Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Ahrefs is a B2B SEO platform used by marketing teams, agencies and SEO consultants to research keywords, audit backlinks, track rankings, monitor competitors and crawl their own sites. The Ahrefs SaaS is accessed at app.ahrefs.com by authenticated users. AhrefsBot is the public web crawler that powers the index. Ahrefs is headquartered in Singapore, with European and US users connecting through AWS.
Ahrefs is one of the most established SEO platforms, used by in house SEO teams, marketing agencies and search consultants to research keywords, audit backlinks, monitor rankings, perform technical site audits and benchmark competitors. The product is delivered as a B2B SaaS dashboard at app.ahrefs.com, accessed by authenticated users only. AhrefsBot, the public web crawler, indexes pages across the internet so the platform can return up to date data. Ahrefs also offers a privacy first Web Analytics product, but it is not commonly embedded on a typical European marketing website.
Within the Ahrefs SaaS, the company processes employee account information (email, role, two factor authentication settings), the URLs and keywords the user submits, the projects and reports they create, and access logs. AhrefsBot collects publicly accessible HTML, response headers, robots.txt, sitemap files and link graphs of the public web. The crawler honours robots.txt and a documented user agent (AhrefsBot/7.0). Ahrefs Web Analytics, when enabled, can record privacy first signals comparable to Plausible or Fathom.
Ahrefs is mostly a backend SaaS tool: it does not set cookies on the visitors of its customers websites and therefore does not trigger the ePrivacy consent rule for them. AhrefsBot crawling publicly accessible pages relies on legitimate interest under Article 6(1)(f) GDPR; webmasters can deny it via robots.txt. The SaaS data used by authenticated SEO professionals is processed under performance of a contract under Article 6(1)(b) GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Ahrefs Pte Ltd is headquartered in Singapore and operates on AWS with regions in the United States and Singapore. EU customer data accessed through the SaaS is therefore transferred outside the European Economic Area. Transfers rely on the Ahrefs Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and supplementary measures (TLS 1.3, encryption at rest, SOC 2 Type II, scoped access controls).
Sign the Ahrefs Data Processing Addendum, enable SSO and two factor authentication for the SaaS, restrict access to authorised users only, define a clear robots.txt that either allows or blocks AhrefsBot consistently with your stance on third party crawling, and document Ahrefs Pte Ltd as a processor in your record of processing activities. If you enable Ahrefs Web Analytics on a public website, treat it like any analytics tool and integrate it with the consent management platform if it deploys identifiers.
Websites using Ahrefs must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for using Ahrefs internally to audit your own website. A DPIA may be considered when Ahrefs is used to harvest competitor data at scale, when Ahrefs Web Analytics is deployed across EU customer websites with consistent identifiers or when sensitive industries (legal, health, public sector) export large data sets through the API.
Sample consent text
Our SEO team uses Ahrefs, a search engine optimisation platform operated by Ahrefs Pte Ltd (Singapore). Ahrefs is accessed by authenticated employees on app.ahrefs.com and is not embedded in our public website. The AhrefsBot crawler may access publicly available pages of our site under the rules defined in robots.txt.
Third-party domains contacted
ahrefs.comanalytics.ahrefs.comapp.ahrefs.comahrefs.comstatic.ahrefs.comahrefs.netahrefsbot.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ahrefs_analytics_id | first_party | 1 year | Ahrefs Web Analytics visitor identifier set under the publisher domain when cookie based mode is enabled. Allows cross visit attribution and conversion measurement. |
| ahrefs_sess | first_party | Session | Session level identifier used by Ahrefs Web Analytics to group page views into a single visit. Set only when cookie based mode is enabled. |
Ahrefs collects user analytics data — you legally need a consent banner. Try FlowConsent free.
AhrefsBot itself does not set cookies. The Ahrefs Web Analytics tag, in cookie based mode, sets the ahrefs_analytics_id first party cookie under the publisher domain. In cookieless mode the tag does not set any browser identifier and hashes the IP and user agent server side.
