Webinar GDPR basics for sign-ups, emails and chat

The moment someone registers for your webinar, you are processing personal data, and if you or your audience are in the EU, the GDPR applies. That sounds like a lot of paperwork, but for a typical webinar it boils down to a manageable set of ground rules. This guide walks through each stage in order, from sign-up to emails to the chat, and finishes with a checklist for your next session. It takes an EU perspective; the UK has its own, very similar regime.

Data and legal bases

What data a webinar collects

Before applying any rules, look at the data itself. A typical webinar involves:

Registration data: usually a first name and email address, sometimes more.
Technical data: IP address, browser and time of access, created whenever pages load.
Attendance data: who joined, when and for how long.
Chat messages: whatever attendees type, often linked to their name.
Clicks and purchases: for example, who clicked through to the offer.
Video and audio: in genuinely live webinars, if attendees use camera or microphone or you record the session.

Each of these needs a purpose and a legal basis. It is also worth asking whether you need it at all.

Legal bases in brief

The GDPR only permits processing when one of the bases in Article 6 applies. Three of them come up in everyday webinar work.

What	Typical basis	Note
Registration, access link, reminders for the booked session	Performance of a contract or steps at the person’s request (Art. 6(1)(b))	The attendee asked to take part.
Marketing emails, newsletters, offers after the session	Consent (Art. 6(1)(a))	Electronic marketing rules also apply, see below.
Security logs, simple statistics without profiling	Legitimate interests (Art. 6(1)(f))	Requires a balancing test and respect for the right to object.

If you store or read information on the attendee’s device, for example through cookies, the ePrivacy rules apply on top. Cookies that are strictly necessary, such as those keeping someone signed in to the webinar room, are fine without consent. Analytics and advertising cookies need consent.

Registration and emails

Setting up registration properly

The registration page is where you make most of the important decisions.

Ask only for what you need. The data minimisation principle (Art. 5(1)(c) GDPR) is very practical here. A first name and email address are usually enough for a webinar. Ask for a phone number, company or revenue band only if you will actually use it, and ideally make it optional.

Tell people what happens. Link your privacy notice right next to the form. It must explain who is responsible, what data is processed and why, who receives it, how long it is kept and what rights attendees have (Art. 13 GDPR).

Use double opt-in. With double opt-in, the address that was entered receives an email with a confirmation link, and the registration only completes once it is clicked. The GDPR doesn’t name the method, but it is the standard way to show that the address really belongs to the person who signed up. Where you rely on consent, you must be able to demonstrate it (Art. 7(1) GDPR). Keep the confirmation email free of advertising.

Ask for marketing consent separately. If you want to send offers by email after the webinar, you need a separate consent for that. The cleanest route is an unticked checkbox of its own with plain wording, for example: “Yes, email me offers and tips on this topic after the webinar. I can unsubscribe at any time.” Taking part should not depend on ticking it. Whether a free webinar can be made conditional on marketing consent is disputed, so keeping the two apart is the safer choice.

Emails before and after the session

It helps to separate webinar emails into two kinds.

Messages that belong to the registration: confirmation, access link, reminders for the booked session, notice of a change of time. They deliver what the attendee asked for and generally don’t need extra consent. Keep them that way, without promotions for other offers.

Marketing messages: offers after the webinar, discount campaigns, a newsletter. The EU’s ePrivacy Directive (Article 13) requires prior consent for marketing emails to individuals, and each country implements this in its own law. Germany, for instance, applies it strictly to business recipients too. There is a narrow exception for existing customers who bought from you and receive information about your own similar products, provided they were offered an easy way to object when you collected the address and in every email. Registering for a webinar does not make someone a customer.

For both kinds, every message should clearly identify you as the sender, and marketing emails need a simple unsubscribe link. Record each consent with its date and time, the exact wording shown and the confirmation click.

Processors and data processing agreements

Few people run webinar software, email delivery and web hosting entirely on their own. As soon as a service provider processes personal data on your behalf, you need a data processing agreement with them under Article 28 GDPR. That typically covers:

the webinar software itself,
your email delivery service,
the host of your website and registration page,
an AI service that answers chat questions, if you use one.

Reputable providers offer this agreement as standard, often right in your account. Ask for their list of sub-processors too. If a provider is based outside the EU or the European Economic Area, you also need a basis for the transfer, such as an adequacy decision by the European Commission or standard contractual clauses (Art. 44 onwards). List every recipient in your privacy notice.

If you are still choosing a platform, data protection is one of the twelve criteria for choosing webinar software.

The webinar chat

The chat is easy to overlook, even though people sometimes share very personal things there. A few habits help:

Decide who sees what. Can every attendee read every message, or only you? Display first names or chosen nicknames at most, never email addresses.
Add a short notice. One line next to the chat box asking people not to post sensitive details such as health information or bank details.
Set a retention period. Keep chat logs only as long as you need them to answer questions and follow up.
Stick to the purpose. Don’t mine chat content for marketing or pass it on without a proper basis.
Label AI replies. If an AI answers questions in the chat, attendees must be able to tell. Since 2 August 2026 the transparency rules of the EU AI Act have applied here. The article on creating a webinar with AI covers this in more detail.

If you record a genuinely live webinar that includes attendees’ video or audio, announce it clearly beforehand and let people join without camera or microphone.

Retention periods and attendee rights

The GDPR says you must not keep data longer than necessary (storage limitation, Art. 5(1)(e)). It sets no fixed periods for webinars, so you decide them and state them in your privacy notice. One possible example, to be adapted to your situation:

Registration data without marketing consent: delete a few weeks after the last booked session.
Chat logs: delete once follow-up is done.
Proof of consent: keep for as long as you rely on the consent, and beyond that only as long as you might need it to defend against claims.
Invoices and accounting records: separate retention rules under commercial and tax law apply.

Attendees also have rights you must honour, mainly access (Art. 15), erasure (Art. 17) and objection to direct marketing (Art. 21). You generally have one month to respond (Art. 12(3)). So check in advance whether your webinar software lets you find an individual, export their data and delete it.

The full text is available in the Official Journal of the EU (GDPR).

Checklist for your next webinar

The registration form only asks for what you actually use.
The privacy notice is linked at the form and names every provider.
Double opt-in is on, and the confirmation email contains no advertising.
Marketing consent is a separate, unticked checkbox.
Consents are stored with date, time and wording.
You have a data processing agreement with every provider.
The chat shows no email addresses, and AI replies are labelled.
Retention periods are set and actually applied.
You know how to answer an access request and delete an individual attendee.

Frequently asked questions

Is double opt-in mandatory for webinars?

The law doesn’t name it. But where you collect consent, you have to be able to prove it, and double opt-in is the established way of doing that. Even for plain registrations it protects against typos and people entering someone else’s address.

Can I send attendees offers after the webinar?

Only if they have explicitly agreed, ideally through a separate checkbox at registration. Reminders about the booked session are generally not marketing as long as they stick to the session. An offer afterwards almost always is.

Only if you use cookies or similar technologies that are not strictly necessary, for analytics or advertising for example. A registration page without such services can do without a banner. You still need a privacy notice.

How long can I keep registration data?

As long as you need it for the purpose. For the webinar itself, that purpose ends shortly after the session. With marketing consent, you can generally use the address until the person withdraws. Write your retention periods down.

Final thought

Data protection for webinars is mostly about good habits: ask for little, explain clearly, get separate consent for marketing, sign agreements with your providers and delete on schedule. Set it up properly once, and each new webinar only needs a quick check.

This article is general information and not legal advice. For your specific situation, speak to a lawyer or your data protection officer.