> Chatwoot live chat: how the widget works, which cookies it sets, why prior consent is required under the GDPR and ePrivacy and how to deploy it. > > Canonical: https://www.flowconsent.com/en/services/customer-support/chatwoot Customer support # Chatwoot Preferences · [Official website](https://www.chatwoot.com) Chatwoot is an open source customer engagement suite combining live chat, shared inbox, helpdesk and chatbot capabilities. Its embedded widget loads a JavaScript SDK, opens a WebSocket connection to the Chatwoot server and stores cw\_conversation in cookies and local storage to keep a returning visitor connected to their conversation. As a customer support widget, it requires consent for visitors who have not yet engaged. [Block Chatwoot until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Preferences - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers Self hosted by the controller (often EU). Chatwoot Cloud is hosted on AWS in the United States with regional EU and Asia Pacific options for paid plans. Overview ## What does Chatwoot do? ## **What is Chatwoot?** Chatwoot is an open source, multi channel customer engagement suite. It bundles a website live chat widget, a shared inbox for email, WhatsApp, Facebook Messenger, Instagram and Twitter, helpdesk articles and AI assisted bots. Many European SaaS companies and ecommerce stores either self host Chatwoot in their own infrastructure or use the Chatwoot Cloud SaaS (with EU and US regions). ## **Cookies and identifiers** The widget stores the cw\_conversation cookie and the cw\_user\_xxx local storage entries on the publisher domain to keep the visitor associated with their conversation. The websocket carries the messages, page context and visitor identifiers (set by setUser API calls if you authenticate end users) to the Chatwoot backend. ## **GDPR and ePrivacy implications** Loading the chat widget without a user interaction is not strictly necessary for the visitor's requested service, so European DPAs (CNIL, Garante) consider that prior consent is required under Article 5(3) ePrivacy. Once the visitor opens the chat and types a message, processing the conversation falls under contract performance or legitimate interest in providing customer support. ## **Consent management** Block sdk.js through your CMP until the visitor accepts the necessary or functional cookies category. A frequent compliant pattern is the click to chat alternative: a static button on the page replaces the widget, and the actual Chatwoot SDK is only loaded after the user clicks it, which constitutes an explicit consent. ## **Hosting and data transfers** Self hosting Chatwoot in the EU keeps all conversation data inside your infrastructure. Chatwoot Cloud uses AWS, with EU regions available on paid plans; the default US region implies a transfer that must be covered by Standard Contractual Clauses or the EU U.S. Data Privacy Framework, plus disclosure in your privacy policy. ## **Implementing Chatwoot compliantly** Gate the widget on a CMP signal or click to chat trigger, set retention periods on conversations and contacts, configure the data export and deletion APIs to honour data subject requests, and document Chatwoot Inc. as a processor (or yourself for the self hosted edition) in your records of processing. Compliance ## Chatwoot and the GDPR Chatwoot is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy when the widget is loaded for visitors who have not yet started a conversation, since the cw\_conversation cookie and the WebSocket are not strictly necessary for browsing the page. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU U.S. Data Privacy Framework (Cloud edition only) ### Impact assessment (DPIA) A DPIA should be considered when Chatwoot is integrated with CRM, customer health scoring or AI bots that process conversation transcripts at scale. Cloud editions outside the EU also raise transfer risks worth assessing. ### Sample text for your banner > We use Chatwoot to offer live chat support. With your consent, the widget will load on your device, store the cw\_conversation cookie and forward your messages to our Chatwoot server. You can refuse or withdraw your consent at any time from the cookie settings. Cookies and trackers ## What Chatwoot sets and contacts - Tracking method JavaScript live chat widget (sdk.js loaded from app.chatwoot.com or the self hosted Chatwoot instance) that opens a WebSocket connection to the Chatwoot backend, stores conversation tokens in cookies and local storage, and processes the conversation history server side. - Server location Self hosted by the controller (often EU). Chatwoot Cloud is hosted on AWS in the United States with regional EU and Asia Pacific options for paid plans. ### Cookies set (2) | Name | Type | Duration | Purpose | | ---------------- | ------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------- | | cw\_conversation | first\_party | 1 year | Stores the Chatwoot conversation token to keep returning visitors connected to their conversation thread. | | cw\_user\_\* | first\_party | 1 year | Stores visitor