In-app chat 101: conversations inside your own product

In-app chat is messaging that lives inside your own product: a support conversation in a banking app, a buyer asking a seller a question in a marketplace, a driver and a passenger arranging a pickup, a tutor and a student, or a members' community. It is built into a mobile or web app with an SDK (a software development kit: ready-made code a developer adds to the app) and an API, from a chat provider or built in-house.

• What it is: chat screens and message storage inside your app or website, with your design and your rules.
• Who runs it: you do, usually on top of a provider's chat service. No public network or platform owner sits between you and your users.
• Reach: only people who have your app or sign in to your product. The GSMA counted 4.7 billion mobile internet users in 2024,¹ but your reach is your own user base.
• Who may start the conversation: usually the user. The business can write into an open thread, and alerts about new messages travel as push notifications.
• How it is priced: typically per monthly active user, sometimes by concurrent connections or volume, plus storage and add-ons.
• Best for: conversations tied to an account, an order, a booking or a match between two users.
• Avoid for: reaching people who have not installed your app or have stopped opening it.
• As of: October 2026.

Three parts do the work. The client SDK in the app draws the chat screen, keeps a local copy of recent messages so the app still works on a poor connection, and holds an open connection to the chat service. The chat service (the provider's servers, or your own) stores each message, decides who may see it and passes it to everyone in the conversation. Your back end creates users and conversations, signs each user in with a token, and listens for events through webhooks, so that bots, moderation tools and your customer records can react.

The open connection is usually a WebSocket, an IETF standard from December 2011 that keeps one two-way connection between app and server instead of asking the server again and again whether anything new has arrived.⁶ Some services use XMPP, the open messaging and presence protocol whose core is defined in RFC 6120.⁵ When the app is closed the connection drops; the chat service then asks the phone's platform to show a push notification, and the conversation catches up when the person opens the app again.

Two more choices shape the product. End-to-end encryption means only the people in the conversation can read the messages, not the service in the middle. The IETF's Messaging Layer Security protocol (MLS), RFC 9420 of July 2023, standardises it for groups whose members are not all online at the same time.⁸ It also means your own moderators and bots cannot read those messages, so it suits private chat between users better than support chat. Where the data is stored (data residency) matters wherever laws restrict sending personal data abroad, as in Saudi Arabia, the UAE and the EU (see the rules below).

Chat inside software is older than smartphones. In January 1999 Jeremie Miller announced Jabber, an open technology for instant messaging and presence; it was published by the IETF as XMPP in 2004, and its core was revised as RFC 6120 in March 2011.⁴⁵ In December 2011 the IETF published WebSocket, which gave web pages and apps a standard, always-open connection.⁶ Together they made it practical to run a real-time chat service that many apps could connect to, instead of every product building its own messaging plumbing.

Communications platforms then sold chat as a building block. In August 2019, for example, Twilio announced Conversations, an API for conversations that span in-app chat, SMS and WhatsApp, launched in public beta.⁷ In July 2023 the IETF published MLS for end-to-end encrypted group messaging.⁸

Regulation caught up with chat between users. The EU Digital Services Act has applied to all online platforms and hosting services since 17 February 2024;¹⁴ the UK's illegal content duties under the Online Safety Act came into force on 17 March 2025;¹³ and the US Federal Trade Commission's amended children's privacy rule was published in April 2025.¹² Since 2 August 2026, chatbots offered in the EU must tell people they are dealing with an AI system.²¹

In-app chat goes wherever smartphones and apps go, and mobile internet use sets its ceiling. The GSMA, the mobile industry's association, reported that 4.7 billion people, 58% of the world's population, used mobile internet in 2024, while another 3.1 billion lived within mobile broadband coverage but did not use it.¹

What changes between regions is less the technology than the rules on user content, children and data:

• Americas: in the United States, the FTC's COPPA rule governs online services aimed at children under 13.¹¹¹²
• Europe: the Digital Services Act requires platforms that host user content to let people report illegal content;¹⁴¹⁵ the UK has its own Online Safety Act duties;¹³ and the European Accessibility Act covers the apps of e-commerce and banking services.²⁰
• Middle East and Africa: Saudi Arabia's Personal Data Protection Law reaches the processing of residents' data by parties outside the Kingdom,¹⁸ and the UAE's federal law sets conditions for transferring personal data abroad.¹⁹
• Asia-Pacific: Australia's Basic Online Safety Expectations apply to messaging services,¹⁶ and India notified the rules under its Digital Personal Data Protection Act in November 2025.¹⁷

The usual homes for in-app chat are marketplaces, ride-hailing and delivery, banking and fintech, telehealth, education, gaming, dating and member communities: products where people already sign in and the conversation is about something inside the product.

• Support inside a signed-in app: the agent already knows who the customer is and which order or account they mean, so nobody has to repeat an account number.
• Embedded conversations between users: buyer and seller, host and guest, driver and rider, without either side giving out a phone number.
• Commerce: questions before a purchase, order updates and returns, next to the order itself.
• Membership and communities: group channels for members, classes or fans.
• Chatbots and AI agents that answer first and hand over to a person in the same thread.
• Video calls started from a chat, such as a consultation, with the meeting link carried in a message.

