Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Microsoft Application Insights is an application performance monitoring service that collects browser telemetry including page views, performance metrics, exceptions and custom events via a JavaScript SDK, sending data to Azure.
Microsoft Application Insights is the application performance monitoring feature of Azure Monitor. Its browser JavaScript SDK is embedded in a website and automatically collects telemetry covering page views, page load and AJAX performance, JavaScript exceptions and custom events. Each telemetry item is correlated to a user and a session using cookies, and the data is sent to an Azure ingestion endpoint in the region chosen during resource creation.
The SDK sets three cookies by default. The ai_user cookie persists for one year and holds a randomly generated user identifier. The ai_session cookie expires after 30 minutes of inactivity and identifies the current browsing session. The ai_authUser cookie is set only when the website supplies an authenticated user identifier. Beyond cookies, the SDK collects the visitor IP address, browser user agent, screen resolution, referrer URL and the full URL of each page visited. When cookieless mode is enabled the ai_user and ai_session cookies are not set, though an in-memory session identifier is still used.
Under the ePrivacy Directive, storing or reading cookies on a user's device requires prior informed consent unless the cookie is strictly necessary. The ai_user and ai_session cookies are analytics cookies and are not strictly necessary, so consent is required before the SDK initialises. Under GDPR, the IP address and telemetry constitute personal data. The legal basis for processing is consent under Article 6(1)(a). If the SDK is used to track authenticated users, additional considerations under Article 9 may apply if health or other special category data can be inferred.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent must be obtained before the Application Insights JavaScript snippet is executed. The SDK supports a cookieless mode and a disableCookiesUsage flag so that it can be initialised after consent is given, or run without cookies at all if the user declines analytics. Your consent management platform should block the snippet by default and release it only when the user opts in to the analytics category.
If the Azure Monitor workspace is located in a US region, or if Microsoft support engineers access data from the United States, telemetry including IP derived geolocation and user identifiers is transferred to a third country. Microsoft relies on the EU US Data Privacy Framework and standard contractual clauses as the legal transfer mechanism. Operators should configure their Azure resource to an EU region and verify the data residency settings to minimise cross-border transfers.
Block the Application Insights snippet via your consent management platform until analytics consent is granted. Configure the SDK with cookieless mode as a fallback for users who decline. Set the Azure Monitor workspace to an EU region to limit data transfers. Define a data retention period in Azure Monitor that matches your stated privacy policy. Document Application Insights in your Records of Processing Activities and update your cookie policy and privacy notice to describe the telemetry collected.
Websites using Microsoft Application Insights must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA should be considered when Application Insights is used to monitor authenticated user journeys or when cross-session profiling is enabled, as telemetry including user identifiers and IP addresses may be transferred to Microsoft in the United States. Assess the volume of personal data collected, the retention period configured in Azure Monitor, and whether cookieless mode is activated to reduce risk.
Sample consent text
We use Microsoft Application Insights to monitor the performance of this website and to understand how you use it. Application Insights places cookies on your device and sends telemetry data including your approximate location, browser type and the pages you visit to Microsoft Azure. You can withdraw your consent at any time.
Third-party domains contacted
js.monitor.azure.comdc.services.visualstudio.com*.in.applicationinsights.azure.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ai_user | Analytics | 1 year | Randomly generated user identifier used to correlate telemetry events to the same anonymous user across sessions |
| ai_session | Analytics | 30 minutes | Session identifier used to group telemetry events that occur within the same browsing session |
| ai_authUser | Analytics | Session | Stores the authenticated user identifier provided by the website when a logged-in user identifier is supplied to the SDK |
Microsoft Application Insights places tracking cookies for advertising — comply with GDPR using FlowConsent.
Application Insights sets three cookies by default. The ai_user cookie (1 year) holds a randomly generated user identifier. The ai_session cookie (30 minutes) identifies the current browsing session. The ai_authUser cookie is set only when your website supplies an authenticated user identifier. All three can be disabled using the SDK cookieless mode or the disableCookiesUsage flag.
Yes. The ai_user and ai_session cookies are analytics cookies and are not strictly necessary. Under the ePrivacy Directive, consent must be obtained before those cookies are set. You should block the Application Insights snippet via your consent management platform and only release it after the user opts in to the analytics category.
The legal basis is consent under Article 6(1)(a) of the GDPR for the analytics cookies and telemetry. Consent must be freely given, specific, informed and unambiguous. If you use Application Insights only for strictly necessary performance monitoring without cookies and with anonymised IP, a case for legitimate interest under Article 6(1)(f) may be arguable, but consent remains the safest basis.
It depends on your Azure region configuration. If your Azure Monitor workspace is in a US region, or if Microsoft support staff access data from the United States, telemetry including IP-derived geolocation and user identifiers is transferred to the US. Microsoft relies on the EU US Data Privacy Framework and standard contractual clauses. To minimise transfers, configure your workspace in an EU region.
A DPIA is recommended if Application Insights is used to track authenticated users across sessions, if it is deployed on a high-traffic site processing large volumes of personal data, or if the Azure workspace is in a US region. The combination of persistent user identifiers, IP addresses and potential US transfers raises the risk level. If you enable cookieless mode, anonymise IPs and restrict the workspace to the EU, a DPIA may not be mandatory.
Block the JavaScript snippet via your consent management platform until analytics consent is granted. Use the SDK disableCookiesUsage flag or cookieless mode as a fallback for users who decline. Enable IP anonymisation in the SDK configuration. Set the Azure Monitor workspace to an EU region. Define a data retention period aligned with your privacy notice. Document Application Insights in your Records of Processing Activities.
Yes. Server-side analytics platforms such as Plausible Analytics, Fathom Analytics and Matomo (self-hosted) can provide performance metrics without setting persistent user cookies and with IP anonymisation by default. These reduce or eliminate the need for consent under the ePrivacy Directive and lower the risk of cross-border data transfers. Azure Monitor can also be used purely on the server side without the browser SDK.
Your cookie policy should list ai_user (duration 1 year, purpose analytics user identifier), ai_session (duration 30 minutes, purpose session identifier) and ai_authUser (duration session, purpose authenticated user identifier). Describe the data controller as Microsoft Corporation, the purpose as website performance monitoring, and the legal basis as consent. Reference the US data transfer safeguards if your Azure workspace is not in the EU.