Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Aircall is a cloud business phone system that provides numbers in 100+ countries, a softphone for browser and desktop, call recording, IVR, and a click to call widget that can be embedded on a website.
Aircall is a French cloud business phone provider that offers numbers in more than a hundred countries, a softphone for browser and desktop, IVR, queue routing, call recording, and integrations with CRMs and helpdesks. Most customers use it as a call centre tool, but Aircall also exposes a click to call widget that can be embedded on a website to let visitors place calls from the browser.
Aircall provides outbound and inbound calling via softphone or hardware SIP devices. Calls are bridged over WebRTC for browser users and over SIP for desktop. The platform stores call metadata (numbers, duration, agent), call recordings if enabled, voicemail audio, and transcripts when AI features are activated. The Click to Dial widget loads a JavaScript snippet from aircall.io and uses WebRTC to capture audio from the visitor.
Aircall sets authentication and session cookies on aircall.io and on the merchant domain when the click to call widget is loaded. It collects the visitor IP, user agent, page URL, the phone number they dial, the call audio if recording is enabled, and any context variables you pass (visitor ID, page, plan). Call recordings can include special category data depending on what callers discuss.
Aircall acts as a processor for call data and as a controller for its own account management. The click to call widget loads non strictly necessary scripts on your site, so Article 5(3) ePrivacy requires consent. Call recording requires a separate legal basis (consent or legitimate interest with a balancing test) plus an explicit notice to both parties at the start of the call, in line with national rules such as French Article L34-1 CPCE and the German Bundesdatenschutzgesetz.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Aircall runs production workloads on AWS in the EU (Ireland and France) and in the US. EU customers can opt for an EU residency tier that keeps voice, metadata and recordings in the EU. International calls and some support tools still imply transfers outside the EU. Transfers rely on Standard Contractual Clauses and on the EU-US Data Privacy Framework where applicable.
Sign the DPA, choose EU residency if your audience justifies it, and gate the click to call widget behind consent in your CMP. Play a recording notice at the start of every recorded call. Set a retention policy for recordings and transcripts. Document Aircall as a processor in your record of processing activities, and update your privacy notice with call recording details, retention, and rights of recourse.
Websites using Aircall must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when call recording, transcription or AI analysis is activated. Document the lawful basis for recording, the retention period, the access control, the EU or US residency choice, and the chain of subprocessors. Pay particular attention to inbound calls from EU consumers being recorded without explicit notice.
Sample consent text
We use Aircall to handle our calls, including the click to call widget on this website. Aircall sets cookies on your browser and processes call metadata on its servers in the EU or the US depending on our plan. The widget loads only after you accept the customer support category in our cookie banner.
Third-party domains contacted
aircall.ioapi.aircall.ioapp.aircall.iocdn.aircall.iophone.aircall.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| auth_token | http_cookie | Session | Authentication token used when the click to call widget or the agent app connect to api.aircall.io. |
| session_id | http_cookie | Session | Session identifier used by the Aircall application to maintain the user state across requests. |
| ajs_anonymous_id | http_cookie | 1 year | Segment anonymous identifier used by Aircall for product analytics on its application surface. |
| __cf_bm | http_cookie | 30 minutes | Cloudflare bot management cookie set by the Aircall edge to protect the API and the application. |
Aircall uses cookies for user preferences — inform visitors with a consent banner.
When the click to call widget is loaded, Aircall sets authentication and session cookies on aircall.io and may set helper cookies on the merchant domain. The web application at app.aircall.io also sets cookies for the agent (auth_token, session_id, ajs_anonymous_id) when agents log in.
Yes for the embedded click to call widget, because it loads non strictly necessary scripts on your site. The Aircall agent application is used by your employees on Aircall domains, so consent rules apply differently there.
Contract performance under Article 6(1)(b) GDPR for handling the call itself, consent under Article 6(1)(a) for the website widget cookies and for call recording (or legitimate interest with a balancing test where local law allows), and legal obligation under Article 6(1)(c) for retention duties.
By default Aircall can use EU and US AWS regions. Enterprise customers can opt for an EU residency tier. International calls and certain support subprocessors imply transfers outside the EU, covered by SCCs and by the EU-US Data Privacy Framework where applicable.
A DPIA is recommended when call recording, AI transcription or sentiment analysis is enabled, especially for inbound consumer calls. Document retention, access control, the AI model provider, and the consent or notice mechanism used to inform callers.
Sign the DPA, enable EU residency if available, gate the click to call widget behind consent, configure call recording with an explicit notice (recording disclaimer at the start of every call), set retention, and restrict access to recordings and transcripts.
Alternatives include Ringover, Diabolocom, Axialys, 3CX, OnOff Business, Zoom Phone, RingCentral and Talkdesk. Choose based on EU hosting, telecom licensing in the countries you operate, and the depth of CRM integration you need.
Add an Aircall entry covering the click to call widget cookies, their lifetime and purpose. Mention the EU residency option if you use it, the call recording feature, the retention period for recordings, and link to the Aircall privacy notice.