Consent & privacy

TrustAnalytics collects in six groups, and for each group you decide whether it is collected at all and whether it waits for the visitor’s consent. This page explains the groups, how your consent banner reports the decision, and what is stored when.

Under Settings › Data collection & privacy › Collection and consent every group has one of three modes:

• Page views carry everything else and cannot be switched off. While page views wait for consent, no other group can be Always — nothing is collected from a visitor who did not consent.
• One consent, not one per group. Your banner reports a single yes or no, the way consent managers and Google Consent Mode signal analytics. Which groups that consent switches on is decided here, so the text of your banner has to name what is set to Only with consent — see Your banner.
• Your plan comes first. A group your plan does not include is greyed out and collects nothing. Sampling, masking and the other details of heatmaps and replays stay their own settings.
• The switch above the fields sets the consent question for all groups at once; a group that is Off stays off. Change a single group so that none of the three fits any more, and the switch shows Custom.

On top of the modes, SDK options can switch single collectors off in code (data-forms="false", heatmaps: false, …), and Do Not Track and Global Privacy Control and your tracking rules can narrow what is stored for some traffic. None of them widens what the modes allow, and the server checks all of it again — a modified script cannot send more than the website allows. Which fields an event carries is not a setting: leave one out in code with beforeSend. Copy From Another Website takes these settings and the retention over from another website of the project.

The modes have to fit the country you operate in, its case law and your own legal view. TrustAnalytics makes every combination possible so that it can be used under any law; it does not decide for you, and this is no legal advice. In the EU two questions usually decide:

• Is something stored on or read from the visitor’s device? That needs consent unless it is strictly necessary (Art. 5(3) ePrivacy Directive, in Germany § 25 TDDDG). Recognition and cookie stores the visitor cookie; automatic interactions read time zone, screen, window size, scroll depth and, for heatmaps, click positions; session replay reads pointer positions and the page content. Page views store nothing on the device. They read the address, title and referrer of the page the browser is showing, the browser’s privacy signals (Do Not Track, Global Privacy Control) and its automation flag, which are sent as flags, and, from mouse, keyboard and touch events, how long the page was actively used, which is sent when the visitor leaves the page. Scroll depth and window size are not read without Automatic interactions. Authorities differ on how far “access to the device” reaches — the EDPB guidelines 2/2023 take a broad view — and some member states exempt audience measurement from consent under conditions (France and the Netherlands, for example).
• What is the legal basis for the processing itself? Even a page view processes the IP address and user agent and stores a pseudonym derived from them (see Visitors). Many websites base page views on legitimate interest and everything else on consent; recordings of visits and recognition across visits are widely seen as needing consent.

With the settings of a new website, only page views are stored as long as the visitor has not consented. Whatever you set to Always is added to that; with page views on Only with consent, nothing is stored.

• Nothing in the browser without consent. No cookie, no localStorage, no sessionStorage. The SDK never uses web storage at all; the only thing it ever writes is the cookie trustanalytics, and only once a visitor decided: GRANTED with the visitor id where recognition is collected, or REFUSED, or OPTOUT — see Consent states. The value starts with the version of its format (1~GRANTED~<id>). The one exception is a website that sets Recognition and cookie to Always: it stores the visitor id from the first page on, before a decision as 1~UNDECIDED~<id>.
• No IP address and no user agent are stored. The server uses them while it receives the event — to derive country, region and city, browser, operating system and device class, to filter bots and to evaluate your rules — and then discards them.
• Sessions without a cookie. Every page load starts a fresh page view id, kept in the page’s memory only, that holds together what happens on that page; in a single-page app only a page view after 30 minutes without an event renews it. The server joins page loads into visits itself: with the visitor cookie by that cookie, otherwise the page loads of one address and browser on one day belong to one session until 30 minutes pass without an event. Visitors without a cookie who share one address and browser (a company network) can therefore end up in one session. The key behind that is an HMAC with a secret that changes every day and is deleted after two days at the latest, so no address can be derived from it later.
• No user id. Where Recognition and cookie is not collected for a visitor, identify() is not sent, and the server removes a user id from events.
• What a page view carries: the page address and title, the referrer, and what the server derives from the request itself — location from the address, browser, system and device class from the user agent, language from Accept-Language. The script also reads the browser’s Do Not Track, Global Privacy Control and automation signals, which travel as flags, and measures the time the page was actively used from mouse, keyboard and touch events, which travels with the page-leave event. Time zone, screen and window size, client hints and scroll depth are not read: they belong to Automatic interactions — see What every event carries.
• Query strings are filtered from stored paths and from the urls in a replay. UTM parameters are kept as campaign fields; which other parameters stay is set under Settings › Data collection & privacy › Pages › Query parameters: Keep only the listed ones (a new website starts with an empty list, so nothing stays) or Keep all except the listed ones — up to 50 names, * matching any characters, at most two * per name. Technical parameters — utm_*, ref and source, click ids such as gclid, msclkid or fbclid, session ids such as phpsessid or sid, and the hand-over parameter _ta — never stay, in either mode; ref and source are read as the campaign source, like utm_source.

