Chatbot development
in Frankfurt am Main

A chatbot aimed at people in Germany answers to two sets of rules that touch the product directly. The EU AI Act sets transparency duties for systems that talk to people. The German TDDDG, the act formerly known as the TTDSG, governs what any script may store on or read from the device of a visitor. Neither rule is about the quality of the answers. Both change how the bot looks, loads and opens a conversation.

Start with the disclosure. Under the AI Act, a system built to interact with people has to make clear that the person is dealing with an AI, unless that is already obvious from the context. A cartoon robot icon is weak evidence. A chat that opens with a friendly first name and a stock photo of a smiling agent works against the rule. The safer reading is simple: say it in words, at the start, every time.

That shapes the first message. A line such as Hello, this is an automated assistant, it can answer questions about orders and delivery, does two jobs at once. It discloses the nature of the system. It also sets the scope, which cuts down the questions the bot cannot handle. Keep the notice inside the conversation itself, not in a tooltip or a footer link. Screenshots of the chat should still show it.

The second rule works on the page before anyone types. Many chat widgets load on every page view and at once set cookies, fill local storage, or read a device identifier to recognise a returning visitor. Under the TDDDG, storing or reading such information on the device needs prior consent, unless it is strictly necessary for a service the user has explicitly asked for. A visitor who has never clicked the chat bubble has not asked for a chat.

The practical fix is to split the loading. Show a static button that sets nothing. Load the full widget, and create any session identifier, only after the user clicks it. At that point storage needed to keep the conversation running has a much better case for counting as strictly necessary. Analytics, tracking pixels bundled with the vendor script and marketing tags do not. They stay behind the consent banner like any other tag.

Check the vendor script line by line. Hosted chat products often ship with their own analytics, visitor fingerprinting or proactive pop-ups that fire on a timer. Each of those runs before a click. Turn them off, or wire them to the consent tool, and then test with a clean browser profile to see what actually lands in storage.

Handover to a human is where the disclosure must change again. When a person takes over, the chat should say so in a separate line, with the switch visible in the transcript. The reverse matters too. If the human leaves and the bot resumes, the user should not be left guessing who writes the next reply.

Finally, keep the evidence. Save the wording of the opening notice, the list of scripts loaded before and after the click, and the date each version went live. When a data protection officer or a partner asks how the bot meets these rules, the answer is then a folder, not a meeting.