Privacy policy clauses for XMPP
XMPP (Extensible Messaging and Presence Protocol) is an open, decentralized messaging standard that enables real-time chat, presence information, and instant messaging. Websites integrate XMPP to provide users with direct messaging capabilities, typically via self-hosted or federated servers rather than centralized third-party platforms.
Free scan · No signup · Results in 60 seconds
What data XMPP collects
Your privacy policy must disclose each of the following data types when you use XMPP.
When does XMPP trigger privacy obligations?
XMPP deployment triggers compliance obligations the moment your server begins collecting message content, user JIDs, and roster (contact list) data—even if self-hosted.
Data flow that starts immediately: When a user registers or connects, their JID (e.g., user@yourdomain.com) and presence status are stored. Every message transits your server and is typically persisted in logs or message archives. Contact lists are stored server-side. This is personal data under GDPR Article 4(1) and CCPA Section 1798.100.
GDPR applies if: You operate in the EU, serve EU residents, or target EU users (GDPR Article 3). You must document a lawful basis (Article 6) before collecting JIDs and messages—consent is common but requires explicit, informed opt-in before connection. Article 13/14 requires privacy notice at point of collection.
CCPA applies if: You serve California residents and meet the threshold (revenue >$25M, or buy/sell/share personal information of 100k+ Californians). CCPA Section 1798.100 gives users the right to know what personal information you collect.
