chat assistant.
12 min read
About this category
This category sets out the requirements: notices about automated processing, legal bases and consent, storage locations and retention periods for conversation logs, data processing agreements with providers, handling personal data entered by accident, and the rules of the EU regulation on artificial intelligence. Accessibility is part of it too: a chat window has to be operable by keyboard, and focus and status messages have to remain perceivable for screen readers. We describe checkpoints and typical mistakes. The articles do not replace individual legal advice, but they prepare those discussions. We also show which notices users should see before the first chat and how to phrase them briefly and understandably.
How does XICBOT handle your visitors' data?
Data processing agreement, deletion concept and data sovereignty are summarised on a page of their own.