A chatbot at the front desk of a domiciliation branch: what the CNIL asks for, and why a human who validates settles almost everything
In its guidance published on 19 February 2021, the CNIL, the French data-protection authority, sets four rules for chatbots: no tracker without consent unless the visitor opens the conversation themselves, retention limited to the stated purpose, special care with sensitive data, and a ban on an automated conversation producing a significant decision on its own (article 22 of the GDPR). A QR-based reception for mail collection ticks those boxes, provided a staff member keeps the final say.
The CNIL text is short and concrete. First point: the tracker (cookie or equivalent) set by a chatbot is exempt from consent if it is placed at the user's request, that is, when the user is the one opening the conversation; if it is placed as soon as the page loads, consent must be collected. Second point: exchanges are kept only as long as the stated purpose requires (answering the visitor, passing a request to the relevant team) and are then deleted or anonymised. Third point: if the conversation may surface sensitive data (health, legal situation), the person must be told in advance and a purge must be planned. Fourth point, the most important one for a domiciliation provider: article 22 of the GDPR prohibits a decision with legal or similarly significant effects from being taken solely by automated processing. A chatbot informs; it does not refuse a mail hand-over and does not issue a certificate.
Brought back to the counter of a domiciliation branch, this draws a simple frame. The visitor scans the QR code on the screen or at the desk: they are the one opening the conversation, so no consent banner at that moment. The assistant explains opening hours, the documents to bring to collect registered mail, the lead time for a domiciliation certificate. When the request calls for an act (handing over an item, issuing a certificate, changing a contract) it goes to the branch staff member, who decides and signs. That is how AppH's Pack Accueil is built: the conversation follows the visitor from the screen to their phone, but nothing leaves the branch without a person having validated it. The assistant introduces itself as such from the first line, and exchanges tied to a file are kept for the period set by the provider, hosted in France, under a data-processing agreement (article 28).
For AppH
- Triggering by QR code is exactly the ‘at the user's request’ case the CNIL exempts from consent: in-branch reception starts with a compliance advantage that a widget auto-loaded on the head-office website does not have.
- The principle ‘the assistant informs, the staff member decides’ is not a slogan: it is the line article 22 draws, and it is also what reassures a network director operating under a prefectoral licence.
Against / the honest limit
- The CNIL guidance dates from 2021 and targets scripted chatbots; today's language models raise further questions (memory, reuse of exchanges) that this text does not address. The CNIL's more recent AI fact sheets must be read alongside it.
- AppH is not legal counsel: the record of processing activities, the retention period and the information given to visitors remain decisions of the provider, as data controller. We supply the settings and the contract, not turnkey compliance.
We are often asked whether a reception assistant ‘is GDPR’. The question, badly framed, hides a better one: who decides? As long as a licensed staff member validates every act, the assistant is an information board that talks, and the CNIL has known how to frame that since 2021. The day the machine is allowed to refuse a hand-over or issue a document, the legal category changes, and so does the liability. We chose never to cross that line, less out of caution than out of clarity about what a domiciliation counter really requires: precision, and someone who answers for what they hand over.
Reviewed by a human at AppH