Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
CallRail is a US-based call tracking and analytics platform that uses Dynamic Number Insertion (DNI) to swap phone numbers on websites and attribute calls to marketing campaigns. It records calls, processes caller phone numbers (personal data), and sets tracking cookies. It carries high privacy risk for European operators due to call recording, US data storage, and multi-party consent obligations.
CallRail is a US-based call tracking and analytics platform used by marketers to attribute phone enquiries to specific campaigns, keywords, and referral sources. When a visitor lands on a website where CallRail''s JavaScript snippet (served from cdn.callrail.com) is active, the script replaces the static phone numbers displayed on the page with session-specific tracking numbers. When the visitor calls that number, CallRail routes the call to the business''s real number and logs the call event, linking it to the visitor''s browsing session, the referring URL, campaign parameters, and device data.
CallRail also optionally records the full audio of calls and produces transcripts. Recordings are stored on CallRail''s US servers. The combination of call attribution, session cookies, and call recording makes CallRail one of the highest-risk tracking tools from a European data protection perspective.
CallRail sets persistent and session cookies to assign each visitor a unique session identifier. This identifier is stored alongside call event data, allowing CallRail to report on which campaign or keyword triggered a call. Personal data collected includes: caller phone numbers (a direct personal identifier), call duration, call timestamps, call recordings and their transcripts, the visitor''s IP address, device and browser data, referring URL and UTM parameters, and any form-fill data if CallRail''s form tracking is enabled.
Under GDPR, phone numbers are personal data and call recordings almost certainly contain personal data, potentially including sensitive information volunteered by callers. The website operator is the data controller and CallRail acts as a data processor. A Data Processing Agreement must be in place. Under the ePrivacy Directive, cookies used to track visitor sessions and attribute calls to campaigns are not strictly necessary and require prior consent. Call recording introduces a further consent layer: most EU member states require that at least the caller is informed at the start of a call that it will be recorded, and some require explicit two-party consent before recording commences.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
This is the most critical compliance element for CallRail. Recording telephone conversations without the knowledge and consent of the parties involved is illegal in most EU member states and is a criminal offence in several jurisdictions. At minimum, callers must be informed at the outset of the call that the conversation will be recorded. Many operators implement an automated IVR announcement such as ''This call may be recorded for quality and training purposes.'' However, in jurisdictions requiring active consent, callers must be offered the option to refuse recording. Operators must also ensure that call recordings are not retained longer than necessary and that access is restricted to authorised personnel only.
All call tracking data, caller phone numbers, session data, and call recordings are stored on CallRail''s servers in the United States. This is an international transfer of personal data subject to GDPR Chapter V requirements. The transfer should be covered by the EU-US Data Privacy Framework if CallRail is certified, supplemented by Standard Contractual Clauses. Given the sensitivity of call recordings (which may include sensitive personal disclosures), the residual risk of US government access under surveillance laws should be addressed in your DPIA. Verify CallRail''s DPF certification status before relying on it as your sole transfer mechanism.
To deploy CallRail compliantly in Europe: conduct and document a DPIA before deployment; sign CallRail''s Data Processing Agreement; configure your CMP to block CallRail''s JavaScript until cookie consent is obtained; implement an automated call-recording announcement on all tracked numbers; verify and document the transfer mechanism (DPF or SCCs) for US transfers; set strict data retention limits for call recordings in CallRail''s admin settings; add CallRail to your privacy policy and cookie notice; audit integration with any CRM or advertising platforms that receive call data; and train staff who access call recordings on their data protection obligations.
Websites using CallRail must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended and may be mandatory for CallRail deployments targeting EU data subjects. CallRail processes phone numbers (personal data), call recordings (which may reveal sensitive personal data through conversation content), and links this to detailed behavioural session tracking. The combination of session cookies, DNI tracking, call recordings, caller identification, and US data transfers creates a high-risk processing profile. Additional risk factors include: call recordings may contain special-category data disclosed voluntarily by callers; many EU member states require explicit two-party consent before a call is recorded; integration with advertising platforms (Google Ads, Meta) creates further profiling risk. Document necessity, proportionality, risk mitigation (e.g., opt-in recording announcements), and data minimisation measures.
