> How Branch deep linking and attribution handles cookies, device data, and US transfers, plus how to deploy it in a GDPR and ePrivacy compliant way.
>
> Canonical: https://www.flowconsent.com/en/services/analytics/branch

Analytics

# Branch

Analytics

Branch is a mobile deep linking, attribution, and measurement platform. It builds links that route people between the web and native apps and measures installs, clicks, and conversions across channels and devices. To attribute these journeys it processes device identifiers, IP addresses, and device characteristics, often through probabilistic fingerprinting. For European websites and apps this makes Branch a marketing technology that requires prior consent.

[Block Branch until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [Analytics](https://www.flowconsent.com/en/services/analytics)

- Consent

  Analytics

- Prior consent

  Required

- Documented cookies

  3

- Third-party domains

  4

- Servers

  United States, EU data residency optional

Overview

## What does Branch do?

## What Branch is

Branch Metrics provides deep linking and mobile measurement. Its links open the right screen inside a native app when the app is installed and fall back to the web or an app store when it is not. On top of this routing, Branch attributes installs, re engagements, and conversions to the campaign, channel, or partner that produced them, giving marketing teams a unified view across web and mobile.

## Data and identifiers Branch collects

To match a click on one device or channel with a later install or conversion, Branch processes mobile advertising identifiers such as the Apple IDFA and the Google Advertising ID when they are available, the IP address, and a range of device characteristics including operating system, model, language, and screen attributes. When deterministic identifiers are missing, Branch can combine these signals into a probabilistic fingerprint. It also records the events your application sends, such as opens, purchases, and custom conversions.

## Cookies and storage on the web

On websites that use the Branch Web SDK or Journeys banners, Branch writes values to browser storage and cookies to keep a session consistent and to remember the originating link. These entries are not strictly necessary for the page to function, because they exist to support attribution and marketing measurement rather than the core content the visitor requested.

## GDPR and ePrivacy implications

Device identifiers, IP addresses, and fingerprints are personal data under the GDPR, and reading or writing information on a user device is regulated by the ePrivacy Directive. Because Branch is used for marketing attribution and can build cross device profiles, both frameworks apply. The controller must be able to demonstrate a valid legal basis and must inform users clearly about the processing in its privacy notice.

## Consent requirements

For attribution and fingerprinting the appropriate legal basis is consent. Consent must be requested before the SDK loads or sets any identifier, it must be freely given, specific, and informed, and it must be as easy to withdraw as to give. A consent management platform should gate the Branch SDK so that it initialises only after the visitor accepts the marketing category.

## Data transfers and practical compliance steps

Branch processes data in the United States, so transfers outside the European Economic Area must be covered by the EU US Data Privacy Framework or by Standard Contractual Clauses, and an EU data residency option can reduce exposure. In practice you should sign a data processing agreement with Branch, document the processing in your records, configure the SDK to defer until consent, set retention limits, and keep your cookie policy and privacy notice aligned with what Branch actually collects.

Compliance

## Branch and the GDPR

Branch is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

- Legal basis

  Consent (Art. 6(1)(a) GDPR)

- Risk level

  high

- Applicable regulations

  GDPR, ePrivacy Directive

### Impact assessment (DPIA)

Branch performs cross device and cross channel tracking and can use device fingerprinting for probabilistic attribution, so a data protection impact assessment is strongly recommended. Assess the scale of identifier collection, the combination of web and app data, the retention periods, and the transfers to the United States.

### Sample text for your banner

> We use Branch to understand how our links and campaigns lead to app installs and conversions. Branch may read device information and store identifiers for attribution. These technologies run only after you accept marketing cookies.

Cookies and trackers

## What Branch sets and contacts

- Tracking method

  JavaScript Web SDK, mobile SDK, server to server API, device fingerprinting

- Server location

  United States, EU data residency optional

- Data transferred outside the EU

  Data is processed by Branch Metrics Inc. in the United States. Transfers rely on the EU US Data Privacy Framework and on Standard Contractual Clauses. An EU data residency option is available on request.

