Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
PHP based live chat and chatroom widget that lets visitors talk in real time on a website, with session cookies and message storage on the operator server.
FlashChat is a self hosted PHP based live chat and chatroom application. It was originally built around a Flash widget and has since shifted to a JavaScript and AJAX user interface. Operators install FlashChat on their own web server and embed the widget on one or several pages so that visitors can talk with each other or with a moderator in real time. Because the service is self hosted, the operator of the website is the data controller for every message and identifier processed by FlashChat.
By default FlashChat sets a PHP session cookie (PHPSESSID) when the chat opens, an authentication cookie when a registered user logs in, and a visitor identifier cookie for guests. It logs the IP address, the user agent, the chat handle, the timestamps and the full content of every message in its server side database. Avatar uploads, private messages and moderation actions are also stored on the operator server.
The chat cookies are not strictly necessary to deliver the rest of the website, so Article 5(3) of the ePrivacy Directive requires prior informed consent before they are written. The processing of messages itself falls under Article 6(1)(b) GDPR when it supports a service the visitor has actively requested, but the cookies still need a separate consent. National regulators such as the CNIL in France, the BfDI in Germany and the AEPD in Spain all consider live chat tools to require an opt in cookie banner.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The FlashChat widget should be loaded only after the visitor has accepted a dedicated category in the cookie banner, usually labelled customer support or interactive features. Refusal must be as easy as acceptance, the banner must list the operator as the data controller and the cookie policy must describe the retention of chat logs. A clear way to delete a chat history on request is also expected under Article 17 GDPR.
FlashChat is fully self hosted, so there is no built in transfer to a vendor. The transfer question depends on where the website operator runs the application. Hosting in the EU or EEA keeps the data inside the GDPR perimeter. Hosting in the United States, the United Kingdom or any other third country triggers Chapter V of the GDPR and requires an adequacy decision, standard contractual clauses or binding corporate rules with a documented transfer impact assessment.
Configure the consent management platform to block the FlashChat script until consent is given, prefer EU hosting, set a short retention period for inactive chat logs, restrict the moderator backend to authenticated accounts, document the processing in the Article 30 records and update the privacy policy with a clear mention of FlashChat, the categories of data, the recipients and the retention.
Websites using FlashChat must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for a small community chat, but becomes recommended when FlashChat is used at scale, when it processes sensitive topics (health, religion, political views) or when minors are part of the audience. Document the categories of data exchanged, the retention of message logs and the moderation workflow.
Sample consent text
We use FlashChat to let you talk with our team and other visitors in real time. This sets a session cookie and stores your messages on our server. We need your consent to enable the chat. You can accept, refuse or withdraw your consent at any time.
Third-party domains contacted
tufat.comflashchat.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| PHPSESSID | http_session | Session | Identifies the visitor PHP session for the chat backend. |
| fc_auth | http_persistent | 1 year | Keeps a registered chat account logged in across visits. |
| fc_user | http_persistent | 1 year | Stores the guest nickname and visitor identifier between chat sessions. |
| fc_room | http_persistent | 30 days | Remembers the last chat room joined by the visitor. |
FlashChat uses cookies for user preferences — inform visitors with a consent banner.
FlashChat sets a PHP session cookie (PHPSESSID) when the chat opens, an authentication cookie (fc_auth) when a registered account logs in, and a visitor identifier (fc_user) for guests. None of these cookies are strictly necessary for the rest of the website to function, so the ePrivacy Directive requires prior consent.
Yes. The widget writes non essential cookies and processes identifiers as soon as it is loaded. Article 5(3) of the ePrivacy Directive, transposed in every EU member state, requires an informed opt in before the script runs. The chat must therefore be gated behind a cookie banner category such as customer support.
The cookies rely on consent (Article 6(1)(a) GDPR). The actual message content is processed under Article 6(1)(b) GDPR when the visitor is having a conversation with a moderator that they actively asked for, or under Article 6(1)(f) GDPR for analytics on aggregate moderation metrics, with a documented balancing test.
FlashChat is self hosted, so there is no built in transfer to a vendor. Transfers depend on the hosting choice of the operator. If the server is located in the United States, an SCC, an adequacy decision (Data Privacy Framework) or another safeguard from Chapter V GDPR plus a transfer impact assessment are required.
A formal DPIA is not always mandatory, but it becomes recommended when FlashChat is used at scale, when the chats touch on sensitive topics covered by Article 9 GDPR, or when minors are part of the audience. Even when not strictly required, a short impact assessment is a good way to document risks.
Load the script only after consent, prefer EU hosting, encrypt the server with TLS, store the database in an EU region, set a short retention for inactive logs, restrict the moderation backend to authenticated accounts and document the processing in your Article 30 records.
Modern alternatives include open source projects such as Rocket Chat or Chatwoot for self hosting, and managed European tools like Crisp from France or Userlike from Germany. Each of these still triggers ePrivacy and GDPR obligations, so the consent flow remains required.
List FlashChat in the cookie policy with the cookie names PHPSESSID, fc_auth and fc_user, their purpose (chat session and identification), the controller, the retention period and the rights to access, delete or object. Update the consent banner to add a category for the chat and link to a public privacy notice.