AI Chatbot for WordPress: The GDPR-Compliant Setup Guide (2026)

WordPress runs more than 40% of the web, and in October 2026 it is quickly becoming AI-ready. On October 5, the official WordPress AI plugin shipped version 1.4.0, which adds Markdown feeds so AI systems can read your content, plus expanded embeddings infrastructure. Two days later, the MCP Adapter, which lets AI agents talk to a WordPress site, was listed as an official plugin in the WordPress.org directory.

So it is no surprise that “AI chatbot WordPress” is one of the most searched questions from small business owners right now. You already have a site, a few service pages, maybe a FAQ and some PDFs. You want visitors to get answers at 11 p.m. without emailing you.

The installation takes minutes. GDPR compliance does not happen by default. Most WordPress chatbot plugins send every visitor message to a third-party AI provider, often in the United States, and you, the site owner, remain legally responsible for that data flow.

This guide explains the two ways to add an AI chatbot to WordPress, where your visitors’ data actually goes, and a 6-point checklist to stay compliant with GDPR and the EU AI Act.

Two ways to add an AI chatbot to WordPress

Option 1: An AI chatbot plugin

The WordPress.org directory lists dozens of AI chatbot plugins. Many of the popular ones work the same way: you install the plugin, paste your own OpenAI (or other LLM) API key, and the plugin calls that API whenever a visitor asks a question.

It is attractive because it feels free and everything lives inside your dashboard. The trade-offs are real, though:

• Your server does the work. The plugin adds code, database tables and API calls to your WordPress install. On shared hosting, that can slow down pages and expand your attack surface. WordPress plugins remain a frequent source of vulnerabilities.
• You are the integrator. Indexing your content, chunking it, keeping it up to date, setting guardrails against off-topic answers: much of that is up to you and the plugin’s settings.
• The data flow is yours to document. Every question typed by a visitor leaves your site for the AI provider attached to the API key you pasted.

Option 2: An external chatbot widget

The second approach is a hosted chatbot service. You build and train the chatbot on the provider’s platform, then paste one line of JavaScript into WordPress. The bot runs on the provider’s infrastructure, not on your server.

On WordPress, adding the snippet usually takes one of three routes:

1. A header and footer code plugin such as WPCode (“Insert Headers and Footers”)
2. A Custom HTML block in your footer template (block themes, via the Site Editor)
3. Your theme’s footer settings, if it offers a field for custom scripts

No database changes, no plugin updates to babysit, and removing the bot is as easy as deleting the line. Your site stays light, and the chatbot provider handles indexing, retrieval and security.

The question then becomes the same for both options: who processes the conversations, and where?

Where your visitors’ data really goes

Under GDPR, the business running the website is usually the data controller for the chatbot conversations. Visitors type names, email addresses, order numbers and sometimes health or financial details into a chat box. That is personal data, whether you planned to collect it or not.

With a “bring your own API key” plugin, those messages are sent to the LLM provider tied to the key. If that provider is a US company, you have to consider international transfers, the provider’s data processing terms, and the US CLOUD Act, which can give US authorities access to data held by US companies, even when it is stored in Europe.

With an external widget, the same questions apply to the widget provider and to the model provider it uses behind the scenes. A “GDPR compliant” badge on a plugin page is a marketing claim, not proof. What counts is the hosting location, the list of sub-processors and the data processing agreement (DPA).

There is a second rule to remember. Since August 2, 2026, Article 50 of the EU AI Act requires that people are told when they are interacting with an AI system. A WordPress chatbot that greets visitors like a human colleague is now a compliance problem in the EU, not just a UX choice.

The 6-point GDPR checklist for a WordPress AI chatbot

Before you publish a chatbot on your WordPress site, check these six points:

1. Hosting location. Where are the conversations and your indexed documents stored? EU, ideally in your own country, is the safest answer.
2. Model provider. Which LLM generates the answers, and where does it run? A French host is not enough if every message is then sent to a US API.
3. DPA and sub-processors. Can you sign a data processing agreement (GDPR Article 28)? Is the sub-processor list public?
4. No training on your data. Get written confirmation that your documents and your visitors’ conversations are never used to train public models.
5. AI disclosure (Article 50). The chatbot must clearly say it is an AI, from the very first message.
6. Consent for lead capture. If the bot collects emails or phone numbers, the form needs a clear purpose and explicit consent. Also update your privacy policy to mention the chatbot.

Also ask the boring question: what happens to your data if you leave? You should be able to export your leads and have your content deleted.

Answer quality matters as much as compliance

A compliant chatbot that makes things up is still a liability. Generic plugins connected straight to a general-purpose model tend to answer from the model’s memory when they cannot find the information in your pages. On a business site, that means invented prices, invented opening hours or invented policies.

A RAG chatbot (retrieval-augmented generation) works differently. It searches your own content first, then generates an answer only from what it found. If the answer is not in your documents, it says so or offers to put the visitor in touch with you. For a WordPress site, that content should include more than your pages: PDFs, brochures, terms of service and FAQs often hold the most useful answers.

DoxyChat: a WordPress AI chatbot built for GDPR

DoxyChat was designed for exactly this setup: a French SaaS chatbot you add to any website, including WordPress, with one line of code.

• Hosted in France. Your documents and conversations are hosted in France, and answers are generated by Mistral models running on Scaleway. No data is used to train public models.
• RAG, answers from your data only. DoxyChat indexes your WordPress pages, your PDFs and DOCX files, and even your RSS feed so new blog posts are picked up automatically. The chatbot answers from that content only.
• Installed in 2 minutes. Create your bot, copy the snippet from your dashboard, paste it with WPCode or a Custom HTML block. Nothing to install on your server, nothing to update.
• Lead capture with consent. A built-in form collects contact details inside the conversation, with GDPR consent handled natively.

Conclusion: WordPress makes it easy, GDPR makes it serious

Adding an AI chatbot to WordPress has never been easier, and WordPress itself is opening up to AI fast. But the easy part is the snippet. The important part is knowing where your visitors’ words go, which model reads them, and whether your chatbot tells the truth about your business.

Pick a chatbot that answers only from your content, keeps the data in Europe and identifies itself as an AI. You will get the 24/7 answers you wanted, without a compliance headache later.

Try DoxyChat free: build a chatbot from your WordPress site and documents, and add it in 2 minutes. More guides on the DoxyChat blog.