Embedding Crisp Chat in a GDPR-compliant way

Crisp (crisp.chat, Crisp IM SARL, France) is a widely used live chat and helpdesk widget. The provider is based in the EU and offers EU data hosting — the chat widget still loads a script on page load and sets storage entries.

Live chat widgets are a borderline case in data protection law: as long as no one uses the chat, the script loaded in the background does not fulfil any purpose the visitor wants — it merely prepares possible later use. It is precisely this advance loading that is the problem. Crisp stores a session identifier in local storage on page load and establishes a connection to the Crisp servers before the visitor clicks anything.

Crisp has an advantage over many US competitors: the company is based in France and, depending on the plan, offers hosting of the chat data in the EU. That eases the third-country question. But it does not replace consent for the access to the device — local storage entries and script loading require consent regardless of the server location if they are not technically necessary.

The clean solution is “on-demand” loading: instead of embedding the Crisp snippet directly, the page initially shows only a custom button. Only on the click is the Crisp script inserted via JavaScript and the chat opened. This way the access to the device only happens when the visitor actively requests the service — then Section 25(2) TDDDG applies (strictly necessary for the requested service).

Is this a risk?

The Crisp widget loads JavaScript from client.crisp.chat on page load and stores an identifier in the browser to associate chat histories with a visitor. This access to the device is not “strictly necessary” as long as the visitor does not actively use the chat — under Section 25(1) TDDDG it therefore requires consent if the widget already loads before the first click.

What you can do

• Load the Crisp script only after active interaction — e.g. a custom “Open chat” button that loads the widget via JavaScript.
• Enable the EU data region in the Crisp dashboard where available, and conclude a data processing agreement with Crisp IM SARL.
• If the widget loads globally: include it in the consent layer and block it until consent is given.
• Name Crisp in the privacy policy — provider, purpose (customer communication), data stored (chat history, IP, possibly email), retention period.

Häufige Fragen

Does Crisp need a consent banner?

If the widget loads on page load: yes. It sets local storage entries and loads scripts before the visitor uses the chat. If the widget only loads after an active click, the use can be based on Section 25(2) TDDDG.

Where is the chat data stored?

Crisp IM SARL is based in France. Depending on the plan, EU data hosting can be selected. The exact storage location should be checked in the dashboard and named in the privacy policy.

How do I load Crisp only after a click?

Do not embed the standard snippet directly; show a custom button instead. On the click, insert the Crisp script (client.crisp.chat) into the DOM via JavaScript and call $crisp.push(['do', 'chat:open']).

Is a data processing agreement with Crisp enough?

The DPA is mandatory but not sufficient on its own. It governs the processing on behalf; the question of consent for the device access under the TDDDG is separate from it.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.