<!-- Strict: your consent manager activates the tag after consent (attribute names vary by manager) -->
<script type="text/plain" data-category="statistics" async
        src="https://cdn.trustcomponent.com/trustanalytics/0.1.x/trustanalytics.min.js"
        data-site-key="YOUR_SITE_KEY" data-consent="granted"></script>

Call trustanalytics.setConsent() with the visitor’s decision, every time the page loads once a decision exists and whenever it changes: true for consent, false for a refusal or a withdrawal. Before the visitor decided, do not call it at all.

// e.g. in the callback of your consent manager
trustanalytics.setConsent(true);

// refuse or withdraw
trustanalytics.setConsent(false);

• Your consent manager stays the source of truth. Pass its state on every page load and whenever it changes — with setConsent, with start({ consent }) or with the consent option. The SDK keeps the visitor’s decision — a consent, a refusal or an objection — in the cookie trustanalytics (12 months, renewed on every page once a decision exists) only so that the next page starts with it instead of waiting for your banner; whatever your consent manager passes overrides it at once.
• Only true is a consent. Anything else — false, nothing, a text — counts as refused, so a mistake in the integration never collects more.
• The consent is checked when events are sent, not when they happen. The SDK sends every five seconds. Events of a group that waits for consent stay in memory — at most 1,000 per page load — and are sent as soon as the consent arrives, with their original time, even minutes later; a visitor who clicks the banner away after three minutes still brings those three minutes. Leaving the page drops what is still waiting. Nothing of it leaves the browser before the consent, and a session replay that waits for consent starts only with it.
• A decision takes effect at once: after a refusal, what is still waiting is dropped and such events are not held any more; a running replay that needs consent stops, and the visitor id leaves the cookie unless recognition is set to Always.
• Start only after consent: if you do not want even the request for the script before a decision, let your consent manager load the snippet only after consent — see Three ways to integrate.
• trustanalytics.getConsent() returns true or false.

Refusing consent in a banner is not an objection: it covers what waits for consent, while what you set to Always rests on your own legal basis. An objection ends that too, and setConsent changes nothing while it stands — a consent manager passes its stored decision on every page and must not undo an objection by that. Only trustanalytics.optIn() withdraws it; the visitor is then undecided again until your consent manager passes the decision. The cookie is renewed on every page once a decision exists and kept for 12 months; storing a refusal or an objection is what lets the next page respect it. A refusal carries no id unless recognition is set to Always, an objection never does. trustanalytics.isOptedOut() tells whether an objection is in place.

Opt-out link for your privacy policy:

<a href="#" onclick="trustanalytics.optOut(); this.textContent = 'You will no longer be measured.'; return false;">Object to analytics on this website</a>

Your consent manager keeps the decision; TrustAnalytics only needs to hear it on every page load and whenever it changes.

Read it automatically. Nearly every consent manager passes its decision on to Google Consent Mode v2, and many to the IAB TCF v2.2 API. Name the one your banner feeds and the SDK follows it by itself, on every page and on every change — no setConsent call needed:

<script async src="https://cdn.trustcomponent.com/trustanalytics/0.1.x/trustanalytics.min.js"
        data-site-key="YOUR_SITE_KEY" data-consent-source="google-consent-mode"></script>

An objection (optOut()) still wins over what the consent manager says. If your banner maps its categories differently, leave consentSource out and call setConsent yourself.

Or call setConsent. Pass the category of your banner that covers analytics:

// Cookiebot
window.addEventListener('CookiebotOnConsentReady', () => trustanalytics.setConsent(Cookiebot.consent.statistics));

// OneTrust — C0002 is the performance group in the default setup; use the group ids of your configuration
function OptanonWrapper() {
  trustanalytics.setConsent((window.OnetrustActiveGroups ?? '').includes(',C0002,'));
}

For any other manager: find the callback or event it fires when the decision is known or changes, read the analytics category there and call setConsent with it. If the SDK may not have loaded yet, push the call to window.trustanalyticsq instead (trustanalyticsq.push(['setConsent', true])).

