Do I need to disclose Zendesk in my privacy policy?

Yes. Zendesk collects personal data from your visitors, including names, email addresses, IP addresses, and support messages. Under GDPR and CCPA, you must transparently disclose all data processors and the categories of data collected. Zendesk's data processing activities require explicit mention in your privacy policy so users understand how their information is handled.

What data does Zendesk collect from website visitors?

Zendesk collects support tickets, live chat messages, email communications, visitor names, and IP addresses. This data is captured whenever a user interacts with your chat widget or submits a support request. The information is stored to manage customer support inquiries and maintain a history of communications.

Does Zendesk use cookies that require consent?

Yes. Zendesk uses the __zlcmid cookie, which persists for one year and serves a functional purpose by maintaining the chat widget identifier. Under GDPR, functional cookies typically require prior user consent. You should include Zendesk's cookie in your cookie consent banner and explain its role in supporting the chat feature.

Where is my Zendesk data processed and stored?

Zendesk Inc., a United States-based company, acts as your data processor. Data transferred to Zendesk may cross borders to the U.S. If you operate under GDPR, you should ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to comply with data transfer requirements.

Live Chat

Privacy policy clauses for Zendesk

Zendesk is a customer support platform that enables websites to provide real-time assistance through live chat, ticketing systems, and email support. Websites use Zendesk to manage customer inquiries, track issues, and deliver timely responses to visitors.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Zendesk collects

Your privacy policy must disclose each of the following data types when you use Zendesk.

Support tickets

Chat messages

Name

IP address

When does Zendesk trigger privacy obligations?

Installation triggers immediate data collection

The moment you embed Zendesk's chat widget on your site or app, three things happen simultaneously:

1. IP addresses are collected from every visitor, regardless of consent status. Zendesk's servers (US-based) receive visitor IP data to route chat sessions and identify repeat users.

2. The `__zlcmid` cookie is set (1-year duration, functional classification). Under ePrivacy Directive Article 5(3) and GDPR Article 7(4), this requires explicit opt-in consent *before* the script loads—not a banner shown after.

Common compliance pitfalls

Cookie	Duration	Category	Purpose
__zlcmid	1 year	functional	Chat widget identifier

Pitfall 1: Misconfiguring Zendesk in consent management platforms

Many founders treat Zendesk as a purely "functional" tool and auto-allow it before consent, because chat seems necessary. This is incorrect. The `__zlcmid` cookie and IP logging are *functional in nature*, but the data transfer to the US and Zendesk's ability to retain chat transcripts for support analytics crosses into a gray zone. If you've classified Zendesk to load without consent, but your privacy policy says "non-essential cookies require consent," regulators will flag the contradiction. Consequence: GDPR Article 82 claims for unlawful processing, or CCPA statutory penalties ($2,500–$7,500 per violation).

Pitfall 2: Forgetting to update the DPA when Zendesk updates its sub-processors

Zendesk regularly adds third-party sub-processors (cloud providers, analytics vendors, backup services). GDPR Article 28(2) requires you to authorize each one and notify your users if you said you would. Many founders sign a DPA once and never revisit it. Zendesk publishes a [Sub-processor List](https://www.zendesk.com/company/agreements-and-terms/) with a change notification policy. If a sub-processor is added and you don't update your privacy policy or get explicit re-consent (depending on your terms), you're in breach. Consequence: Regulatory investigation, forced deletion of historical chat data, or suspension of service.

Pitfall 3: Not implementing a Data Processing Agreement for non-EU visitors

Founders often assume "we don't have EU customers, so we don't need a DPA." This is dangerous: (a) you cannot control visitor location in real time, (b) you may not know if customers' end-users are in the EU, and (c) GDPR applies to *any* personal data of EU residents processed via your service. Even one EU visitor's chat transcript triggers GDPR. Additionally, if you later discover EU traffic, you've been operating unlawfully. Consequence: Retroactive liability, inability to legally justify historical data retention.

Privacy policy clauses for Zendesk

What data Zendesk collects

When does Zendesk trigger privacy obligations?

Installation triggers immediate data collection

Regulations that apply

First concrete step

Where data goes

Cookies set by Zendesk

Common compliance pitfalls

Pitfall 1: Misconfiguring Zendesk in consent management platforms

Pitfall 2: Forgetting to update the DPA when Zendesk updates its sub-processors

Pitfall 3: Not implementing a Data Processing Agreement for non-EU visitors

Sample privacy policy clause

What regulators look for

Enforcement priorities for Zendesk audits

Likely first audit question

Frequently asked questions

Do I need to disclose Zendesk in my privacy policy?

What data does Zendesk collect from website visitors?

Does Zendesk use cookies that require consent?

Where is my Zendesk data processed and stored?

Don't ship without Bandit.