Pitfall 1: Treating Chat Messages as "Just Analytics"
Many founders lump Crisp into their general analytics consent category and assume it's covered by a single "functional cookies" banner. Chat message content, however, is sensitive user data that may contain personal health info, payment card details, or other sensitive categories. Under GDPR Article 9 and CCPA Section 1798.120 (sensitive data), you may need *explicit* consent separate from device-info consent. If Crisp is bundled with Google Analytics under one toggle, you've created a false dichotomy—auditors will flag that message content shouldn't require the same consent as session cookies. Additionally, you must document what happens to chat transcripts: are they retained for 6 months, 1 year, or deleted on-demand? If your policy says "deleted after 30 days" but Crisp defaults to longer storage, that's a policy-practice mismatch regulators catch immediately.
Pitfall 2: Missing the Data Processing Agreement (DPA)
Crisp IM SAS is a data processor (GDPR Article 28) because it stores chat messages and device data on your behalf. You must have a written DPA in place *before* data flows to Crisp. Many indie founders never request one, assuming "EU company = automatically GDPR-safe." Crisp does provide a DPA, but it must be signed and attached to your records. Without it, you're in violation of Article 28(3) even if Crisp's infrastructure is perfect. The consequence is substantial: GDPR fines up to 4% of global annual revenue or €20M (whichever is higher) for processor violations, and DPA absence is a strict liability finding—no good-faith defense.
Pitfall 3: Not Disclosing to Users Before Chat Opens
Under GDPR Article 14 and CCPA Section 1798.100(d), you must inform users that you collect their IP, device info, and messages *before or at the point of collection*—not hidden in a generic privacy policy footer. If your privacy policy exists but Crisp collects data the instant a visitor lands on your homepage (before they click chat), that's a timing violation. Best practice: add a visible notice on the page or in the chat widget itself stating "Chat messages are stored by Crisp IM SAS (France) for 6 months" before the user types. Auditors specifically check whether consent or notice timing matches actual data collection timing; Crisp's automatic IP/device collection happens *before* explicit user interaction, so your notice must precede widget load.