Browsers can send Do Not Track (DNT) and Global Privacy Control (GPC). Under Settings › Data collection & privacy › Privacy signals you choose what is collected from browsers that send either of them. The setting can only collect less than the modes allow:

A visitor connects the sessions of one person. You decide how far that goes:

There is no fingerprinting beyond the window key, and no visitor is recognised across windows without a cookie or a user id. Without a cookie, several people behind one address with the same browser can count as one visitor, and one person switching networks counts as two. Reports that depend on returning visitors (Retention) say which recognition they are based on.

Link earlier events on identify (setting): when a visitor identifies, earlier events of the same session get the user id too.

External domains (setting, Settings › Data collection & privacy › Pages): visits already continue across all hostnames of the website; list other domains your visitors move between (for example a shop on another domain), and sessions continue across them. The SDK appends _ta=1.<page view id>.<timestamp> to links to those domains when they are clicked, plus .<visitor id> where recognition is collected; the page on the other domain continues the visit if the link is younger than two minutes and removes the parameter from the address bar.

Under Settings › Data collection & privacy › Tracking rules you narrow what is stored for traffic that matches conditions — your office network, a test page, a country, internal campaigns.

• Conditions: IP address or network, hostname, path, referrer host and path, UTM source, medium and campaign, country, region, city, browser, operating system, device class, bot, event name, event category and source (browser or server). Operators: equals, does not equal, contains, starts with, ends with, matches (regex).
• Match: all conditions, any condition, or none of them.
• Actions:

• Rules have a priority and can expire at a date. Test a rule against an example request before you save it.
• Rules apply to browser and server events alike and are counted under Dropped events as RULE.

TrustAnalytics never needs personal data, and it removes what it can recognise. What it cannot recognise is your responsibility:

• Never use an e-mail address as user id or property value. Use the id of your own system.
• Neutral paths for pages whose url contains personal data: trustanalytics.page({}, '/users/:id') with autoPage: false, or a rule Store path as.
• Hide addresses that carry a secret: put data-ta-mask-url on an element and its links, sources and form actions are reduced to the origin in click, link and form events and in the replay. On <html> or <body> it also hides the page address: events and replay then report the origin with the page route (<meta name="ta:page-pattern"> or page({}, { pattern }), see Single-page apps), or /[masked] without one. Set it in the server-rendered HTML, or before the navigation of a single-page app that it should mask: the mask is decided when the page view opens, and an attribute added later does not reach what was already sent or recorded.
• Page titles with personal data (an order confirmation that names the buyer): leave the title out on those pages with beforeSend: (event) => (event.url.includes('/orders/') ? { ...event, pageTitle: undefined } : event).
• Clean or drop events before they leave the browser:

new Analytics({
  siteKey: 'YOUR_SITE_KEY',
  beforeSend: (event) => (event.name === 'internal' ? null : { ...event, properties: { ...event.properties, email: undefined } }),
});

• What the server does anyway: it drops query strings except kept parameters, keeps only the fact that an ad click id (gclid, msclkid, fbclid, …) was present, replaces e-mail addresses in paths, titles, referrers, property values and error texts with [email] and ignores a user id that is an e-mail address — as long as Replace e-mail addresses is on (Settings › Data collection & privacy › Pages, on by default; with it off, e-mail addresses are stored as sent) —, removes query parameters from urls in error messages and stacks except the ones the website keeps, and replaces ids and tokens in request paths with :id (e-mail addresses too, while the switch is on).
• What is never collected: form field values, typed text, visible text of clicked elements, request and response bodies, headers.
• Access: under Settings › Retention & deletion › Access and erasure, Export data downloads everything stored about one visitor, user or session as a JSON file — its sessions with every event, its purchases, errors, web vitals, network requests and heatmap samples, and the list of its replays (the recording itself plays in the dashboard). It covers the 1,000 latest sessions with up to 10,000 records of each kind, the same data an erasure would remove, so you can answer a request for access before or instead of an erasure.
• Erasure: under Settings › Retention & deletion › Access and erasure you remove everything stored about one visitor (the cookie id or, without a cookie, the pseudonym shown in the session), user or session — events, sessions, purchases, web vitals, errors, network requests, heatmap samples and replays. New data of that subject is refused for 48 hours, the longest an event may arrive late; a visitor without the cookie is refused until the visitor window ends, because the pseudonym changes with it, and an erased session stays closed while the same browser may start a new one. A second pass a few minutes later removes anything still in processing. Hourly statistics of the last 72 hours are rebuilt without it; older aggregated statistics contain no ids and are not changed.
• Retention: under Settings › Retention & deletion you choose how long raw events, diagnostics, replays and aggregated statistics are kept, within your plan. Older data is deleted every night. Keep in the replay player protects single recordings from that, see Replay limits.

