Does Drift require disclosure in a privacy policy?

Yes. Drift processes personal data on your website, so you must disclose its use in your privacy policy under GDPR, CCPA, and similar regulations. Visitors have a legal right to know that their data is being collected through this tool and how it will be used.

What specific data does Drift collect?

Drift collects chat messages exchanged during conversations, email addresses provided by users, IP addresses, and device information (such as browser type and operating system). This data is used to facilitate communication, track conversations, and personalize the chat experience.

Does Drift require a cookie consent banner?

No cookies from Drift are documented, so a dedicated cookie consent banner specifically for Drift is not required. However, you should still disclose Drift's data collection practices in your privacy policy and obtain appropriate consent for processing personal data where legally required.

Who is the data processor and where is data transferred?

Drift, operated by Salesloft Inc., is the data processor. Drift is based in the United States, so your data is transferred to and processed in the U.S. You should document this transfer in your privacy policy and ensure appropriate safeguards comply with GDPR Standard Contractual Clauses or CCPA requirements.

Live Chat

Privacy policy clauses for Drift

Drift is a conversational marketing and live chat platform that enables real-time communication between websites and visitors. Websites use Drift to engage customers, qualify leads, and provide instant support through chat interfaces embedded on their pages.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Drift collects

Your privacy policy must disclose each of the following data types when you use Drift.

Chat messages

IP address

Device info

When does Drift trigger privacy obligations?

Installation triggers immediate obligations

The moment you embed Drift on your website or app, you begin collecting chat messages, email addresses, IP addresses, and device information from visitors. This data collection is automatic—it does not require visitor action—which triggers compliance obligations immediately.

Applicable regulations by jurisdiction

GDPR (EEA visitors): If any visitor is in the EEA, GDPR Article 6 requires a lawful basis for processing Drift data. Article 5 requires transparency. You must document a Data Processing Agreement (DPA) with Drift (Salesloft Inc., US-based). GDPR Article 13 requires you to provide privacy notice *before* data collection begins, covering the specific categories Drift collects: chat content, email, IP, and device identifiers.

Common compliance pitfalls

Pitfall 1: Omitting Drift from privacy disclosures

The mistake: Many founders add Drift but don't update their privacy policy, or list it under generic "third-party tools" language without naming Drift or specifying that it collects chat messages, email, IP, and device data.

Why it happens with Drift: Drift is installed via a lightweight script snippet; it feels like an internal feature, not an external data processor. Founders treat it as infrastructure rather than a data processor.

Consequence: Under GDPR Article 13 and CCPA Section 1798.100, failure to disclose *before* collection is unfair processing. Regulators view this as dark patterns. Fines under GDPR can reach 4% of global revenue; CCPA statutory damages are $100–$750 per consumer per incident.

Pitfall 2: No Data Processing Agreement (DPA) with Salesloft

The mistake: Operators assume Drift's standard Terms of Service satisfy data processor requirements. They do not.

Why it happens with Drift: Drift's Terms of Service are customer-focused and do not address the specific GDPR Article 28 requirements (sub-processing, data subject rights, audit rights, data deletion obligations) or establish Drift as your processor.

Consequence: Under GDPR, using a processor without a DPA is a direct violation of Article 28. The ICO and other DPAs treat missing or unsigned DPAs as strict liability violations, regardless of actual harm. You are liable for Drift's processing; fines apply to you, not Drift.

Pitfall 3: Miscategorizing Drift data for consent management

The mistake: Configuring Drift under "analytics" or "marketing" consent categories instead of creating a separate category or treating it as "functional." This causes Drift to load before consent is granted.

Why it happens with Drift: Drift touches multiple use cases (customer support, sales acceleration, analytics). Founders guess at the right category or use a consent management platform (CMP) template that doesn't distinguish Drift from analytics tools.

Consequence: Under GDPR Article 7 and the ePrivacy Directive, loading scripts that collect personal data without prior consent violates consent requirements. Regulators now actively audit cookie consent logs; many enforcement actions in 2023–2024 targeted miscategorized tools. You may be required to delete non-consensually collected data.

Privacy policy clauses for Drift

What data Drift collects

When does Drift trigger privacy obligations?

Installation triggers immediate obligations

Applicable regulations by jurisdiction

First concrete step

Where data goes

Common compliance pitfalls

Pitfall 1: Omitting Drift from privacy disclosures

Pitfall 2: No Data Processing Agreement (DPA) with Salesloft

Pitfall 3: Miscategorizing Drift data for consent management

Sample privacy policy clause

What regulators look for

European Data Protection Authorities (EDPB, national DPAs)

FTC and state regulators (US)

Frequently asked questions

Does Drift require disclosure in a privacy policy?

What specific data does Drift collect?

Does Drift require a cookie consent banner?

Who is the data processor and where is data transferred?

Don't ship without Bandit.