Chat providers price the service in a few common ways:

• Per monthly active user (MAU): you pay for each distinct user who sends or receives a message in the month, usually in falling tiers.
• By concurrent connections: the number of users connected at the same moment, which matters for live events and games.
• By message volume or plan tier, with moderation, translation, long message history and file storage often charged as add-ons.
• Building it yourself: no licence fee, but engineers to run real-time servers, sync, notifications, search and moderation for as long as the product lives.

As one official example, Twilio's Conversations API lists the first 200 monthly active users as free and US$0.05 per active user from 201 to 5,000 users, with lower rates above that. It counts only users who actually send or receive messages in the billing cycle, charges media storage separately from US$0.25 per GB a month, and adds the fees of any SMS or WhatsApp messages in the conversation, as listed in October 2026.⁹ Check each provider's own rate card for your volume.

The less visible costs are people: moderators for chat between users, agents for support chat, and the time to answer data requests and legal notices.

This section describes the rules in plain words; it is not legal advice. Four layers apply: the app stores, data protection, online safety for user content, and rules on AI and accessibility.

The app stores

Apple treats chat between users as user-generated content. Under App Review Guideline 1.2, such apps must filter objectionable material, offer a way to report offensive content with timely responses, let people block abusive users and publish contact details; apps used mainly for random or anonymous chat do not belong on the App Store.² Google Play requires an in-app system to report and block objectionable content and users: blocking where users can message each other directly, both reporting and blocking where content is public, and terms that users accept before they post.³

Data protection and retention

Chat transcripts are personal data. Under the GDPR, personal data may be kept no longer than its purpose needs, and controllers should set time limits for erasure or periodic review,¹⁰ so decide before launch how long messages, attachments and the content of deleted accounts are kept. Saudi Arabia regulates transfers of personal data outside the Kingdom under its Personal Data Protection Law;¹⁸ the UAE's Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, generally requires consent and sets cross-border conditions;¹⁹ and India's rules, notified in November 2025, require a clear consent notice for each specific purpose and phase in over eighteen months.¹⁷

Children

In the United States, COPPA amendments finalised in January 2025 require separate verifiable parental consent before a child's personal information is disclosed to third parties, and a written data-retention policy; most changes had to be in place within a year of publication in April 2025.¹¹¹² If children can use your chat, these duties apply alongside the app stores' rules.

Online safety for user content

• European Union: since 17 February 2024, the Digital Services Act applies to all online platforms and hosting services. Platforms must offer a notice-and-action mechanism for reporting illegal content, and hosting services must explain their moderation decisions.¹⁴¹⁵
• United Kingdom: duties to tackle illegal content took effect for user-to-user services on 17 March 2025, after a risk assessment due by 16 March 2025.¹³
• Australia: the Basic Online Safety Expectations under the Online Safety Act 2021 apply to messaging services and expect ways for users to report from inside the service.¹⁶

AI and accessibility

In the EU, an AI system that talks directly with people must tell them so from 2 August 2026, unless it is obvious.²¹ The European Accessibility Act, applying since 28 June 2025, covers the websites and apps of services such as e-commerce and banking; microenterprises providing services are excluded.²⁰

• It only reaches people inside your app. If they uninstall it or switch off notifications, the conversation goes quiet. Keep another channel for anything that must arrive.
• Building chat looks easy and is not. Offline sync, message order, read receipts, notifications, search, attachments and moderation take years to get right; see when to build messaging infrastructure.
• Chat between users without safety tools breaks the app stores' rules and invites fraud, such as buyers lured off the platform to pay outside it.²³
• Encryption against oversight. End-to-end encryption protects users but stops your moderators and bots from reading content; decide per type of conversation.⁸
• Lock-in. Message history, user IDs and the SDK sit with one provider; ask how you would export everything before you sign.
• One person, many channels. The same customer may chat in the app, email you and message you on WhatsApp; without one customer record the agent sees three strangers. See omnichannel is an identity problem.
• Right-to-left and Arabic. Chat screens must mirror correctly, mix Arabic and Latin text and numbers, and search Arabic well; see Arabic-first is not translation.

• AI disclosure in the EU. Article 50 of the AI Act has applied since 2 August 2026: chatbots inside apps must tell people they are dealing with AI unless it is obvious.²¹ See AI Act Article 50 for messaging.
• India's phased rules. The Digital Personal Data Protection Rules notified in November 2025 take full effect over an eighteen-month period.¹⁷
• Children's privacy in the US. The general compliance period for the amended COPPA rule ran for one year from its publication in April 2025.¹²
• Online safety guidance in Australia. The eSafety Commissioner published updated regulatory guidance on the Basic Online Safety Expectations in February 2026.¹⁶

Choose in-app chat when your customers already use your app, when the conversation is about something inside it, or when your users need to talk to each other without leaving your product. Pair it with push notifications to bring people back, and with email or another channel for anything that must arrive. For visitors who have no account yet, web chat and booking pages do the same job on your website. The in-app chat channel page lists providers; the five layers explains where chat sits in the stack, choosing a channel per message covers the trade-offs, and which channel for which need compares every channel side by side. Record what each user agreed to, per channel and purpose: consent is a data model.