The Chatbot Developer's Field Guide to US Privacy Law (Before Your Next Release)
If you're building chatbots in the US and treating privacy compliance as a "Europe problem," it's time for a refresh. There's no federal privacy law, sure—but there's a growing patchwork of state statutes with real teeth, and if your bot talks to anyone in California, Colorado, Connecticut, Virginia, or Texas (among others), the rules apply to you.
Chatbots are uniquely exposed. They collect free-form text, which means users volunteer everything from email addresses to health complaints to half a credit card number before they realize what they've typed. Here's how to keep your data practices on the right side of the law.
Consent: The Disclosure Nobody Reads (But You Still Need)
Most state laws require you to disclose what you're collecting before or at the time of collection. For a chatbot, that means a visible notice before the conversation starts—not buried in a footer nobody clicks.
The bar is rising, too. Some states are moving toward opt-in consent for sensitive data categories, and health-adjacent information ("I've been having chest pain") can easily wander into protected territory. If your bot serves healthcare, finance, or legal verticals, your disclosure needs to name those categories explicitly.
What to ship: A pre-chat consent notice with a plain-language summary of what's collected, why, and a link to the full policy. Log the consent event with a timestamp. If a regulator ever asks, "the user must have seen it" is not a defense.
Retention: Your Transcripts Are Not a Savings Account
Here's a pattern we see constantly: a team builds a bot, stores every transcript forever "for training purposes," and never thinks about it again. That's a liability accruing at a rate of thousands of messages per day.
State laws generally require you to keep personal data only as long as needed for the stated purpose. Practically, that means deciding—on purpose—how long you keep transcripts. Ninety days? A year? Whatever you pick, the deletion has to be automatic. A cron job that quietly purges old conversations beats a policy document that promises you will.
Bonus: fresh training data is overrated. A model trained on 500,000 relevant, recent conversations usually beats one trained on five years of stale, consent-ambiguous transcripts.
The Right to Delete Is Coming for Your Database
Most state privacy laws grant consumers the right to request deletion of their personal data. When a user emails "delete everything I told your bot," can you actually comply?
If your transcripts are keyed to identifiable users, yes. If they're dumped into a data lake with no identity mapping, you've got a problem. Pseudonymized data can still count as personal data if you hold the re-identification key.
What to ship: A deletion request workflow that maps user identity to conversation records and purges them across every store—primary database, backups on their next rotation, analytics pipelines, and any third-party AI vendor you've fed transcripts into.
Vendors Count. Read the Fine Print.
If you're piping conversations into an LLM API or a third-party analytics tool, you're on the hook for what they do with the data. Some providers train models on customer inputs by default; some don't. Some promise deletion; some only "anonymize."
Before your next release, get written answers to three questions: Is my data used for model training? Where is it stored and for how long? Can you delete it on request? If a vendor can't answer cleanly, that's your answer.
Your Pre-Ship Compliance Checklist
Run through this before every bot release:
- Disclosure: Pre-chat notice states what's collected, why, and links to the full policy
- Consent log: Timestamped record of consent per user, per session
- Retention: Automatic deletion of transcripts after a defined period
- Deletion workflow: User-initiated deletion reaches every datastore and vendor
- Vendor agreements: Written confirmation that providers don't train on your data without consent
- Sensitive data handling: Explicit rules for health, financial, and minors' data
- Opt-out path: Users can decline data collection and still get basic service
None of this is glamorous. All of it is cheaper than the alternative. The states aren't slowing down—Colorado, Texas, and Oregon have all expanded enforcement recently—and chatbots sitting at the intersection of consumer data and automated decision-making are exactly where regulators are looking next.
Build it right the first time. Your future self, and your legal team, will send their thanks.