[seanwilson]

It would be nice if chat boxes only loaded the full chat functionality once the user has interacted with it. Why do they need so load so much just to show a chat widget circle in the corner that likely won't even be clicked on the majority of the time?

170KB for the chat widget is good but when you're trying to make minimal fast loading pages, this is still feels like a lot. If you avoid JS, use minimal CSS and stick to SVG images, you can get whole landing pages to load in under 500KB.

One trick I use though is to delay loading chat widget JS for about 5 or 10 seconds after the page loads. It's not needed immediately and the delay lets the browser prioritise loading the rest of the page first.

[baptistejamin]

Hello Sean!

You are totally right, in many cases splitting the chat in many sub-parts can improve loading time.

It is something we tried during our optimization batch.

We figured that it wasn’t improving so much the loading time in our case. Saving around 10KB.

In fact our JS size is 80KB and CSS 30KB. The rest are fonts.

We offer an option for our customers to delay the chat. It’s a built-in feature. Not enabled by default.

About landing pages, you are totally right. SVGs make a real difference.

[shortstuffsushi]

Per the article, your total size is something like 230kb, so more than half your size is in fonts? I'm sure I'm in the minority here in that I don't like loading external fonts, but couldn't system fonts be good enough, or using the default of the site you're hosted within?

[seanwilson]

> We figured that it wasn’t improving so much the loading time in our case. Saving around 10KB.

Would you be able to offer the feature I mentioned? Load only enough CSS + JS to show the chat widget circle then load the rest after the user clicks? It would need less than 10KB of code total before compression, and then optimising the size of the full widget wouldn't be as critical.

I know you can trigger the Crisp chat pop-up programmatically so I guess it's something a user could implement but it would be a feature I would really appreciate since I'm always optimising the page speed of websites I help with.

[lmkg]

Fun fact: loading chat boxes on pageload can get you in hot water with GDPR/PECR! Most such services use cookies in some fashion. You don't need consent for cookies that are "strictly necessary" to provide a service, but you can only use that exemption for users who initiate a chat session.

FYI this is a concrete example given by a regulatory authority of non-compliant behavior they observe in the wild, so it's not just theoretical.

[seanwilson]

> FYI this is a concrete example given by a regulatory authority of non-compliant behavior they observe in the wild, so it's not just theoretical.

Can you give a link to this?

Would it still apply to Crisp chat?

"You do not need to ask for user consent regarding Crisp cookies. Crisp uses cookies solely for messaging purpose, and not for tracking purposes."

https://help.crisp.chat/en/article/crisp-chatbox-cookie-and-...

Also, is there a good source to answer when you need and don't need a consent pop-up? It's maddening how difficult it is to get a straightforward yes/no for common use cases. Has nobody made a questionnaire/wizard where you tell it what you store and why, and it'll tell you if consent is required?

[lmkg]

The report I am referring to is this "cookie sweep" performed by the Irish DPA. It is especially significant because the Irish DPA is the one with jurisdiction over many US tech companies, who incorporate their EU operations in Ireland for tax reasons [PDF]: https://www.dataprotection.ie/sites/default/files/uploads/20...

There is not enough information in (that page of) Crisp's documentation to tell for sure whether they're compliant. The key question is: are cookies written when the JS loads, or only when the user initiates a chat session? They seem to be appealing to the "strictly necessary" exemption, but that only applies when the user actually tries to chat. Cookies set before a user tries to chat are not strictly necessary.

In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested. "Strictly necessary" and "service" should both be interpreted narrowly. That guidance only applies to reading/writing user device data, because it's governed by PECR rather than GDPR directly. GDPR allows a lot more leeway for collecting data for narrowly-defined-but-not-strictly-necessary reasons (like analytics).

The UK regulator, ICO, actually has some pretty thorough write-ups about cookies and consent and things of that nature. The UK is no longer part of the EU and its laws will diverge, but for the moment PECR and GDPR are both UK domestic legislation and will generally mirror EU law (except for international transfers). ICO's cookie guidanec: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

[seanwilson]

> In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested.

What's the rational behind this if the data stored locally isn't used for user tracking or even uploaded anywhere? By the same logic, why shouldn't we have to ask for consent to cache web files and to store data in a URL parameter?

Thanks for the links. I think part of the problem is there's just so much information and discussion on this, that it's hard to get a clear answer you can be 100% sure you can trust. PECR, GDPR, Irish DPA, ICO, UK law, EU law, cookie sweep... how are you suppose to keep up, know what applies to your particular case, and be sure you've interpreted and collated all the guidelines correctly?

[lmkg]

I hold a certification in information privacy, so my totally-biased answer is "hire an expert!" :p

The reading/writing requirements are from PECR, which is old and dumb. Passed in 2003ish, and was basically ignorable until GDPR changed the definition of consent. Updating it to include GDPR's much-saner concept of "Legitimate Interest" has been a priority goal for several years, but never actually happens.