Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Actito is a European customer engagement and marketing automation platform built and hosted in Europe, with data centres in Belgium and France. It combines a customer database, multichannel campaigns and a website Goals tracking script that links email engagement to web visits through first party cookies. Because the platform is operated inside the European Economic Area, it offers a strong data residency position for organisations that want to keep personal data within the EU.
Actito is a European customer engagement and marketing automation platform that originated in Belgium and positions itself as a customer engagement solution made in Europe. It brings together a central contact database, multichannel campaign management across email, SMS and push, and a website tracking capability called the Goals module. The platform is widely used by retailers, financial services firms and other brands that run personalised, data driven marketing. A defining characteristic is that Actito operates its own European infrastructure, with data centres in Belgium and a server in Paris, which makes it attractive to organisations that prioritise European data residency. Marketers use it to unify customer profiles, orchestrate campaigns and measure how recipients respond across channels.
When the Goals tracking script is installed on a website, Actito sets a first party cookie that stores a unique identifier known as the actId, which links a visitor to a specific contact profile in the database. This cookie is typically generated when a recipient clicks a link in an Actito email for which goal tracking is enabled, and it can also be set through an external system to follow visitors who never clicked an email. The identifier allows page views and conversions to be attributed to a known contact, which is the basis of Actito behavioural reporting. In email, Actito relies on tracking pixels and tagged links rather than cookies to record opens and clicks. The combined effect is a profile that can contain contact details, campaign engagement history and website behaviour, all of which constitute personal data under the GDPR.
The actId cookie and the website Goals script are not strictly necessary to deliver a website, so under the ePrivacy Directive they require prior consent before they are placed on a visitor device. Because the identifier is linked to a named contact profile, the resulting processing is clearly within the scope of the GDPR and must rest on a valid lawful basis. Email open and click tracking that is tied to an identifiable individual is treated by several supervisory authorities as profiling that also needs consent. National rules such as the German TTDSG and the guidance issued by the French CNIL reinforce that non essential tracking must be opt in and must not run before a choice is made. Organisations therefore need to treat Actito website and email tracking as consent based processing and keep clear records of the choices their contacts make.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The Goals tracking script should be governed by a consent management platform so that it only fires after a visitor has accepted marketing or analytics cookies. In practice this means loading the Actito script through the tag manager or consent gate and blocking it by default until consent is recorded. The consent banner must appear on first page load, offer a genuine choice to refuse, and make withdrawing consent as easy as giving it. For email, contacts should have a clear way to opt out of behavioural tracking, which Actito supports through preference and consent handling. Keeping the consent state synchronised between the CMP and the campaigns ensures that tracking and profiling stop promptly when someone changes their mind.
Actito is a European company that processes customer data within its European infrastructure, with data centres in Belgium and a server in Paris, which means EU customers can generally keep personal data inside the European Economic Area. This is a meaningful advantage compared with platforms that route data through the United States, because it limits exposure to third country transfer requirements. Actito does operate a separate North American region for North American clients, so European organisations should confirm that their account is provisioned on a European region and that no processing is silently routed elsewhere. Any sub processors used for delivery or supporting services should be listed in the data processing agreement and checked for their location. Where every component stays in the EU, the transfer chapter of the GDPR becomes far simpler to satisfy.
Begin by signing a data processing agreement with Actito and confirming that your account runs on a European region. Inventory every place the Goals script is deployed and route it through your consent management platform so it stays blocked until consent is given. Update your cookie policy and privacy notice to describe the actId cookie, its purpose and its duration, and explain how email engagement is tracked. Configure preference and consent options so contacts can refuse or withdraw behavioural tracking, and verify that those choices propagate to live campaigns. Finally, document your lawful basis for each purpose, set sensible retention periods for engagement data, and review the configuration periodically as your campaigns and regulations evolve.
Websites using Actito must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is recommended where Actito is used for large scale behavioural tracking, cross channel profiling or scoring that informs automated marketing decisions. Assess the linkage between the website Goals script, the actId cookie and the central contact database, the retention of engagement histories, and the safeguards around the contact data store. Document the lawful basis for each processing purpose, the consent capture mechanism and the data subject rights workflow. EU hosting in Belgium and France reduces transfer risk, but confirm the contractual region and any sub processors before concluding the assessment.
Sample consent text
We use Actito to personalise our communications and to understand how you interact with our emails and website. With your consent, Actito places a first party cookie that links your visits to your contact profile so we can measure campaign performance and tailor offers. You can withdraw your consent at any time through our cookie settings or by contacting us.
Third-party domains contacted
actito.comactito.becdn.actito.becdn3.actito.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| actId | First party tracking cookie | Several months to one year | Stores a unique profile identifier set by the Goals tracking script so that website visits and conversions can be attributed to a known contact in the Actito database for campaign measurement. |
Actito places tracking cookies for advertising — comply with GDPR using FlowConsent.
Its Goals website tracking script sets a first party cookie that stores a unique identifier called the actId, which links page views to a specific contact profile and typically lasts several months. The cookie is usually created when a recipient clicks a link in an Actito email, although it can also be set through an external system. Email open and click tracking relies on pixels and tagged links rather than cookies.
Yes. The actId cookie and the website Goals script are not strictly necessary, so under the ePrivacy Directive prior consent is required before they are placed on a visitor device. Because the identifier is linked to a named contact, the linked profiling also needs consent under the GDPR. Email behavioural tracking tied to an identifiable person should likewise be consent based.
Consent under GDPR Article 6(1)(a) is the appropriate basis for website behavioural tracking, email open and click tracking and marketing profiling. Legitimate interest under Article 6(1)(f) may support core CRM record keeping where you have completed a documented balancing test. You should map each processing purpose to its own lawful basis and record that mapping.
Actito is a European platform that processes EU customer data within its European infrastructure in Belgium and France, so for properly provisioned EU accounts there is generally no transfer to the United States. It does run a separate North American region for North American clients, so confirm your account is hosted in a European region. Any sub processors should be listed in the data processing agreement and checked for their location.
A data protection impact assessment is recommended where Actito is used for large scale behavioural tracking, cross channel profiling or scoring that informs automated marketing decisions. Assess the linkage between the website script, the actId cookie and the central contact database, along with retention and security. EU hosting reduces transfer risk, but the profiling and scale factors are what usually trigger the need for an assessment.
Sign a data processing agreement, confirm a European region, and route the Goals script through your consent management platform so it stays blocked until consent is given. Update your cookie policy and privacy notice to describe the actId cookie and email tracking, and configure preference options so contacts can refuse or withdraw tracking. Verify that consent choices propagate to live campaigns and set sensible retention periods.
Other European marketing automation and customer engagement platforms with EU hosting include providers that offer similar database, campaign and tracking features while keeping data in the European Economic Area. Some organisations also use cookieless analytics tools alongside their email platform to reduce reliance on tracking cookies. The right choice depends on your data residency needs, channel mix and consent tooling.
List the actId first party cookie with its purpose and approximate duration, and explain that it links website visits to a contact profile for campaign measurement. Describe that email engagement is tracked through pixels and tagged links rather than cookies. Keep the policy aligned with what your consent management platform actually blocks and allows, and review it whenever your Actito configuration changes.