Get Ready for U.S. State Privacy Laws in Your Chat Widget!

Privacy rules across the United States are evolving rapidly. California’s Consumer Privacy Act (CCPA) and Privacy Rights Act (CPRA) remain the most widely recognized frameworks, and we provide a dedicated guide helping you to Get Ready for CCPA/CPRA.  

Beyond California, more than 20 U.S. states now have (or soon will have) obligations related to user consent, privacy notices, and individual rights requests (access, correction, deletion, opt-out). Examples include: 

• Virginia Consumer Data Protection Act (VCDPA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Utah Consumer Privacy Act (UCPA)
• Florida Digital Bill of Rights (FDBR)
• Delaware Personal Data Privacy Act (DPDPA) 
• Indiana Consumer Data Protection Act (ICDPA) 
• Iowa Consumer Data Protection Act 
• Kentucky Consumer Data Protection Act (KCDPA) 
• Maryland Online Data Privacy Act (MODPA) 
• Minnesota Consumer Data Privacy Act (MNCDPA)
• Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas 

While details vary, the goal is the same: give people more control over their data and require clear, transparent practices.

Why It Matters

If you chat with customers across U.S. states, you’ll likely need to:

• Provide a clear privacy notice before collecting personal data.
• Obtain consent in certain circumstances, particularly for sensitive information.
• Respond to requests from individuals who wish to access, correct, delete, and opt out of targeted ads/sales/sharing.
• Ensure that conversations are handled securely and responsible handling of conversations and logs.

In addition, some states are opt-out (process until the user objects); others require opt-in. Many add extra protections for children’s data, or add stricter twists (e.g., Maryland’s strong data-minimization rule; Florida’s FDBR with its own scope).

By enabling privacy features such as consent requests and notices in your chat widget, you can better align with these evolving state-level requirements and demonstrate your commitment to compliance across multiple jurisdictions

How to Stay Compliant

You do not need to overhaul your entire business model to address state privacy requirements. Implementing a few core practices will help ensure that your chat interactions align with evolving regulations:

• Provide a Clear Pre-chat Privacy Notice:  Explain what data you collect (e.g., as name, email address, or chat content) and why it is collected (for example, customer support or troubleshooting). Link your Privacy Policy for those who wish to review the details.
• Obtain Consent When Required: When opt-in is required, make sure your pre-chat form asks for consent first. If the customer says no, that’s okay- the chat just won’t go ahead.
• Support Customer Rights: Establish processes for requesting access, deletion, correction, or opting out of data sharing, depending on the applicable state law.
• Apply Security Measures: Implement appropriate technical and organizational safeguards to protect customer data against unauthorized access, loss, or misuse.
• Assess Applicability and keep it proportional: Keep in mind that some state laws apply only to businesses above certain thresholds (revenue, the volume of data processed, or business model). Confirm which frameworks apply to your organization and tailor the above accordingly.

The information provided here is not meant to be construed as legal advice. It is always recommended to seek guidance from a legal advisor to ensure compliance with your local applicable regulations. Therefore, we advise consulting with qualified legal counsel regarding your particular business and data processing circumstances.

Handling Customer Data in Your Chat Widget - Configure your chat

If your chat widget is used for transactions (for example, on an e-commerce site), this information can be incorporated into the agreement between you and your customer. If you use the widget for support or general inquiries, you should still notify visitors that their data (such as name, email, or chat content) will be collected and processed.

In addition, make sure your privacy notices address whether third-party providers (such as analytics or chat service platforms) are involved in handling customer data.

Note that you have to make sure that the agreement and/or the consent will match your business agenda, based on what data you are processing, for what purpose or for how long you keep them.

Below we will provide you with the step-by-step instruction on how to do so with the use of our pre-chat form.

Adjust your pre-chat form

If you’d like to gather data processing consent from your customers, first visit the Pre-chat form section of your LiveChat settings. While there, add a new Multiple choice list field for consent text and link to your Privacy Policy.

Now you can add your data processing consent under the Label section.

Don’t forget to mark your Multiple choice list as required! If you don’t, your customers will be able to start a chat without agreeing to the consent.

As your pre-chat form is ready now, press Save changes and you are ready to go!

Please note that when you invite customers to chat manually, the pre-chat form will not be displayed even if it is enabled.

You can also link to your full privacy policy in the pre-chat form. Use the text editor in the input fields to create a clickable link. See this article for more details.

Data processing consent examples
If you’d like to get a better idea of what the data processing acknowledgement should look like, we prepared a few examples that you can use to adjust your pre-chat form.

Note that the data protection acknowledgements provided are to be considered as general examples and are not legal advice. Keep in mind that you’ll need to adapt these examples to fit your unique business and legal requirements each time.

