Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
LiveAgent is a multi-channel help desk and live chat platform by Quality Unit (Slovakia), used by over 150 000 businesses worldwide for ticketing, live chat, call centre and social media support. The chat widget is loaded via a JavaScript snippet, sets persistent cookies on the visitor browser and can transmit IP addresses, user agent, page URL and chat content to LiveAgent servers, triggering GDPR and ePrivacy obligations.
LiveAgent is a unified customer service platform from Quality Unit, a Slovak company, that combines ticketing, live chat, call centre, social media support and a knowledge base. The product is widely used by SaaS, e-commerce and B2B services to centralise customer conversations across channels. The live chat widget is the most visible component on customer websites: a small JavaScript snippet loads a chat button that, when clicked or proactively triggered, exchanges messages with LiveAgent servers in real time.
On load, the LiveAgent widget sets several first party and third party cookies on the customer subdomain (typically agent.subdomain.ladesk.com), including la_id (visitor identifier), la_sid (session identifier) and lt_session. It also collects the visitor IP address, user agent, referrer, page URL, time on page and any data the visitor types into the chat. Optionally, agents can attach files and the platform stores complete chat transcripts indefinitely (subject to retention settings).
Although Quality Unit is established in the EU, the LiveAgent chat widget still falls under Article 5(3) of the ePrivacy Directive because it writes non strictly necessary cookies to the visitor browser. Most EU supervisory authorities (CNIL, BfDI, AEPD) consider live chat trackers as Functional or Marketing depending on configuration, and require prior consent unless the chat is loaded only after explicit user action (such as clicking a Contact button).
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In practice, two compliant patterns work for LiveAgent. Pattern A: block the widget script until the visitor accepts the Functional category in your consent manager, then load it on consent. Pattern B: replace the auto loading widget with a static Contact us button that only triggers the widget after the visitor clicks, which can rely on Art. 6(1)(b) GDPR (steps prior to entering a contract) and may not require a cookie consent banner. Pattern B is preferred when chat is reactive only and no proactive tracking is enabled.
LiveAgent infrastructure is primarily in the EU, but Quality Unit relies on sub-processors in the United States for CDN, error reporting (Sentry), notification services and AI features. Transfers to the US are governed by Standard Contractual Clauses and, where applicable, the EU, US Data Privacy Framework. The list of sub-processors is published by Quality Unit and should be reviewed and documented in your record of processing activities.
Sign the LiveAgent Data Processing Agreement, list LiveAgent in your cookie policy and record of processing activities, gate the widget behind consent or use a click to load Contact pattern, document the sub-processor list and any cross border transfers, set chat retention to the minimum necessary, train agents not to record sensitive data in transcripts, and offer visitors a clear way to request access, deletion or portability of their chat history.
Websites using LiveAgent must obtain user consent under GDPR regulations.
DPIA considerations
LiveAgent processes visitor IP address, user agent, browser fingerprint signals, page URL, time on page, visitor identifier (cookie), chat transcript content and any personal data the visitor voluntarily provides (name, email, phone). Key DPIA considerations: (1) chat content can include special categories of data (health, religion, financial details) shared spontaneously by visitors and requires Art. 9 GDPR consideration; (2) persistent visitor cookies (la_id, la_sid) allow long term identification across sessions and pages; (3) some sub-processors are located outside the EU (US CDN, notification services), requiring SCCs and a Transfer Impact Assessment; (4) chat recording, transcript storage and AI-assisted features may amount to systematic monitoring of communications; (5) potential profiling when LiveAgent is paired with marketing automation or CRM. A DPIA is recommended whenever chat is used at scale or in regulated industries (healthcare, finance, legal).
Sample consent text
We use LiveAgent to offer live chat support. When you load this page, LiveAgent places cookies on your device to identify your session and may transfer your IP address, page URL and chat content to LiveAgent servers in the EU and to selected sub-processors. You can withdraw your consent at any time via our cookie settings.
Third-party domains contacted
ladesk.comliveagent.comcdn.ladesk.comliveagentapi.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| la_id | Functional | 1 year | Persistent visitor identifier used by LiveAgent to recognise returning visitors, maintain chat history across sessions and route conversations to the right agent. |
| la_sid | Functional | Session | Session identifier used to keep the chat window state consistent during a single browsing session. |
| lt_session | Functional | Session | Tracks the chat session state, including which agent is handling the conversation and whether the chat window is open. |
| lt_recent | Functional | 30 days | Stores the most recent chat session so the visitor can resume where they left off if they return within the retention window. |
| lt_online | Functional | Session | Indicates whether a live agent is currently available, used to display the online or offline status of the widget. |
LiveAgent uses cookies for user preferences — inform visitors with a consent banner.
LiveAgent sets several first party and third party cookies on the customer subdomain (typically agent.subdomain.ladesk.com), including la_id (persistent visitor identifier, 1 year), la_sid (session identifier), lt_session and lt_recent. These cookies are used to identify returning visitors, maintain chat continuity and route conversations to the right agent.
Yes, in most cases. Because the widget writes non-essential cookies to the visitor browser, Article 5(3) of the ePrivacy Directive requires prior consent. The exception is a click to load pattern where the widget is only initialised after the visitor clicks a static Contact button, which can rely on Art. 6(1)(b) GDPR (steps prior to entering a contract).
For the cookies and tracking pixels, the basis is consent under Art. 6(1)(a) GDPR. For the chat content itself, the basis is typically Art. 6(1)(b) (performance of a contract or pre-contractual steps) when the visitor is seeking support, or Art. 6(1)(f) (legitimate interest) for general inquiries, subject to a balancing test.
Quality Unit hosts LiveAgent primarily in the EU. However, sub-processors located in the United States (CDN, error reporting via Sentry, notification services, AI features) may receive limited data. These transfers are governed by Standard Contractual Clauses and, where applicable, the EU, US Data Privacy Framework. Always check the current sub-processor list on Quality Unit's site.
A DPIA is recommended when LiveAgent is used at scale (large customer base), in regulated sectors (healthcare, finance, legal), to process sensitive data, or in combination with proactive triggers, behavioural targeting or AI-driven routing. For low volume reactive chat with no special data, a documented assessment is usually sufficient.
Sign the LiveAgent Data Processing Agreement, gate the widget behind your consent management platform or use a click to load Contact pattern, list LiveAgent in your cookie policy and record of processing activities, configure chat retention to the minimum necessary, train agents not to record sensitive data in transcripts, document your sub-processor list, and offer visitors a way to exercise their GDPR rights.
EU based or privacy focused alternatives include Crisp (France), Chatwoot (self hosted open source), HelpCrunch (Ukraine), Tidio (Poland), Userlike (Germany) and Freshchat (with EU data residency). When evaluating alternatives, consider data residency, sub-processor list, retention controls, DPA terms and whether chat is purely reactive or includes proactive tracking.
List LiveAgent by name, the categories of cookies (Functional, Marketing), the data collected (IP address, user agent, page URL, chat content, visitor identifier), the controller and processor relationship with Quality Unit s.r.o., the data centre region (EU), the retention period (configurable), the sub-processors with locations including any US ones, and a link to the LiveAgent privacy notice.