Zendesk Chat

What is Zendesk Chat?

Zendesk Chat, now integrated into the Zendesk Web Widget, is a live chat and customer messaging solution used by hundreds of thousands of businesses worldwide. It embeds a widget on your website that allows support agents to chat with visitors in real time, handle multiple conversations simultaneously, and route tickets to the right team. The Web Widget also supports chatbot automation via Zendesk Answer Bot and integrates with the broader Zendesk Support, Sell, and Sunshine platforms. When the widget script loads, it immediately sets cookies and begins collecting visitor data, including identity information if the visitor is a logged-in customer.

What data and cookies does Zendesk Chat collect?

Zendesk Chat sets several cookies including __zlcmid (a persistent visitor identifier valid for 1 year used to recognise returning chat users), and session-level cookies for maintaining active conversations. Local storage entries store visitor preferences and conversation state. The platform collects IP addresses, browser type and version, device information, pages viewed before and during the chat, geolocation derived from IP, and the full content of all chat transcripts including any personal or sensitive data shared by the visitor during the conversation.

GDPR and ePrivacy implications

The Zendesk Chat widget loads automatically on page entry and sets persistent cookies before any interaction, triggering the ePrivacy Directive requirement for prior consent. Under GDPR, the collection of visitor identifiers, browsing behaviour, and conversation content constitutes personal data processing. Chat transcripts in particular may contain sensitive personal data shared voluntarily by users (health issues, financial details, complaints), raising the risk profile of the processing activity. A lawful basis and appropriate technical safeguards are required for all this data.

Consent requirements

Consent must be collected before the Zendesk Web Widget script loads. The widget must be suppressed entirely when consent is refused or has not yet been given. Consent banners must disclose that Zendesk Chat is used for live support, describe the cookies and data collected, and inform users of the potential transfer to US servers. Users who decline should still be able to access support through alternative channels such as email or a contact form. Consent must be revocable and the widget must be disabled immediately upon withdrawal.

Data transfers outside the EU

Zendesk is a US company (subsidiary of Salesforce). By default, customer data is processed on US-based infrastructure. Enterprise customers can request EU data residency, with data hosted in Frankfurt on Zendesk Pod 15 or Pod 26. For organisations not on Enterprise plans, Standard Contractual Clauses are the applicable transfer mechanism. Zendesk is also certified under the EU-US Data Privacy Framework. All transfers must be disclosed in the privacy policy and documented in the Records of Processing Activities. A signed Data Processing Agreement with Zendesk is required.

Practical compliance steps

To deploy Zendesk Chat compliantly: configure your consent management platform to block the Web Widget snippet until consent is granted; use Zendesk's JavaScript API to conditionally initialise the widget post-consent; suppress the widget launcher icon until consent is obtained so it does not imply data collection is already running; categorise Zendesk Chat under functional or customer support cookies; update your privacy and cookie policy to disclose the __zlcmid cookie, its duration, and its purpose; document the US transfer and applicable safeguard in your RoPA; and evaluate EU data residency if you process large volumes of European personal data through support interactions.