FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Customer support

FlashChat

PreferencesOfficial website

PHP based live chat and chatroom widget that lets visitors talk in real time on a website, with session cookies and message storage on the operator server.

Block FlashChat until consentScan my site
Overview

What does FlashChat do?

What is FlashChat

FlashChat is a self hosted PHP based live chat and chatroom application. It was originally built around a Flash widget and has since shifted to a JavaScript and AJAX user interface. Operators install FlashChat on their own web server and embed the widget on one or several pages so that visitors can talk with each other or with a moderator in real time. Because the service is self hosted, the operator of the website is the data controller for every message and identifier processed by FlashChat.

What data and cookies FlashChat collects

By default FlashChat sets a PHP session cookie (PHPSESSID) when the chat opens, an authentication cookie when a registered user logs in, and a visitor identifier cookie for guests. It logs the IP address, the user agent, the chat handle, the timestamps and the full content of every message in its server side database. Avatar uploads, private messages and moderation actions are also stored on the operator server.

GDPR and ePrivacy implications

The chat cookies are not strictly necessary to deliver the rest of the website, so Article 5(3) of the ePrivacy Directive requires prior informed consent before they are written. The processing of messages itself falls under Article 6(1)(b) GDPR when it supports a service the visitor has actively requested, but the cookies still need a separate consent. National regulators such as the CNIL in France, the BfDI in Germany and the AEPD in Spain all consider live chat tools to require an opt in cookie banner.

Consent and user controls

The FlashChat widget should be loaded only after the visitor has accepted a dedicated category in the cookie banner, usually labelled customer support or interactive features. Refusal must be as easy as acceptance, the banner must list the operator as the data controller and the cookie policy must describe the retention of chat logs. A clear way to delete a chat history on request is also expected under Article 17 GDPR.

Data transfers and hosting

FlashChat is fully self hosted, so there is no built in transfer to a vendor. The transfer question depends on where the website operator runs the application. Hosting in the EU or EEA keeps the data inside the GDPR perimeter. Hosting in the United States, the United Kingdom or any other third country triggers Chapter V of the GDPR and requires an adequacy decision, standard contractual clauses or binding corporate rules with a documented transfer impact assessment.

Practical compliance steps

Configure the consent management platform to block the FlashChat script until consent is given, prefer EU hosting, set a short retention period for inactive chat logs, restrict the moderator backend to authenticated accounts, document the processing in the Article 30 records and update the privacy policy with a clear mention of FlashChat, the categories of data, the recipients and the retention.

Compliance

FlashChat and the GDPR

FlashChat is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive) for the chat cookies and identifiers. Performance of a contract (Article 6(1)(b) GDPR) for messages exchanged during an active conversation.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), national implementations such as the French Data Protection Act and the German TDDDG, plus the EU Digital Services Act for hosted chat content.

Impact assessment (DPIA)

A DPIA is generally not required for a small community chat, but becomes recommended when FlashChat is used at scale, when it processes sensitive topics (health, religion, political views) or when minors are part of the audience. Document the categories of data exchanged, the retention of message logs and the moderation workflow.

Sample text for your banner

We use FlashChat to let you talk with our team and other visitors in real time. This sets a session cookie and stores your messages on our server. We need your consent to enable the chat. You can accept, refuse or withdraw your consent at any time.
Cookies and trackers

What FlashChat sets and contacts

Tracking method
JavaScript widget with iframe and HTTP session cookies
Server location
Self hosted (server location depends on the operator)

Cookies set (4)

NameTypeDurationPurpose
PHPSESSIDhttp_sessionSessionIdentifies the visitor PHP session for the chat backend.
fc_authhttp_persistent1 yearKeeps a registered chat account logged in across visits.
fc_userhttp_persistent1 yearStores the guest nickname and visitor identifier between chat sessions.
fc_roomhttp_persistent30 daysRemembers the last chat room joined by the visitor.

Third-party domains contacted (2)

  • tufat.com
  • flashchat.com
Questions

Frequently asked questions about FlashChat

Can't find your question? Write to us, we answer fast.

Which cookies does FlashChat set?

FlashChat sets a PHP session cookie (PHPSESSID) when the chat opens, an authentication cookie (fc_auth) when a registered account logs in, and a visitor identifier (fc_user) for guests. None of these cookies are strictly necessary for the rest of the website to function, so the ePrivacy Directive requires prior consent.

Is user consent required to load FlashChat?

Yes. The widget writes non essential cookies and processes identifiers as soon as it is loaded. Article 5(3) of the ePrivacy Directive, transposed in every EU member state, requires an informed opt in before the script runs. The chat must therefore be gated behind a cookie banner category such as customer support.

What is the legal basis for processing chat messages?

The cookies rely on consent (Article 6(1)(a) GDPR). The actual message content is processed under Article 6(1)(b) GDPR when the visitor is having a conversation with a moderator that they actively asked for, or under Article 6(1)(f) GDPR for analytics on aggregate moderation metrics, with a documented balancing test.

Are chat messages transferred to the United States?

FlashChat is self hosted, so there is no built in transfer to a vendor. Transfers depend on the hosting choice of the operator. If the server is located in the United States, an SCC, an adequacy decision (Data Privacy Framework) or another safeguard from Chapter V GDPR plus a transfer impact assessment are required.

Do I need a DPIA for FlashChat?

A formal DPIA is not always mandatory, but it becomes recommended when FlashChat is used at scale, when the chats touch on sensitive topics covered by Article 9 GDPR, or when minors are part of the audience. Even when not strictly required, a short impact assessment is a good way to document risks.

How do I implement FlashChat compliantly?

Load the script only after consent, prefer EU hosting, encrypt the server with TLS, store the database in an EU region, set a short retention for inactive logs, restrict the moderation backend to authenticated accounts and document the processing in your Article 30 records.

Are there alternatives to FlashChat?

Modern alternatives include open source projects such as Rocket Chat or Chatwoot for self hosting, and managed European tools like Crisp from France or Userlike from Germany. Each of these still triggers ePrivacy and GDPR obligations, so the consent flow remains required.

How do I update my cookie policy for FlashChat?

List FlashChat in the cookie policy with the cookie names PHPSESSID, fc_auth and fc_user, their purpose (chat session and identification), the controller, the retention period and the rights to access, delete or object. Update the consent banner to add a category for the chat and link to a public privacy notice.

Same category

More services: Customer support

See the whole category

Kapture CRM

Kapture CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Kapture CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Kapture CRM empowers data-driven relationship management.

Preferences

Re:plain

Re:plain is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Re:plain supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Re:plain ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Nolt

Nolt is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Nolt integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Nolt helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Visitor Chat

Visitor Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. Visitor Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, Visitor Chat helps convert visitors into customers.

Preferences

ScapBot

ScapBot is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. ScapBot supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, ScapBot enables informed decisions that improve experience and drive results.

Analytics

Pubble

Pubble is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Pubble supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Pubble ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site