This is how TrustAnalytics is built for websites in the EU. It is no legal advice — which legal basis applies to your website is your decision.

• What is stored on the device: nothing before the visitor decided, with the settings of a new website. The only thing the SDK writes is the cookie trustanalytics: after a consent it holds GRANTED and, where recognition is collected, the visitor id; after an objection it holds only OPTOUT; after a refusal it holds REFUSED, with the visitor id behind it (1~REFUSED~<id>, the leading 1 being the version of the cookie format) where the website recognises visitors without consent (Recognition and cookie on Always), otherwise without any id, so the next page respects it. A consent you report yourself with data-consent writes no cookie unless it carries the visitor id. Rules on storing and reading information on the device therefore concern the cookie and the groups that read from the device; page views read only the signals and the active time described under Choosing the modes.

• Without a duty to ask for consent (outside the EU, or where your legal assessment says so): set the groups to Always, or keep them on Only with consent and let your consent manager report the consent — most grant it automatically outside the EU and pass it through setConsent, so one setup serves both. Whether a consent is needed is your decision; TrustAnalytics only follows the modes and what the page reports.

• What is personal data: even without consent, the server processes the IP address and user agent of the visitor while it receives an event, and stores a pseudonym derived from them (see Visitors). Treat page views as processing of pseudonymous personal data.

• Your banner: put TrustAnalytics behind your statistics category and pass its decision on every page with setConsent. Because one consent covers every group on Only with consent, the category has to name them. A text to adapt — leave out what you switched off or do not use:

  Statistics — We use TrustAnalytics to understand how this website is used: which pages are viewed, what is clicked, how forms and content are used, and how fast and error-free the site runs. With your consent we also record click and scroll positions (heatmaps) and replays of visits, in which everything you type is masked, and we recognise you on later visits with a cookie kept for 12 months or, when you are signed in, by your account.

• Your privacy policy should name TrustAnalytics as your analytics, the groups you collect and which of them wait for consent, the data of What every event carries, the pseudonym and its window, the cookie trustanalytics with 12 months (the visitor’s consent, refusal or objection, and the visitor id where you recognise visitors), session recordings if you record, and the retention you chose — see the text suggestion.

• Data processing agreement: TrustComponent processes the data on your behalf; you sign the agreement per project under Governance › Contracts, see Signing a DPA.

• Stricter setups: Everything with consent or the strict way send nothing before a decision; a rule Keep basic only or the privacy signal setting collects less for some traffic.

You may be legally obliged to inform your visitors about the analytics you use, usually in your privacy policy. The text below fits the settings of a new website: page views always, everything else only with consent.

Disclaimer: This is an idea of how the notice might look. It only serves as a guideline and is no legally binding advice. Adapt it to your settings — leave out what you switched off or do not use, and move what you set to Always from the consent paragraph to the first one — to your legal basis and your retention, and have it reviewed by a legal advisor of your choice if necessary.

TrustAnalytics (web analytics)

We use “TrustAnalytics” (www.trustcomponent.com) on our website to understand how it is used and to improve it. TrustAnalytics is a service provided by Trustcaptcha GmbH, Munich, Germany, which processes the data on our behalf on servers in the EU.

For every page view, TrustAnalytics records the page visited and its title, the referring page, the language set in your browser, the approximate location (country, region, city) and the type of device, browser and operating system. Your IP address and the browser identification are used to derive this information and are not stored. To count visits, a pseudonymous identifier is formed from them that can no longer be recreated after two days at the latest. No cookies are set and nothing is stored on your device for this; your browser’s privacy settings (Do Not Track, Global Privacy Control), whether the browser reports that it is controlled by automation software, and the time you actively used the page are read. The legal basis is our legitimate interest in the needs-based design of our website (Art. 6(1)(f) GDPR).