### Cookies set (3)

| Name                     | Type      | Duration | Purpose                                                                                                            |
| ------------------------ | --------- | -------- | ------------------------------------------------------------------------------------------------------------------ |
| \_branch\_session        | Marketing | Session  | Maintains the Branch attribution session for the current visit so a click can be linked to later actions.          |
| \_branch\_session\_first | Marketing | 1 year   | Stores the first attribution session so the originating link can be matched to installs and conversions over time. |
| branch\_journeys\_shown  | Marketing | 1 year   | Records that a Branch Journeys smart banner has been displayed to avoid showing it repeatedly.                     |

### Third-party domains contacted (4)

- `api2.branch.io`
- `cdn.branch.io`
- `app.link`
- `bnc.lt`

Questions

## Frequently asked questions about Branch

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies and identifiers does Branch set?

On the web, Branch can store session values in cookies and browser storage to keep attribution consistent and remember the link a visitor arrived from. In mobile apps it reads advertising identifiers and device characteristics. None of these are strictly necessary, so they belong in the marketing category of your consent banner.

### Do I need consent to use Branch?

Yes. Branch is used for marketing attribution and can rely on device fingerprinting, which requires prior informed consent under the ePrivacy Directive and the GDPR. The SDK should load only after the visitor accepts marketing cookies.

### What is the legal basis for processing with Branch?

Consent under Article 6(1)(a) of the GDPR is the appropriate basis, because the processing serves marketing measurement rather than a strictly necessary purpose. Legitimate interest is generally not sufficient for cross device attribution that involves fingerprinting.

### Does Branch transfer data to the United States?

Yes. Branch Metrics is based in the United States and processes data there by default, so transfers must be covered by the EU US Data Privacy Framework or Standard Contractual Clauses. An EU data residency option is available to keep data within the region.

### Do I need a DPIA for Branch?

A data protection impact assessment is recommended because Branch performs systematic cross device tracking and may use fingerprinting. Document the categories of data, the scale, the retention, and the safeguards for international transfers.

### How do I implement Branch in a compliant way?

Gate the Branch SDK behind your consent management platform so it initialises only after marketing consent, sign a data processing agreement, limit retention, and disable any optional fingerprinting you do not need. Make sure your privacy notice describes the attribution clearly.

### Are there alternatives to Branch?

Alternatives include AppsFlyer, Adjust, Singular, and Kochava for attribution, as well as the first party measurement offered natively by Apple and Google. Each still processes device data, so the same consent rules apply.

### How do I update my cookie policy for Branch?

List the Branch cookies and storage entries with their purpose and duration, state that they are used for marketing attribution, name Branch Metrics as the recipient, and mention the United States transfer. Keep the entry in sync whenever you change your Branch configuration.

Same category

## More services: Analytics

[See the whole category](https://www.flowconsent.com/en/services/analytics)

### [PixelYourSite](https://www.flowconsent.com/en/services/analytics/pixelyoursite)

[PixelYourSite is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. PixelYourSite supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, PixelYourSite enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/pixelyoursite)

[Analytics](https://www.flowconsent.com/en/services/analytics/pixelyoursite)

·

### [OneStat](https://www.flowconsent.com/en/services/analytics/onestat)

[OneStat is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. OneStat supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, OneStat enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/onestat)

[Analytics](https://www.flowconsent.com/en/services/analytics/onestat)

·

### [SuperStats](https://www.flowconsent.com/en/services/analytics/superstats)

[SuperStats is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SuperStats offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SuperStats empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/superstats)

[Analytics](https://www.flowconsent.com/en/services/analytics/superstats)

·

### [Countly](https://www.flowconsent.com/en/services/analytics/countly)

[Countly is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Countly supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Countly enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/countly)

[Analytics](https://www.flowconsent.com/en/services/analytics/countly)

·

### [Acoustic Experience Analytics](https://www.flowconsent.com/en/services/analytics/acoustic-experience-analytics)

[Acoustic Experience Analytics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Acoustic Experience Analytics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Acoustic Experience Analytics empowers organizations to optimize strategy and maximize.](https://www.flowconsent.com/en/services/analytics/acoustic-experience-analytics)

[Analytics](https://www.flowconsent.com/en/services/analytics/acoustic-experience-analytics)

·

### [Clearbit Reveal](https://www.flowconsent.com/en/services/analytics/clearbit-reveal)

[Clearbit Reveal is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Clearbit Reveal offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Clearbit Reveal empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/clearbit-reveal)

[Analytics](https://www.flowconsent.com/en/services/analytics/clearbit-reveal)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)