--- title: "In-app chat 101: conversations inside your own product" summary: "In-app chat puts messaging inside your own mobile or web app through an SDK: support chat between customers and your team, and chat between your users in marketplaces and communities. You keep the context, the design and the data, and you also take on what platforms usually carry for you: moderation, safety and data rules." canonical: https://cpaas.co/en/learn/in-app-101 kind: explainer depth: foundation origin: original published: 2026-10-13T16:26:18.899Z updated: 2026-10-14T16:26:19.854Z topics: ["Messaging", "Architecture", "Fundamentals"] language: en --- # In-app chat 101: conversations inside your own product ## At a glance In-app chat is messaging that lives inside your own product: a support conversation in a banking app, a buyer asking a seller a question in a marketplace, a driver and a passenger arranging a pickup, a tutor and a student, or a members' community. It is built into a mobile or web app with an [SDK](/en/learn/glossary#sdk) (a software development kit: ready-made code a developer adds to the app) and an [API](/en/learn/glossary#api), from a chat provider or built in-house. - **What it is:** chat screens and message storage inside your app or website, with your design and your rules. - **Who runs it:** you do, usually on top of a provider's chat service. No public network or platform owner sits between you and your users. - **Reach:** only people who have your app or sign in to your product. The GSMA counted 4.7 billion mobile internet users in 2024,[^1] but your reach is your own user base. - **Who may start the conversation:** usually the user. The business can write into an open thread, and alerts about new messages travel as push notifications. - **How it is priced:** typically per monthly active user, sometimes by concurrent connections or volume, plus storage and add-ons. - **Best for:** conversations tied to an account, an order, a booking or a match between two users. - **Avoid for:** reaching people who have not installed your app or have stopped opening it. - **As of:** October 2026. ```diagram:compare | Support chat (customer to business) | User-to-user chat Who talks | A customer and your team, a bot or an AI agent | Two or more of your users: buyer and seller, driver and rider, members What it replaces | A phone call or an email ticket | Swapping phone numbers or moving to an outside app Main risk | Slow answers and lost context | Abuse, fraud and harmful content What app stores expect | The usual privacy rules | Reporting, blocking and filtering, as user-generated content > The two kinds of in-app chat, and why the second carries more duties. ``` ## How it works Three parts do the work. The **client SDK** in the app draws the chat screen, keeps a local copy of recent messages so the app still works on a poor connection, and holds an open connection to the chat service. The **chat service** (the provider's servers, or your own) stores each message, decides who may see it and passes it to everyone in the conversation. Your **back end** creates users and conversations, signs each user in with a token, and listens for events through [webhooks](/en/learn/glossary#webhook), so that bots, moderation tools and your customer records can react. The open connection is usually a WebSocket, an IETF standard from December 2011 that keeps one two-way connection between app and server instead of asking the server again and again whether anything new has arrived.[^6] Some services use XMPP, the open messaging and presence protocol whose core is defined in RFC 6120.[^5] When the app is closed the connection drops; the chat service then asks the phone's platform to show a [push notification](/en/learn/push-101), and the conversation catches up when the person opens the app again. ```diagram:path # The path of one in-app message Sender's app | The SDK sends the message over an open connection | The message, with the sender's signed-in identity Chat service | Stores it, checks who may see it, runs filters | A copy for each member of the conversation Your back end | Receives a webhook; a bot, moderation or your records can act | An optional reply, flag or update Recipient's app | Shows it at once if open, otherwise a push notification | Read receipts and typing status back to the sender ``` Two more choices shape the product. **End-to-end encryption** means only the people in the conversation can read the messages, not the service in the middle. The IETF's Messaging Layer Security protocol (MLS), RFC 9420 of July 2023, standardises it for groups whose members are not all online at the same time.