Only with your consent does TrustAnalytics additionally record how you interact with our pages (for example clicks including their position on the page, scroll depth, the use of forms without the values you enter, downloads and events such as a sign-up or a purchase), further details of your device (screen and window size, time zone and, in some browsers, the exact operating system version and device model), technical measurements such as loading times and errors, and recordings of your visit in which everything you type is masked. With your consent, a cookie “trustanalytics” also recognises your browser on later visits for up to 12 months, and after you signed in your visits can be linked to your account. The legal basis is your consent (Art. 6(1)(a) GDPR and the national rules on storing information on your device), which you can withdraw at any time with effect for the future in our cookie settings.

The cookie “trustanalytics” also remembers your decision — a consent, a refusal or an objection — for up to 12 months so that the next page respects it. You can object to the measurement at any time (Art. 21 GDPR): [Object to analytics on this website]. The data is deleted after [your retention].

Haftungsausschluss: Nachstehend finden Sie einen möglichen Textvorschlag. Er dient nur der Orientierung und ist keine rechtsverbindliche Beratung. Passen Sie ihn an Ihre Einstellungen, Ihre Rechtsgrundlage und Ihre Speicherdauer an — lassen Sie weg, was Sie abgeschaltet haben oder nicht nutzen, und verschieben Sie, was Sie auf Always gestellt haben, aus dem Einwilligungsabsatz in den ersten — und lassen Sie ihn gegebenenfalls von einem Rechtsberater Ihrer Wahl prüfen.

TrustAnalytics (Webanalyse)

Wir verwenden „TrustAnalytics“ (www.trustcomponent.com) auf unserer Website, um zu verstehen, wie sie genutzt wird, und um sie zu verbessern. TrustAnalytics ist ein Dienst der Trustcaptcha GmbH, München, Deutschland, die die Daten in unserem Auftrag auf Servern in der EU verarbeitet.

Bei jedem Seitenaufruf erfasst TrustAnalytics die aufgerufene Seite und ihren Titel, die verweisende Seite, die in Ihrem Browser eingestellte Sprache, den ungefähren Standort (Land, Region, Stadt) sowie die Art von Gerät, Browser und Betriebssystem. Ihre IP-Adresse und die Browserkennung werden verwendet, um diese Angaben abzuleiten, und nicht gespeichert. Um Besuche zu zählen, wird daraus eine pseudonyme Kennung gebildet, die spätestens nach zwei Tagen nicht mehr neu gebildet werden kann. Dafür werden keine Cookies gesetzt und keine Informationen auf Ihrem Gerät gespeichert; ausgelesen werden die Datenschutzeinstellungen Ihres Browsers (Do Not Track, Global Privacy Control), ob der Browser meldet, dass er von einer Automatisierungssoftware gesteuert wird, und die Dauer, in der Sie die Seite aktiv genutzt haben. Rechtsgrundlage ist unser berechtigtes Interesse an einer bedarfsgerechten Gestaltung unserer Website (Art. 6 Abs. 1 lit. f DSGVO).

Nur mit Ihrer Einwilligung erfasst TrustAnalytics zusätzlich, wie Sie mit unseren Seiten interagieren (zum Beispiel Klicks einschließlich ihrer Position auf der Seite, Scrolltiefe, die Nutzung von Formularen ohne die eingegebenen Werte, Downloads und Ereignisse wie eine Registrierung oder einen Kauf), weitere Angaben Ihres Geräts (Bildschirm- und Fenstergröße, Zeitzone und in manchen Browsern die genaue Betriebssystemversion und das Gerätemodell), technische Messwerte wie Ladezeiten und Fehler sowie Aufzeichnungen Ihres Besuchs, in denen alle Eingaben unkenntlich gemacht sind. Mit Ihrer Einwilligung erkennt außerdem ein Cookie „trustanalytics“ Ihren Browser bei späteren Besuchen für bis zu 12 Monate wieder, und nach einer Anmeldung können Ihre Besuche Ihrem Konto zugeordnet werden. Rechtsgrundlage ist Ihre Einwilligung (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG), die Sie jederzeit mit Wirkung für die Zukunft in unseren Cookie-Einstellungen widerrufen können.

Das Cookie „trustanalytics“ merkt sich außerdem Ihre Entscheidung — eine Einwilligung, eine Ablehnung oder einen Widerspruch — für bis zu 12 Monate, damit die nächste Seite sie beachtet. Sie können der Messung jederzeit widersprechen (Art. 21 DSGVO): [Der Analyse auf dieser Website widersprechen]. Die Daten werden nach [Ihre Speicherdauer] gelöscht.