identifier and basic context (name, email if provided) to attribute messages to the right contact in Chatwoot. | ### Third-party domains contacted (3) - `app.chatwoot.com` - `cdn.chatwoot.com` - `self-hosted Chatwoot instance (controller domain)` Questions ## Frequently asked questions about Chatwoot Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Chatwoot set? The Chatwoot widget stores the cw\_conversation cookie and the cw\_user\_xxx local storage entries on the publisher domain to keep the visitor associated with their conversation. The cookie is required for the chat to function once the user has engaged. ### Does Chatwoot require consent? Yes, in most cases. European DPAs consider that auto loading the chat widget is not strictly necessary and requires prior consent under Article 5(3) ePrivacy. A click to chat pattern can substitute the consent banner by capturing explicit user intent. ### What is the legal basis? Once the visitor types a message, processing the conversation can rely on contract performance or legitimate interest in providing customer support. Loading the widget passively still requires consent. ### Are data transferred to the United States? Not when Chatwoot is self hosted in the EU. Chatwoot Cloud uses AWS with EU and US regions; the US region triggers a transfer that must rely on Standard Contractual Clauses or the EU U.S. Data Privacy Framework. ### Do I need a DPIA for Chatwoot? A DPIA is recommended when Chatwoot is integrated with CRM, customer scoring or AI bots that process transcripts at scale. Pure live chat with EU hosting and limited retention typically does not trigger a mandatory DPIA. ### How do I deploy Chatwoot compliantly? Block the SDK until consent or use click to chat, set retention periods on conversations, configure data export and deletion APIs to honour data subject rights, and document the legal basis in your records of processing. ### Are there alternatives to Chatwoot? EU friendly alternatives include Crisp (France), LiveChat (Poland), Zammad (Germany) or your own self hosted Rocket.Chat instance, all of which offer EU data residency. ### How do I update my cookie policy? Add a section that names Chatwoot, lists the cookie cw\_conversation with purpose and duration, mentions the local storage entries and clarifies whether the data stays in your EU instance or is transferred to Chatwoot Cloud. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [Copilot.Live](https://www.flowconsent.com/en/services/customer-support/copilot-live) [Copilot.Live is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Copilot.Live integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Copilot.Live helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/copilot-live) [Preferences](https://www.flowconsent.com/en/services/customer-support/copilot-live) · ### [BokaBord](https://www.flowconsent.com/en/services/customer-support/bokabord) [BokaBord is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. BokaBord provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, BokaBord helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/customer-support/bokabord) [Preferences](https://www.flowconsent.com/en/services/customer-support/bokabord) · ### [Provide Support](https://www.flowconsent.com/en/services/customer-support/provide-support) [Provide Support is a customer support and helpdesk platform that helps businesses manage, track, and resolve customer inquiries efficiently. It provides a unified ticketing system, knowledge base, and multi-channel support across email, chat, phone, and social media. Provide Support features automated ticket routing, SLA management, and self-service portals, enabling faster resolutions, higher satisfaction, and reduced operational costs for support teams.](https://www.flowconsent.com/en/services/customer-support/provide-support) [Preferences](https://www.flowconsent.com/en/services/customer-support/provide-support) · ### [AINIRO](https://www.flowconsent.com/en/services/customer-support/ainiro) [AINIRO is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AINIRO integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AINIRO helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/ainiro) [Preferences](https://www.flowconsent.com/en/services/customer-support/ainiro) · ### [Trengo](https://www.flowconsent.com/en/services/customer-support/trengo) [Trengo is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Trengo supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Trengo ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/customer-support/trengo) [Preferences](https://www.flowconsent.com/en/services/customer-support/trengo) · ### [Re:amaze](https://www.flowconsent.com/en/services/customer-support/re-amaze) [Re:amaze is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Re:amaze supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Re:amaze ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/customer-support/re-amaze) [Preferences](https://www.flowconsent.com/en/services/customer-support/re-amaze) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)