1. [Business notice]
   I understand/acknowledge that the business handling my personal information is [your company name] with its registered office in [your business address]. I understand/acknowledge that my personal information shall be processed and transmitted in accordance with the [applicable U.S. privacy and communication laws].
2. [Data processing acknowledgment, purpose, retention period, revocation]
   I agree for my personal information, provided via chat, to be processed by [your company name] for the purposes of providing support via chat. I agree for my personal information to be processed for the time [e.g., needed to carry out the service]. I understand that this acknowledgment may be revoked by sending an email at: [your business email/your data protection officer’s email].
3. [Opt-in consent example – for stricter state laws]
   By checking this box, I consent to [your company name] collecting and processing my personal information shared in this chat, in line with [your company’s] Privacy Policy. I understand I may withdraw my consent at any time.
4. [Opt-out example – for states where data can be processed unless declined]

[Your company name] may process the personal information I share in this chat to provide support, unless I choose to opt out. I understand I may opt out at any time by contacting [your email] or using the tools provided in [your company’s] Privacy Policy.

Understanding Your Consumers’ Privacy Rights

Across the U.S., privacy laws are giving consumers more control over their personal information. While the details differ by state, many frameworks (like those in California, Virginia, Colorado, Connecticut, Utah, and others) grant individuals similar rights when interacting with businesses online.

Here are some of the common rights you should be prepared to honor:

1. Right to Know/Access: Consumers have the right to request that businesses disclose the personal information they collect, use, share, or sell about them. They can also request details about specific pieces of personal information, categories of sources, business purposes for collecting or selling, and categories of third parties with whom the business shares personal information.
2. Right to Delete: Consumers can ask businesses to delete the personal information they have collected from them, with certain exceptions.
3. Right to Opt-Out: Consumers have the right to direct businesses not to sell their personal information. This is often referred to as the right to “opt-out” of the sale of personal information.
4. Right to Correct: Some laws (like California’s CPRA and Connecticut’s CTDPA) give consumers the ability to correct inaccurate personal data.
5. Rights Around Sensitive Data: In some states, businesses need explicit opt-in consent before collecting or using sensitive categories of personal information.

For businesses, the key is to have clear processes in place to receive, verify, and respond to these requests within the timelines set by law (often around 45 days).

How to Give Your Customers Easy Access
With LiveChat, you already have simple tools to help support these rights:

• Access: You can provide customers with transcripts of their chat conversations or tickets upon request.
• Deletion: You can remove conversations or tickets from your records if a customer asks to have their personal information deleted.
• Transparency: Through your pre-chat form and Privacy Policy links, you can explain upfront what rights your customers have and how they can exercise them.

By making these options clear and easy to use, you’ll not only stay aligned with state privacy requirements but also build greater trust with your customers.

Copy of chat transcripts

To provide your customer with the transcript of the requested conversation, go to the Archives section of your LiveChat. While there, pick a requested chat from the list.

Now, click on the Send transcript button, available under the More menu at the top-right side of the conversation.

You will be prompted with a modal, asking you to provide an email address. To proceed, provide your customer’s email and click on Send copy.

We will now send the transcript of the conversation to the provided email address.

Copy of tickets

Tickets mentioned in this article refer to the old LiveChat ticketing system available for new customers until June 1, 2023. If you’re using HelpDesk tickets, you can send tickets from the HelpDesk app. If you’re not, add the best ticketing system to your LiveChat!

The native Tickets feature will be sunsetted based on the following schedule:

Starter plan: January 6, 2025

Team and Business plans: January 15, 2025

Enterprise and custom deals: January 31, 2025

Learn more

Tickets at LiveChat are automatically forwarded to your customers, whenever an agent will reply to their query via email or LiveChat application. However, if your customer has deleted a ticket or simply would like to receive it again, simply go to the Tickets section of your LiveChat. While there, look for the desired entry.

Now you can resend a ticket by simply typing a message and hitting Send button, or you can forward a ticket to another email address, by adding more people.

Let them know that they have the right to be forgotten

Under privacy laws such as the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and a growing number of state frameworks (including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and others), consumers have the right to request the deletion of their personal information.

You as a business owner may decline a request to delete a customer’s personal information upon receiving such request for the following reasons:

• if it is necessary for the business;
• or if your service provider needs personal information under certain conditions.

However, if you ever face such a request and you have no reason to decline, we prepared an internal procedure that allows you to remove the requested conversation or a ticket from your LiveChat license. What’s more, we’ll take care of the hard part for you.

What does the procedure look like?

Tickets mentioned in this article refer to the old LiveChat ticketing system available for new customers until June 1, 2023. If you’re using HelpDesk tickets, you can delete tickets in the HelpDesk app. If you’re not, add the best ticketing system to your LiveChat!

All you have to do is to tag a chat or a ticket that you would like for us to remove. You can create a separate tag and name it Delete, so that you will use it only when such requests arise.

Not using tags at LiveChat or not entirely sure how to create a new one? Click here to learn more!

After tagging a conversation or a ticket, send us an email at support@livechat.com, asking us to remove all the transcripts and/or tickets, marked with a specified tag.

After processing your initial request, we may ask you to send us via chat a verification code from the email we have sent to the email address registered under your LiveChat subscription.

After receiving the verification code, we will remove all of the requested data as soon as possible. Also, after fulfilling your request, one of our Support Heroes will send you an email confirmation, letting you know that the process has been taken care of.

Questions?

If you have any questions about making your LiveChat privacy compliant, feel free to start a chat with one of our Support Heroes. They are available 24/7 and are always ready to provide you with additional information on adjusting your LiveChat license.