[^8] It also means your own moderators and bots cannot read those messages, so it suits private chat between users better than support chat. **Where the data is stored** ([data residency](/en/learn/glossary#data-residency)) matters wherever laws restrict sending personal data abroad, as in Saudi Arabia, the UAE and the EU (see the rules below). ## A short history Chat inside software is older than smartphones. In January 1999 Jeremie Miller announced Jabber, an open technology for instant messaging and presence; it was published by the IETF as XMPP in 2004, and its core was revised as RFC 6120 in March 2011.[^4][^5] In December 2011 the IETF published WebSocket, which gave web pages and apps a standard, always-open connection.[^6] Together they made it practical to run a real-time chat service that many apps could connect to, instead of every product building its own messaging plumbing. Communications platforms then sold chat as a building block. In August 2019, for example, Twilio announced Conversations, an API for conversations that span in-app chat, SMS and WhatsApp, launched in public beta.[^7] In July 2023 the IETF published MLS for end-to-end encrypted group messaging.[^8] Regulation caught up with chat between users. The EU Digital Services Act has applied to all online platforms and hosting services since 17 February 2024;[^14] the UK's illegal content duties under the Online Safety Act came into force on 17 March 2025;[^13] and the US Federal Trade Commission's amended children's privacy rule was published in April 2025.[^12] Since 2 August 2026, chatbots offered in the EU must tell people they are dealing with an AI system.[^21] ```diagram:timeline # From instant messaging to regulated in-app chat January 1999 | Jabber announced | Open instant messaging, later XMPP March 2011 | RFC 6120 revises the XMPP core | An open standard for messaging and presence December 2011 | RFC 6455 standardises WebSocket | One always-open connection for apps and pages August 2019 | Twilio announces Conversations | Chat APIs spanning in-app chat, SMS and WhatsApp July 2023 | RFC 9420 publishes MLS | End-to-end encryption for groups February 2024 | The Digital Services Act applies to all platforms | Reporting illegal content in the EU March 2025 | UK illegal content duties in force | Online Safety Act duties for user-to-user services August 2026 | EU AI Act Article 50 applies | People must be told when they talk to AI ``` ## Where it is used In-app chat goes wherever smartphones and apps go, and mobile internet use sets its ceiling. The GSMA, the mobile industry's association, reported that 4.7 billion people, 58% of the world's population, used mobile internet in 2024, while another 3.1 billion lived within mobile broadband coverage but did not use it.[^1] ```diagram:bars # Mobile internet in 2024 (billions of people) Using mobile internet | 4.7 | 58% of the world's population Covered but not using it | 3.1 | What the GSMA calls the usage gap > GSMA, State of Mobile Internet Connectivity, September 2025. ``` What changes between regions is less the technology than the rules on user content, children and data: - **Americas:** in the United States, the FTC's COPPA rule governs online services aimed at children under 13.[^11][^12] - **Europe:** the Digital Services Act requires platforms that host user content to let people report illegal content;[^14][^15] the UK has its own Online Safety Act duties;[^13] and the European Accessibility Act covers the apps of e-commerce and banking services.[^20] - **Middle East and Africa:** Saudi Arabia's Personal Data Protection Law reaches the processing of residents' data by parties outside the Kingdom,[^18] and the UAE's federal law sets conditions for transferring personal data abroad.[^19] - **Asia-Pacific:** Australia's Basic Online Safety Expectations apply to messaging services,[^16] and India notified the rules under its Digital Personal Data Protection Act in November 2025.