Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Semrush is a B2B SEO and content marketing platform used by marketing teams, agencies and consultants to research keywords, audit sites, track positions, monitor competitors and analyse PPC campaigns. Semrush is accessed by authenticated employees on semrush.com. SemrushBot crawls publicly available pages to feed the index. Semrush is a US listed company with a strong European presence in Cyprus.
Semrush is one of the leading SEO and content marketing platforms with more than 50 tools that span keyword research, backlink analysis, technical site audits, position tracking, content optimisation, social media management, local SEO and competitive intelligence. The product is delivered as a B2B SaaS dashboard at www.semrush.com, accessed by authenticated users only. SemrushBot, the public crawler, powers the indexed dataset. Semrush is publicly listed on the NYSE.
In the SaaS, Semrush processes employee account information (email, role, SSO claims, two factor authentication), URLs and keywords submitted by users, projects, reports and access logs. SemrushBot collects publicly accessible HTML, headers, robots.txt and sitemaps. The bot respects robots.txt and identifies itself with a documented user agent (SemrushBot, SemrushBot-SA, SemrushBot-BA). The Semrush dashboard itself uses authentication cookies, security cookies and product analytics cookies for logged in users.
Semrush is a backend SaaS tool: it does not set cookies on the visitors of customer websites and therefore does not trigger the ePrivacy consent rule for them. SemrushBot crawling public pages relies on legitimate interest under Article 6(1)(f) GDPR; webmasters can deny it via robots.txt. SaaS usage by authenticated marketing teams is processed under Article 6(1)(b) GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Semrush Holdings Inc. is established in the United States with operations in Cyprus and a global engineering team. SaaS workloads run on AWS with US and EU regions. Transfers rely on the Semrush Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework. Supplementary measures include TLS 1.3, encryption at rest, ISO 27001 and SOC 2 Type II controls.
Sign the Semrush Data Processing Addendum, enable SAML SSO and two factor authentication on the SaaS, restrict access to authorised employees, define explicit robots.txt rules for SemrushBot variants, document Semrush as a processor in your record of processing activities and mention Semrush Holdings Inc. and the US transfer in the privacy notice.
Websites using SEMrush must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for internal SEO usage of Semrush. A DPIA may be considered when Semrush is used to harvest competitor data at industrial scale via the API, when it is integrated with HR or sales tools that combine personal data or when sensitive sectors export bulk datasets.
Sample consent text
Our marketing team uses Semrush, an SEO and content marketing platform operated by Semrush Holdings Inc. (USA, with EU offices in Cyprus). Semrush is accessed by authenticated employees on semrush.com and is not embedded in our public website. The SemrushBot crawler may visit publicly available pages of our site according to the rules in robots.txt.
Third-party domains contacted
semrush.comstatic.semrush.comsemrushcdn.comsemrush.itSEMrush places tracking cookies for advertising — comply with GDPR using FlowConsent.
No. Semrush is a B2B SaaS tool accessed by authenticated employees on semrush.com. It does not deploy cookies on the public websites of its customers. Cookies are only set inside the Semrush dashboard for the authenticated user.
No. SemrushBot variants (SemrushBot, SemrushBot-SA, SemrushBot-BA) access public pages under legitimate interest under Article 6(1)(f) GDPR. Webmasters can disallow them in robots.txt. Consent is not the appropriate legal basis for impersonal crawling of public content.
Performance of a contract under Article 6(1)(b) GDPR for the Semrush SaaS used by authenticated employees. Legitimate interest under Article 6(1)(f) GDPR for SemrushBot crawling. Consent under Article 6(1)(a) GDPR if any Semrush widget that sets cookies is embedded on a public website.
Semrush signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR via its Data Processing Addendum and confirms participation in the EU US Data Privacy Framework. Supplementary measures include TLS 1.3 in transit, encryption at rest, ISO 27001 and SOC 2 Type II.
A DPIA is not required for internal SEO use. It may be relevant when Semrush is integrated with HR or sales tools that combine personal data, when it powers automation that targets identified EU users or when sensitive industries export bulk datasets through the API.
Add a User-agent: SemrushBot block in robots.txt with Disallow: /. Also add separate blocks for SemrushBot-SA, SemrushBot-BA and SiteAuditBot if you want to opt out of every crawl. Semrush honours robots.txt within a few hours.
European or open source alternatives include SISTRIX (Germany), Searchmetrics (Germany), SEObserver (France), Babbar (France), Majestic (UK) and Screaming Frog (UK). Most teams combine an SEO platform with Google Search Console and Bing Webmaster Tools.
No specific cookie entry is needed because Semrush does not set cookies on your public website. Mention Semrush Holdings Inc. (USA, with EU offices in Cyprus) as a processor used internally by the SEO team and link to the Semrush Privacy Policy.