Privacy rules differ by country. We help you follow them.
A website chat collects personal information, so privacy laws apply to the business running it. This page shows, country by country, what the main rules ask, what OAConnect does for you today, and what we are finishing.
Last updated: October 2026
Not legal advice. We are a software provider, not a law firm. Compliance depends on how each business uses the tool and on its own policies. We do not claim that OAConnect, by itself, makes a business "compliant". Please check your situation with a privacy lawyer.
Canada
What Canadian rules ask of a business
Federal privacy law (PIPEDA)
Tell people what you collect and why, get meaningful consent, keep it safe, and let people see, correct and ask about their information.
What it asks
- A clear notice at collection
- Consent people understand
- Safeguards and a way to ask questions
What we do today
- Secure, separated storage
- Canadian hosting for Canadian clients
- Deletion and access by email request
Being finished
- Notice and "I agree" step in the chat
- Saved record of each consent
- In-chat delete button
Quebec (Law 25)
The strictest in Canada. Plain-language notices, a named privacy officer, an assessment before information leaves Quebec, and notice when automated tools are used.
What it asks
- Clear, specific consent
- A named privacy officer
- An impact assessment for transfers outside Quebec
- Telling people when automated tools are used
What we do today
- Name our AI provider and where it processes data
- Provide the information a business needs for its assessment
Being finished
- The assistant says it is an AI before chat starts
- French wording for the notice and chat buttons
British Columbia and Alberta (PIPA)
Similar rules to the federal law for private businesses in those provinces: notice, consent, and reasonable security.
Anti-spam law (CASL)
Businesses need permission before sending marketing emails or texts, and each message needs the sender's details and an unsubscribe link.
What it asks
- Permission before marketing
- Sender details and unsubscribe
What we do today
- Leads are captured only when a visitor shares details
Being finished
- A separate marketing tick box, never pre-ticked, with the time and wording saved
United States
What US rules ask of a business
There is no single national privacy law. The rules come from each state, plus a few federal laws for specific topics.
California (CCPA / CPRA) and other state laws
Tell people what you collect at the moment you collect it, let them see and delete their information, and never sell or share it without letting them opt out. Virginia, Colorado, Connecticut, Texas and other states have similar laws.
What it asks
- Notice at collection
- Access and deletion on request, within 45 days
- Opt-out of selling or sharing
What we do today
- We never sell or share chat data for advertising
- Deletion and access by email, answered within 30 days
Being finished
- In-chat notice and delete button
- Owner tool to export or delete one person's data
Chat recording and "this is a bot" notices
Some states, including California, expect people to be told before a chat is recorded, and to be told when they are talking to an automated assistant rather than a person.
What it asks
- Tell people the chat is recorded
- Say clearly that it is an AI
What we do today
- Our demo assistants say they are demonstrations
Being finished
- Every assistant says it is an AI, and that the chat is saved, before the first message
Texts and calls (TCPA)
A business needs clear permission before texting or calling someone for marketing.
Children, health and money
Special rules apply to children under 13 (COPPA), health information (HIPAA) and banking (GLBA). OAConnect is not built for these uses, and we do not claim compliance with them. Please don't collect that kind of information through the chat.
Our progress
Where we are, and what comes next
We update this list as things ship. If a feature matters to your decision, ask us for its current status.
- DoneSecure, separated storage and access controlsApplies to every country.
- DoneHosting in Canada for Canadian clientsSeparate servers per country.
- DoneDeletion, access and correction by emailWe reply within 30 days.
- DoneSpending limits and activity recordsSo usage and access can be checked.
- In progressAI notice, "I agree" and saved consentShown before the first message, with the time and version of the notice recorded.
- In progress"Delete my data" in the chatPlus a tool for the business to export or delete one person's information and keep a log of requests.
- In progressAutomatic retention periodsEach business picks how long chats are kept.
- In progressSeparate marketing permissionA tick box that is never pre-ticked.
- In progressHiding sensitive details from the AIMasking card, SIN/SSN and health details before they reach the AI.
- PlannedFrench chat and noticesFor Quebec businesses.
- PlannedAn AI region choiceKeeping AI processing in Canada for clients who require it.
- PlannedIndependent security testing and certificationWe hold no formal certification today.
Your part
What a business should do on its side
- Publish a privacy policyWritten for your business, and linked from the chat. We provide a starting outline.
- Name a privacy contactRequired in Quebec, and good practice everywhere.
- Decide how long to keep chatsAnd use that period once the setting is available.
- Handle requestsWhen someone asks to see or delete their information, respond within the legal time, and tell us so we can act on our side.
- Get permission before marketingDon't email or text people from a chat unless they said yes.
- Check your other toolsData sent to your own CRM, calendar or booking tool is stored there too, and must be removed there separately.
Need a compliance answer for your business?
Tell us your country or province and what you collect. We'll tell you what we cover today and what is still coming.
info@optimalagents.ai