[^17] The usual homes for in-app chat are marketplaces, ride-hailing and delivery, banking and fintech, telehealth, education, gaming, dating and member communities: products where people already sign in and the conversation is about something inside the product. ## What businesses use it for - **[Support](/en/ecosystem/use-cases/support)** inside a signed-in app: the agent already knows who the customer is and which order or account they mean, so nobody has to repeat an account number. - **[Embedded conversations](/en/ecosystem/use-cases/embed)** between users: buyer and seller, host and guest, driver and rider, without either side giving out a phone number. - **[Commerce](/en/ecosystem/use-cases/commerce):** questions before a purchase, order updates and returns, next to the order itself. - **[Membership](/en/ecosystem/use-cases/membership) and communities:** group channels for members, classes or fans. - **[Chatbots](/en/ecosystem/use-cases/chatbot)** and [AI agents](/en/learn/glossary#ai-agent) that answer first and hand over to a person in the same thread. - **[Video calls](/en/ecosystem/use-cases/video-calls)** started from a chat, such as a consultation, with the meeting link carried in a message. ## What it costs Chat providers price the service in a few common ways: - **Per monthly active user (MAU):** you pay for each distinct user who sends or receives a message in the month, usually in falling tiers. - **By concurrent connections:** the number of users connected at the same moment, which matters for live events and games. - **By message volume or plan tier,** with moderation, translation, long message history and file storage often charged as add-ons. - **Building it yourself:** no licence fee, but engineers to run real-time servers, sync, notifications, search and moderation for as long as the product lives. As one official example, Twilio's Conversations API lists the first 200 monthly active users as free and US$0.05 per active user from 201 to 5,000 users, with lower rates above that. It counts only users who actually send or receive messages in the billing cycle, charges media storage separately from US$0.25 per GB a month, and adds the fees of any SMS or WhatsApp messages in the conversation, as listed in October 2026.[^9] Check each provider's own rate card for your volume. The less visible costs are people: moderators for chat between users, agents for support chat, and the time to answer data requests and legal notices. ## Rules and regulation This section describes the rules in plain words; it is not legal advice. Four layers apply: the app stores, data protection, online safety for user content, and rules on AI and accessibility. ### The app stores Apple treats chat between users as user-generated content. Under App Review Guideline 1.2, such apps must filter objectionable material, offer a way to report offensive content with timely responses, let people block abusive users and publish contact details; apps used mainly for random or anonymous chat do not belong on the App Store.[^2] Google Play requires an in-app system to report and block objectionable content and users: blocking where users can message each other directly, both reporting and blocking where content is public, and terms that users accept before they post.[^3] ```diagram:checklist # What the app stores expect of chat between users Report | Users can report a message or a user from inside the app Block | Users can block someone who messages them Filter | Objectionable material is filtered before others see it Respond | Reports get timely answers, and contact details are published [!] Random or anonymous chat | Not accepted on Apple's App Store ``` ### Data protection and retention Chat transcripts are personal data. Under the [GDPR](/en/learn/glossary#gdpr), personal data may be kept no longer than its purpose needs, and controllers should set time limits for erasure or periodic review,[^10] so decide before launch how long messages, attachments and the content of deleted accounts are kept. Saudi Arabia regulates transfers of personal data outside the Kingdom under its Personal Data Protection Law;[^18] the UAE's Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, generally requires consent and sets cross-border conditions;[^19] and India's rules, notified in November 2025, require a clear consent notice for each specific purpose and phase in over eighteen months.[^17] ### Children In the United States, COPPA amendments finalised in January 2025 require separate verifiable parental consent before a child's personal information is disclosed to third parties, and a written data-retention policy; most changes had to be in place within a year of publication in April 2025.