Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
AvidTrak is a United States based call tracking and analytics provider. It uses dynamic number insertion to attribute inbound phone calls to marketing sources, and it can record and transcribe calls. AvidTrak processes phone numbers and call recordings, which can be sensitive, and it sets a first party cookie that ties a website visit to a phone call so that marketing performance can be measured.
AvidTrak is a call tracking and analytics provider based in the United States. It helps businesses understand which marketing campaigns, keywords and web pages generate inbound phone calls. To do this it uses dynamic number insertion, which means it swaps the phone number shown on a website depending on how the visitor arrived. AvidTrak can also record and transcribe the resulting calls so that teams can review conversations and measure conversions.
AvidTrak processes personal data including phone numbers, call recordings and call transcripts, alongside web analytics data such as the marketing source of a visit. Call recordings can reveal a great deal about a caller, so they are treated as sensitive in practice. On the website, AvidTrak sets a first party attribution cookie that links a visit to a later phone call. Because this cookie stores and reads information on the visitor device, it falls within the scope of the ePrivacy rules.
Under the GDPR, the website operator is normally the controller and AvidTrak acts as a processor for the analytics it performs on your behalf. The attribution cookie is not strictly necessary to deliver the website, so under article 5(3) of the ePrivacy Directive it requires consent before it is placed. Call recording adds a second layer, because recording a conversation and storing voice data needs its own lawful basis and, in most member states, callers must be told and asked before recording begins.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent should be obtained through a compliant consent banner before the attribution cookie is set and before tracked numbers are shown for analytics purposes. The consent must be freely given, specific, informed and as easy to withdraw as it is to give. For call recording, you should add a clear notice at the start of the call and give the caller a genuine way to object. Keep records that show when and how consent was collected.
Because AvidTrak is based in the United States, using it involves transferring personal data outside the European Economic Area. These transfers can rely on the EU US Data Privacy Framework where AvidTrak is certified, or on the EU Standard Contractual Clauses combined with a transfer impact assessment. Since call recordings are more sensitive than ordinary analytics, the transfer impact assessment should pay close attention to the risk of disclosure and to the safeguards in place.
In practice, block the AvidTrak attribution cookie until consent is given and connect it to your consent management platform. Describe the call tracking and the recording clearly in your privacy policy and cookie notice. Sign a data processing agreement with AvidTrak, define a sensible retention period for recordings and transcripts, and limit who can access them. Carry out a data protection impact assessment and review it whenever you expand the use of call data.
Websites using AvidTrak must obtain user consent under GDPR regulations.
DPIA considerations
AvidTrak records and transcribes phone calls and processes phone numbers, so a data protection impact assessment is strongly advisable. Assess the volume and sensitivity of call content, the lawful basis for recording, retention of recordings and transcripts, and transfers of this data to the United States. Document caller information notices and the consent mechanism for both the attribution cookie and the recording.
Sample consent text
We use AvidTrak to measure which marketing sources lead to phone calls. With your consent, AvidTrak sets a first party cookie and may display a tracked phone number, and calls may be recorded and transcribed for analytics. You can refuse or withdraw consent at any time.
Third-party domains contacted
avidtrak.comscripts.avidtrak.comcdn.avidtrak.comapp.avidtrak.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| at_visitor | first party | persistent, up to 1 year | Attribution cookie that ties a website visit to a later phone call |
| at_session | first party | session | Maintains the visitor session during dynamic number insertion |
| at_source | first party | persistent, up to 1 year | Stores the marketing source so calls can be attributed to a campaign |
AvidTrak collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Yes. On your website AvidTrak sets a first party attribution cookie that links a visit to a later phone call, so it can tell which marketing source generated the call. It may also use a short lived session cookie. Because these cookies are not strictly necessary, they require consent before being placed.
Yes. The attribution cookie needs consent under article 5(3) of the ePrivacy Directive, and the analytics processing of phone numbers needs a lawful basis under the GDPR. Call recording requires its own basis and a clear notice to callers. In practice you should obtain consent before any of this tracking begins.
The most appropriate basis is consent under article 6(1)(a) of the GDPR, paired with ePrivacy consent for the cookie. Call recording is usually based on consent as well, supported by a notice at the start of the call. You should document the chosen basis in your records of processing.
Yes. AvidTrak is based in the United States, so personal data including phone numbers and call recordings can be transferred there. These transfers should rely on the EU US Data Privacy Framework or on the EU Standard Contractual Clauses with a transfer impact assessment. Because recordings are sensitive, the assessment deserves extra care.
A data protection impact assessment is strongly advisable. AvidTrak records and transcribes calls and processes phone numbers, which can reveal sensitive information at scale. The assessment should examine the lawful basis, retention, access controls and the transfer to the United States.
Block the attribution cookie until the visitor consents and connect AvidTrak to your consent management platform. Add a recording notice at the start of calls and describe the tracking in your privacy policy. Sign a data processing agreement, set a retention period and restrict access to recordings.
Some call tracking tools host data in the European Union or offer reduced recording features, which can lower the transfer and sensitivity risk. You can also limit AvidTrak to attribution without recording where recording is not essential. The right choice depends on your need for call content and where you want data stored.
List the AvidTrak attribution cookie and any session cookie with their purpose and duration. Explain that calls may be recorded and transcribed and that data may be transferred to the United States. Keep the policy aligned with what your consent banner actually controls.