Law, privacy & accessibility
An assistant processes input from visitors — which brings data protection and transparency obligations.
In plain language
This topic is about law and data protection. It also covers accessibility. An assistant reads what visitors type. Rules apply to that. The articles explain these rules and common mistakes. A chat must also work with a keyboard. The articles do not replace advice from a lawyer for your own case.
- articles
- 18
- min average read
- 13
-
Minors in Chat: What Article 8 GDPR Requires
When Art. 8 GDPR applies to a chat assistant, why a click on Accept proves no age, and how an assistant handles children with as little data as possible.
Law, privacy & accessibility13 min read
-
New Product Liability Directive: Software and Chat Assistants
Directive (EU) 2024/2853 counts software as a product; this article sets out key dates, types of damage, updates and rules of evidence for chat assistants.
Law, privacy & accessibility14 min read
-
What a Chat Assistant May Say About Prices
If an assistant quotes a price, it is advertising with a price. What belongs in the same reply, when the 30-day rule applies and why prices come from the shop.
Law, privacy & accessibility13 min read
-
Cancellation Button and Chat: Handling Requests to Cancel
What Sec. 312k BGB requires for the cancellation button and confirmation, and how a chat assistant guides requests to cancel onto that path without obstacles.
Law, privacy & accessibility13 min read
-
Chat Widget and Cookie Banner: What Section 25 TDDDG Requires
When a chat widget needs consent under Sec. 25 TDDDG, what it may store before the first message and how banner, withdrawal and records fit together.
Law, privacy & accessibility13 min read
-
CRA reporting: is your chat assistant in scope?
Article 14 of the Cyber Resilience Act has applied since 11 September 2026. Check whether a chat assistant is in scope and which deadlines start on awareness.
Law, privacy & accessibility15 min read
-
DPIA for a chat assistant: when it is required
When Article 35 GDPR requires a data protection impact assessment for your chat assistant: the three cases in paragraph 3, the authority list and the structure.
Law, privacy & accessibility14 min read
-
Contact data from chat: getting consent right
When a chat needs consent and when pre-contractual steps carry it: legal bases under the GDPR, TDDDG and UWG, plus records and withdrawal at a glance.
Law, privacy & accessibility13 min read
-
AI Literacy under Art. 4 AI Act: Roles, Records
Article 4 of the AI Act requires AI literacy from providers and deployers. Four roles around a website assistant, and the records that evidence them.
Law, privacy & accessibility13 min read
-
Right of access to chat data under the GDPR
What a visitor may learn about their chat transcript under Article 15 GDPR: deadline, copy, origin, recipients, redaction and access without an account.
Law, privacy & accessibility13 min read
-
Setting Retention Periods for Chat Logs
How long chat logs may be kept: storage limitation under Article 5 GDPR, erasure under Article 17, anonymisation and when commercial retention duties apply.
Law, privacy & accessibility13 min read
-
Data processing agreement for an AI assistant
Article 28 GDPR in plain terms: when a provider is a processor, which eight duties the contract carries and what applies to a third-party language model.
Law, privacy & accessibility14 min read
-
Chatbot Liability: What the OLG Hamm Ruling Means
On 12 May 2026 the OLG Hamm ruled that companies are liable for misleading statements made by their AI chatbot. What the judgment means for operators.
Law, privacy & accessibility12 min read
-
Accessible AI Chat Assistant: WCAG and the EAA
The EAA has applied since 28 June 2025: what an accessible AI chat assistant needs - keyboard operation, screen readers, visible focus and WCAG 2.2 AA.
Law, privacy & accessibility12 min read
-
EU AI Act 2026: Chatbot Disclosure Duties Explained
From 2 August 2026, Article 50 of the AI Act applies: users must be able to tell they are chatting with an AI, not a human. What it means for your website chat.
Law, privacy & accessibility11 min read
-
GDPR-Compliant AI Chat: Hosting and Data Protection
What makes an AI chat assistant GDPR-compliant: hosting in Germany, a data-processing agreement, data sovereignty, a deletion concept and no sharing.
Law, privacy & accessibility12 min read
-
Prompt Injection: Securing Your AI Assistant
Why prompt injection tops the OWASP Top 10 for LLM applications, what direct and indirect attacks are, and which guardrails protect your AI chat assistant.
Law, privacy & accessibility12 min read
About this category
This category sets out the requirements: notices about automated processing, legal bases and consent, storage locations and retention periods for conversation logs, data processing agreements with providers, handling personal data entered by accident, and the rules of the EU regulation on artificial intelligence. Accessibility is part of it too: a chat window has to be operable by keyboard, and focus and status messages have to remain perceivable for screen readers. We describe checkpoints and typical mistakes. The articles do not replace individual legal advice, but they prepare those discussions. We also show which notices users should see before the first chat and how to phrase them briefly and understandably.
How does XICBOT handle your visitors' data?
Data processing agreement, deletion concept and data sovereignty are summarised on a page of their own.