[^11][^12] If children can use your chat, these duties apply alongside the app stores' rules. ### Online safety for user content - **European Union:** since 17 February 2024, the Digital Services Act applies to all online platforms and hosting services. Platforms must offer a notice-and-action mechanism for reporting illegal content, and hosting services must explain their moderation decisions.[^14][^15] - **United Kingdom:** duties to tackle illegal content took effect for user-to-user services on 17 March 2025, after a risk assessment due by 16 March 2025.[^13] - **Australia:** the Basic Online Safety Expectations under the Online Safety Act 2021 apply to messaging services and expect ways for users to report from inside the service.[^16] ### AI and accessibility In the EU, an AI system that talks directly with people must tell them so from 2 August 2026, unless it is obvious.[^21] The European Accessibility Act, applying since 28 June 2025, covers the websites and apps of services such as e-commerce and banking; microenterprises providing services are excluded.[^20] ## Limits and pitfalls - **It only reaches people inside your app.** If they uninstall it or switch off notifications, the conversation goes quiet. Keep another channel for anything that must arrive. - **Building chat looks easy and is not.** Offline sync, message order, read receipts, notifications, search, attachments and moderation take years to get right; see [when to build messaging infrastructure](/en/learn/when-to-build-messaging-infrastructure). - **Chat between users without safety tools** breaks the app stores' rules and invites fraud, such as buyers lured off the platform to pay outside it.[^2][^3] - **Encryption against oversight.** End-to-end encryption protects users but stops your moderators and bots from reading content; decide per type of conversation.[^8] - **Lock-in.** Message history, user IDs and the SDK sit with one provider; ask how you would export everything before you sign. - **One person, many channels.** The same customer may chat in the app, email you and message you on WhatsApp; without one customer record the agent sees three strangers. See [omnichannel is an identity problem](/en/learn/omnichannel-is-an-identity-problem). - **Right-to-left and Arabic.** Chat screens must mirror correctly, mix Arabic and Latin text and numbers, and search Arabic well; see [Arabic-first is not translation](/en/learn/arabic-first-is-not-translation). ## Strengths and weaknesses ```diagram:compare | Strengths | Weaknesses Context | The user is signed in; the agent sees the account, order or booking | Nothing reaches people who are not in your app Control | Your design, your rules, your data | Safety, moderation and data requests are your job Between users | Buyers, sellers and members talk without sharing phone numbers | Abuse and fraud need reporting, blocking and review Cost | No per-message carrier fees inside the app | Costs grow with active users and storage Data | Transcripts stay in your systems for service and analysis | Retention limits and transfer rules apply ``` ## What comes next - **AI disclosure in the EU.** Article 50 of the AI Act has applied since 2 August 2026: chatbots inside apps must tell people they are dealing with AI unless it is obvious.[^21] See [AI Act Article 50 for messaging](/en/learn/ai-act-article-50-for-messaging). - **India's phased rules.** The Digital Personal Data Protection Rules notified in November 2025 take full effect over an eighteen-month period.[^17] - **Children's privacy in the US.** The general compliance period for the amended COPPA rule ran for one year from its publication in April 2025.[^12] - **Online safety guidance in Australia.** The eSafety Commissioner published updated regulatory guidance on the Basic Online Safety Expectations in February 2026.[^16] ## When to choose it ```diagram:decision # Is in-app chat the right channel? Do the people you want to reach use your app or sign in to your site? | | Use a channel they already have: email, SMS or a chat app Must your users talk to each other? | Use in-app chat with reporting, blocking and moderation | Is the conversation about something inside your product? | Use in-app chat for support | Consider web chat or a chat app ``` Choose in-app chat when your customers already use your app, when the conversation is about something inside it, or when your users need to talk to each other without leaving your product. Pair it with [push notifications](/en/learn/push-101) to bring people back, and with [email](/en/learn/email-101) or another channel for anything that must arrive. For visitors who