LiveZilla

What LiveZilla is and how it works

LiveZilla is a customer service platform from LiveZilla GmbH (Germany) that combines live chat, ticketing, visitor monitoring and a small CRM. It is distributed as a PHP and MySQL application that publishers can install on their own server, or as a cloud subscription. The self hosted model is one of the main reasons LiveZilla is chosen by German speaking SMBs: it lets the publisher keep all visitor and chat data on infrastructure they fully control.

What data and cookies LiveZilla collects

On load, the LiveZilla widget writes first party cookies (typically prefixed lz_, including lz_visitor and lz_session) on the publisher domain. It also records the visitor IP, user agent, referrer, time on page, navigation path, mouse activity (when typing preview is enabled) and the full chat content. When configured for visitor monitoring, agents can see live page views and even pre-empt conversations with proactive invites.

GDPR and ePrivacy implications

Because LiveZilla writes non strictly necessary cookies and may capture mouse activity before a message is sent, Article 5(3) of the ePrivacy Directive applies: prior consent is required unless the widget is loaded only after explicit user action. German regulators have specifically flagged the typing preview feature as intrusive, so most compliant deployments either disable it or treat it as a high risk processing requiring a DPIA.

Consent and configuration

For a compliant deployment, gate the widget behind your consent management platform (block the LiveZilla overlay script until consent), or use a click to load Contact button. Disable typing preview and proactive monitoring unless you have a strong legitimate interest and a documented DPIA. Anonymise IP addresses in the LiveZilla configuration where the feature is available, and restrict access to visitor data to support agents who genuinely need it.

Data transfers (or absence thereof)

In the self hosted deployment, no data leaves your infrastructure, which makes LiveZilla one of the most attractive options for organisations that cannot accept any third country transfer. In the cloud deployment, data is processed by LiveZilla GmbH in Germany under a DPA, again without systematic non EU transfer. This is a strong argument for the deployment model, but the controller still has to verify any optional integrations (email gateways, push notifications) that might involve third country sub-processors.

Practical compliance steps

List LiveZilla in your cookie policy and record of processing activities, gate the widget behind consent or use click to load, disable typing preview and proactive monitoring by default, anonymise visitor IPs, restrict agent access, configure short retention for chat transcripts, secure your LiveZilla server with HTTPS and updated PHP, sign a DPA with LiveZilla GmbH when using the cloud, and train agents not to capture sensitive data in transcripts.