Does the chat widget need a cookie banner?

Short answer: no. You can add the Shout chat widget to your website without adding a cookie banner for it, and without wiring it into a consent management platform. This page explains exactly what the widget does in a visitor’s browser and why that keeps it outside the consent rules.

What happens when your page loads

For a visitor who has never used the chat, the widget does nothing at page load:

• No cookies are set — the widget doesn’t use cookies at all.
• Nothing is written to browser storage.
• No network requests are made to our servers, other than fetching the widget script itself — the same as any image or stylesheet on your page.
• No identifier of any kind is created. Nothing exists on our servers for that visitor.

The chat button is inert until it’s clicked. There is no invisible visitor tracking, no “who’s browsing right now” beacon, no fingerprinting, and no third-party trackers.

What happens when a visitor opens the chat

When a visitor chooses to open the chat panel, the widget creates a random session identifier and saves it in that browser’s local storage. That identifier is what keeps their conversation working — it lets messages flow, keeps the thread intact across page loads, and lets a returning visitor see replies to a conversation they started earlier.

That’s its only job. It contains no personal details, it works only on your website, and it is never used for advertising, analytics or cross-site tracking.

And storage is as far as it goes until they actually engage: a visitor who opens the widget and closes it again leaves no contact record behind. A contact is only created in your CRM when the visitor sends a message.

Why this means no banner

Cookie banners exist because of the ePrivacy rules (PECR in the UK), which require consent before a website stores information in a visitor’s browser — unless the storage is strictly necessary for a service the visitor themselves asked for. That exemption is the same one that lets a shopping basket work without a consent pop-up.

The Shout widget is designed to fit that exemption:

What is stored	When	Why
Nothing	Page load	The button is inert until clicked
A random session identifier	The visitor opens the chat	Keeps their conversation working and lets it resume later
Read-state (which replies they’ve seen)	While they use the chat	Stops the unread badge re-alerting them to messages they’ve read

Because nothing is stored until the visitor actively uses the chat, and what is stored then exists only to make the chat they asked for work, there is nothing for a cookie banner to ask about.

Many popular chat and messenger widgets work the other way around: they write tracking identifiers into every visitor’s browser at page load, before any interaction, so they can track anonymous visitors as leads. Storage like that isn’t covered by the strictly-necessary exemption — which is why those widgets typically have to be gated behind your cookie consent tool, and why adding them to a site without a banner can put you in breach. With Shout there is nothing to gate.

What this doesn’t cover

• The rest of your website. If your site uses analytics, advertising pixels or other non-essential storage, you may need a banner for those — the Shout widget just won’t be the reason.
• Legal advice. This page describes how the widget behaves so you (or your adviser) can make your own assessment. If your business has specific compliance requirements, check with your own data protection adviser.

Related reading

• Data retention — how long conversations and contact records are kept, including the retention controls for unidentified chat visitors.
• What is GDPR