have no account yet, [web chat and booking pages](/en/learn/webchat-101) do the same job on your website. The [in-app chat channel page](/en/ecosystem/channels/in-app) lists providers; [the five layers](/en/learn/the-five-layers) explains where chat sits in the stack, [choosing a channel per message](/en/learn/choosing-a-channel-per-message) covers the trade-offs, and [which channel for which need](/en/learn/which-channel-for-what) compares every channel side by side. Record what each user agreed to, per channel and purpose: [consent is a data model](/en/learn/consent-is-a-data-model). ## Sources [^1]: [GSMA calls for renewed focus on closing the Usage Gap as more than 3 billion people remain offline despite available mobile internet services](https://www.gsma.com/newsroom/press-release/gsma-calls-for-renewed-focus-on-closing-the-usage-gap-as-more-than-3-billion-people-remain-offline-despite-available-mobile-internet-services/) — GSMA Newsroom, 2025-09 [^2]: [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) — Apple Developer, accessed 2026-10 [^3]: [User Generated Content](https://support.google.com/googleplay/android-developer/answer/9876937?hl=en) — Google Play Console Help, accessed 2026-10 [^4]: [History of XMPP](https://xmpp.org/about/history/) — XMPP Standards Foundation, accessed 2026-10 [^5]: [RFC 6120: Extensible Messaging and Presence Protocol (XMPP): Core](https://www.rfc-editor.org/info/rfc6120/) — IETF / RFC Editor, 2011-03 [^6]: [RFC 6455: The WebSocket Protocol](https://www.rfc-editor.org/info/rfc6455/) — IETF / RFC Editor, 2011-12 [^7]: [Twilio Conversations Creates Meaningful, Cross-channel Connections with Customers At Scale](https://www.twilio.com/en-us/press/releases/twilio-conversations) — Twilio (press release), 2019-08-06 [^8]: [RFC 9420: The Messaging Layer Security (MLS) Protocol](https://www.rfc-editor.org/rfc/rfc9420.html) — IETF / RFC Editor, 2023-07 [^9]: [Conversations API Pricing](https://www.twilio.com/en-us/messaging/pricing/conversations-api) — Twilio, accessed 2026-10 [^10]: [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) — EUR-Lex, 2016-04 [^11]: [FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) — US Federal Trade Commission, 2025-01-16 [^12]: [16 CFR Part 312: COPPA - Final Rule Amendments](https://www.ftc.gov/legal-library/browse/federal-register-notices/16-cfr-part-312-coppa-final-rule-amendments) — US Federal Trade Commission, 2025-04 [^13]: [Important dates for Online Safety compliance](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/important-dates-for-online-safety-compliance) — Ofcom, accessed 2026-10 [^14]: [Digital Services Act starts applying to all online platforms in the EU](https://digital-strategy.ec.europa.eu/en/news/digital-services-act-starts-applying-all-online-platforms-eu) — European Commission, 2024-02 [^15]: [Fighting online scams with the DSA (notice and action mechanism)](https://digital-strategy.ec.europa.eu/en/policies/dsa-notice-and-action-mechanism) — European Commission, accessed 2026-10 [^16]: [Basic Online Safety Expectations: regulatory guidance](https://www.esafety.gov.au/sites/default/files/2026-02/Basic-Online-Safety-Expectations-regulatory-guidance-February-2026.pdf?v=1775023200024) — eSafety Commissioner (Australia), 2026-02 [^17]: [Government notifies DPDP Rules to empower citizens and protect privacy](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014®=3&lang=2) — Press Information Bureau, Government of India, 2025-11 [^18]: [Guide to the Saudi Personal Data Protection Law, Version 1.0](https://dgp.sdaia.gov.sa/wps/wcm/connect/85a664fd-6e4e-4edb-bab4-1cbdb02ba6d5/Guide+to+the+saudi+PDP+law+HANDBOOK__%D9%90EN.pdf?MOD=AJPERES) — Saudi Data and AI Authority (SDAIA), 2023-12 [^19]: [Data protection laws](https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws) — The UAE Government portal (u.ae), accessed 2026-10 [^20]: [European Accessibility Act (EAA)](https://commission.europa.eu/strategy-and-policy/policies/justice-and-fundamental-rights/disability/european-accessibility-act-eaa_en) — European Commission, accessed 2026-10 [^21]: [Transparency obligations under Article 50 of the AI Act](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) — European Commission, accessed 2026-10 --- Published by the company behind five products in this category. Those products appear in this site's directory alongside competitors under the same published criteria and are labelled as its own. Editorial content does not recommend them.