Crisp Live Chat

What is Crisp Live Chat?

Crisp Live Chat is a customer messaging and live chat platform developed by Crisp IM SAS, a company incorporated in France and headquartered in Nantes. It provides website visitors with a real-time chat widget through which they can contact support or sales teams. Crisp also offers chatbots, a shared inbox, CRM integrations, email campaigns, and knowledge base features. All infrastructure and data processing occurs within the European Union, which makes Crisp a privacy-favourable choice compared to US-headquartered live chat alternatives.

What Data and Cookies Does Crisp Collect?

Crisp sets session-based cookies to maintain chat continuity across page navigations: crisp-client/session/{website-id} (session identification, 6 months) and related session state cookies. It collects visitor IP addresses, page URLs browsed, browser type, device type, and the content of chat messages exchanged. If visitors identify themselves during a chat, their name, email address, and any information they share becomes part of the Crisp CRM record. Crisp also tracks page view sequences and session duration to provide context to support agents.

GDPR and ePrivacy Implications

Because Crisp is based in France and processes data exclusively within the EU, it avoids the data sovereignty risks associated with US-based services. However, GDPR still applies fully: the session cookies Crisp sets are not strictly necessary for the website itself, they are necessary for the chat service. Under the ePrivacy Directive, cookies that are strictly necessary for a service explicitly requested by the user may be exempt from consent requirements. If the chat widget loads automatically on every page without user request, the session cookie likely requires consent. If it only activates when the user clicks to open the chat, a strictly-necessary exemption may apply.

Consent Requirements

For most deployment configurations, Crisp requires consent under the ePrivacy Directive because the chat widget loads and sets cookies on every page view regardless of whether the visitor initiates a chat. The safest approach is to obtain consent before loading the Crisp script. Alternatively, configure Crisp to use a minimised launcher mode that only fully initialises and sets session cookies when the user actively clicks the chat bubble. In either case, disclose Crisp in your cookie policy, identify Crisp IM SAS as the data processor, and document the lawful basis in your Records of Processing Activities.

EU Data Processing and No Third-Country Transfers

Crisp stores all conversation data, contact records, and analytics on servers located within the European Union. There are no transfers of personal data to third countries outside the EU or EEA. This eliminates the need to rely on Standard Contractual Clauses or other GDPR Chapter V transfer mechanisms for core Crisp functionality. Website operators should nonetheless execute a Data Processing Agreement with Crisp (available in the Crisp dashboard) to formalise the controller-processor relationship and satisfy GDPR Article 28 requirements.

Practical Compliance Steps

Sign a Data Processing Agreement with Crisp via your account settings. If your consent management platform controls cookie loading, add Crisp to the functional or chat category and gate its loading on consent. Alternatively, evaluate whether your deployment qualifies for the strictly-necessary exemption. Update your cookie policy to list Crisp session cookies, their purpose and duration, and identify Crisp IM SAS as the data processor. Configure Crisp's data retention settings to align with your privacy policy. If you use Crisp AI or analytics add-ons, reassess the legal basis as these features involve additional profiling.