AhrefsBot does not require consent because it crawls only public content. Ahrefs Web Analytics in cookieless mode does not require consent under ePrivacy but still owes a transparency notice. The cookie based mode requires prior, freely given, specific, informed and unambiguous consent under Article 5(3) ePrivacy.
AhrefsBot relies on legitimate interest under Article 6(1)(f) GDPR with a robots.txt opt out. Ahrefs Web Analytics in cookieless mode typically also relies on legitimate interest. The cookie based mode relies on consent under Article 6(1)(a) GDPR.
Yes, partially. Ahrefs Pte. Ltd. is established in Singapore but runs application infrastructure on AWS in the United States and Europe. Standard Contractual Clauses are included in the Ahrefs DPA. AWS US regions are covered by the EU US Data Privacy Framework adequacy decision.
A DPIA is not required for AhrefsBot. It becomes recommended when Ahrefs Web Analytics is used in cookie based mode at scale, when integrated with CRM systems for visitor identification, or when used by sensitive verticals such as health or finance.
Sign the Ahrefs DPA, prefer cookieless mode for Ahrefs Web Analytics on EEA traffic, document the Singapore and US transfers, declare AhrefsBot processing in your privacy notice with a robots.txt opt out, and gate the cookie based mode behind your consent management platform.
EU based SEO alternatives include Sistrix (Germany), SEObserver (France), Yourtext.guru (France), Mangools (Slovakia), Seolyzer (France) and Babbar (France). Cookieless analytics alternatives include Plausible (Estonia), Matomo (Germany and New Zealand) and Pirsch (Germany).
If you use Ahrefs Web Analytics in cookieless mode, mention the analytics tag, its purpose and that no cookie is set. If you switch to cookie based mode, list ahrefs_analytics_id with its name, domain, duration and purpose. Document the transfer to Singapore and AWS US regions in the privacy notice and link to the Ahrefs privacy policy.
No. Ahrefs is a B2B SaaS tool accessed by authenticated employees on app.ahrefs.com. It does not set any cookies on the public websites of its customers. Cookies are only set inside the Ahrefs admin app for the authenticated user.
No. AhrefsBot accesses publicly available pages under legitimate interest under Article 6(1)(f) GDPR. Webmasters can disallow AhrefsBot in robots.txt or rate limit it. Consent is not the appropriate legal basis for impersonal crawling of public content.
Performance of a contract under Article 6(1)(b) GDPR for the Ahrefs SaaS used by authenticated employees. Legitimate interest under Article 6(1)(f) GDPR for AhrefsBot crawling. Consent under Article 6(1)(a) GDPR if Ahrefs Web Analytics is deployed on a public website with identifiers.
Ahrefs Pte Ltd signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR via its Data Processing Addendum. Supplementary measures include TLS 1.3 in transit, encryption at rest, SOC 2 Type II controls and scoped access for support and operations.
A DPIA is generally not required for internal use to audit your own website. A DPIA may be relevant when Ahrefs is used to harvest large competitive datasets through the API, when Ahrefs Web Analytics is deployed across many EU customer websites or when sensitive industries export large data sets.
Add a User-agent: AhrefsBot block in robots.txt with a Disallow: / rule. AhrefsBot honours robots.txt within roughly an hour of the rule being published. You can also block the documented IP ranges or return HTTP 403 to the user agent.
European or open source alternatives include SISTRIX (Germany), Searchmetrics (Germany), SEObserver (France), Babbar (France), Majestic (UK) and the open source crawler Screaming Frog (UK). Most teams combine an SEO platform with Google Search Console and Bing Webmaster Tools.
No specific cookie entry is needed because Ahrefs does not set cookies on your public website. You can mention Ahrefs Pte Ltd (Singapore) as a processor used internally by the SEO team and refer to the Ahrefs Privacy Policy if asked by visitors or regulators.