Yes, and the risk is legal more than technical. A chat box keeps what people type, and it usually hands those words to an outside company that runs the widget. California lawsuits argue that this counts as wiretapping, and the law they use puts the floor for damages at $5,000 a violation.
What the chat box actually keeps
Every chat widget stores the conversation somewhere, usually on the widget company’s server, not on yours.
A transcript holds more than the words. It holds the page the person was on, the time, the browser, often the IP address, and whatever got typed into the name, email and phone fields.
For a plumber that is usually dull stuff. Sometimes it is not. People type things into a chat box they would never put in a form. A gate code. A note that nobody is home until Thursday. A photo of a burst pipe with a license plate in the frame.
Two questions decide your exposure. Who else can read that, and did the visitor know before they started typing.
The California law behind the lawsuits
California Penal Code section 631 is old wiretap law. The page on the state’s own site, leginfo.legislature.ca.gov, shows it was last amended by Stats. 2022, Ch. 27, Sec. 1, effective January 1, 2023.
The words that matter: it covers anyone who “willfully and without the consent of all parties to the communication” reads a message “while the same is in transit”. All parties. Not one. The argument in these suits is that the widget company is a second listener nobody agreed to.
Penal Code section 637.2 is the part that pays for the lawsuit. It lets a person sue for the greater of $5,000 per violation or three times actual damages, and it says in plain words that actual damages are not a prerequisite. Nobody has to prove they were hurt. That page shows an amendment by Stats. 2016, Ch. 855, Sec. 4, effective January 1, 2017. Section 631 also carries a criminal fine of up to $2,500 for a first offense.
This is not legal advice, and it was not written by an attorney. Recording rules are set state by state, so start with an attorney licensed in your own state, and add one licensed in California if your site takes chats from people there.
What one judge said about a chat widget
In Valenzuela v. Nationwide Mutual Insurance Co., the United States District Court for the Central District of California ruled on August 14, 2023. The plaintiff said Nationwide’s website chat sent her conversation to an outside firm paid to put code in the site and store the chats.
Nationwide argued the vendor was only a tool, an extension of itself. The court did not accept that. It found it plausible that the vendor was “a third party learning the contents of communications in real time,” and said that whether the vendor used the chats for its own benefit or only for Nationwide’s was “immaterial under the statute.”
Now read the limit on that, and it is a real limit. This was a ruling on a motion to dismiss. The judge let the section 631 claim go forward and threw out a second claim under section 632.7 with leave to amend. Nobody found that Nationwide broke the law. One district court ruling does not bind other courts either. It tells you the claim is hard to kill early, which is what makes a demand letter cheap to send.
Where courts have gone the other way
One state’s highest court went the other way.
In Vita v. New England Baptist Hospital, docket SJC-13542, decided October 24, 2024, the Supreme Judicial Court of Massachusetts held that the word “communication” in that state’s wiretap act does not clearly cover web browsing. The court called the statute unclear and applied the rule of lenity, which gives a defendant the benefit of any rational doubt.
Note what that case was not. Vita involved tracking code following a person around a hospital website, not a person typing sentences into a chat box. A typed conversation looks a lot more like a conversation. Do not read it as an all clear for chat.
California may move too. Senate Bill 690, as amended in the Assembly on July 2, 2026, would let only the Attorney General sue a private company over one narrow kind of claim, the one about code that logs where a visitor came from. Typed conversations are not in that slice, so the wiretap part would stay open to private suits. The legislature’s own status page had the bill still in the Assembly floor process on August 13, 2026, not passed. Bills change and bills die, so read that page before you lean on any of this.
The size rule that does not save you
Contractors often hear that California privacy law only bites big companies. For one law that is true.
California Civil Code section 1798.140 sets out which businesses the consumer privacy act covers. The code prints three lines: yearly gross revenue over $25,000,000, buying, selling or sharing the personal information of 100,000 or more consumers or households in a year, or getting half or more of your yearly revenue from selling or sharing personal information. That page shows an amendment by Stats. 2025, Ch. 67, Sec. 27, effective January 1, 2026. The revenue line is raised for inflation in odd numbered years, and the California Privacy Protection Agency’s own table, posted December 17, 2024, put it at $26,625,000 from January 1, 2025, with the next change due in 2027. A four truck HVAC shop clears none of the three.
The wiretap statute has no such line in it. Section 631 sets no revenue figure and no headcount. Nothing in it turns on the size of your shop.
Here is the part nobody selling a compliance product will say out loud. If your site gets a hundred visits a month and none of them come from California, this is a small worry, and the money is better spent getting found at all. Nobody can honestly tell you a demand letter will never arrive either. Anyone who does is selling.
What to do this week
- Find out who runs your chat. Look for a company name at the bottom of the widget, or ask whoever built the site. If a separate company shows up, that is your third party.
- Read what that vendor’s own terms say they do with transcripts. Holding them for you is one thing. Using them to train their own systems is another.
- Put one short line above the box, visible before the first message: this chat is recorded and handled by an outside service. Short and visible beats long and buried. Where the fuller notice belongs is its own question, covered in does your website chat need a privacy policy.
- Stop collecting what you do not need. A chat asking for a name, a town and a phone number is a smaller target than one asking for a full address and a card number.
- Turn off session recording if the widget bundles it. That feature films a visitor’s mouse and keystrokes, and draws the same suits.
- Keep transcripts for a set number of days, then delete them. Old chats nobody opens are only evidence.
- If you plan to text a person after they chat, that is a separate set of rules, written up in texting somebody back after a website chat.
Then decide what the chat is allowed to do at all. The narrower its job, the less it collects. What an on site agent should answer, and what it has to hand straight to a person, is set out on the AI assistant page. A widget is also code pulled from another company’s server on every page load, which shows up in your page speed and is worth weighing against a site built with no outside calls in it.