Sample consent text
We use CallRail call tracking on this website. CallRail temporarily replaces the phone numbers displayed on this page with unique tracking numbers to help us understand which marketing channels generate enquiries. Calls may be recorded for quality and training purposes. By continuing to use this website, you consent to CallRail setting tracking cookies to associate your browsing session with any call you make. If you proceed to call, you will be informed that the call is being recorded and your consent will be obtained at that point. You can opt out of session tracking via our cookie settings at any time. Call recordings and session data are processed by CallRail in the United States under the EU-US Data Privacy Framework.
Third-party domains contacted
callrail.comcdn.callrail.comapp.callrail.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _cr_session | tracking | Session | CallRail session identifier that ties the visitor's current browsing session to any call event generated from this website visit |
| _cr_visitor | tracking | 2 years | Persistent visitor identifier used by CallRail to recognise returning visitors and attribute repeated calls to previous campaign sources |
| _cr_campaign | tracking | 30 days | Stores the campaign, keyword, and referral source associated with the visitor's session for call attribution reporting in CallRail's dashboard |
| _cr_referrer | tracking | 30 days | Records the HTTP referrer and UTM parameters of the visitor's session to enable multi-touch attribution of calls to their originating ad or organic source |
| _calltrk_refer | tracking | 1 year | Long-term referral tracking cookie that persists the original acquisition source across multiple sessions for cross-session call attribution |
CallRail collects user analytics data — you legally need a consent banner. Try FlowConsent free.
CallRail sets persistent and session cookies to assign each website visitor a unique session identifier. This identifier is associated with any call the visitor makes to a CallRail-tracked number, allowing campaign attribution. CallRail collects the caller's phone number, call duration, call recording audio and transcripts, the visitor's IP address, referring URL, UTM parameters, and device data. Phone numbers are personal data under the GDPR.
Yes, consent is required on two levels. First, the ePrivacy Directive requires prior consent for the session-tracking cookies that CallRail sets to associate browsing sessions with call events, as these are not strictly necessary. Second, if call recording is enabled, European law requires that callers be informed before the call begins that it will be recorded, and in some EU member states explicit call recording consent from both parties is required. Neither cookie consent nor call recording consent is optional for EU audiences.
Consent (Article 6(1)(a) GDPR) is the most appropriate legal basis for CallRail's session-tracking cookies and for call recordings. Legitimate interest (Article 6(1)(f)) might theoretically apply to basic call attribution without recording, but given the high-risk nature of phone number processing and the availability of less intrusive alternatives, consent is the safer basis. A Data Processing Agreement with CallRail is mandatory regardless of the legal basis chosen, as CallRail processes data on behalf of the operator.
Yes. CallRail is headquartered in Atlanta, Georgia, and all call recordings, caller phone numbers, session data, and analytics are stored on CallRail's US servers. This constitutes an international transfer under the GDPR. The transfer mechanism is the EU-US Data Privacy Framework (DPF) where CallRail is certified, supplemented by Standard Contractual Clauses. Because call recordings can contain sensitive personal disclosures, the residual risk from US government surveillance laws should be specifically assessed in your Data Protection Impact Assessment.
A DPIA is strongly recommended and will often be mandatory. CallRail falls into multiple high-risk categories under GDPR Article 35: it processes personal data (phone numbers), it records communications (call recordings that may include sensitive data), it uses systematic tracking (session cookies combined with call attribution), and it transfers data to a third country (the US). Regulatory guidance in several EU member states specifically flags call recording and telephone tracking as requiring a DPIA. Document your assessment before deployment.
Complete a DPIA before deploying CallRail. Sign and retain CallRail's Data Processing Agreement and the applicable SCCs for US transfers. Configure your CMP to block CallRail's JavaScript snippet (cdn.callrail.com) until cookie consent is obtained. If recording is enabled, configure all tracked numbers to play an automated announcement at call start informing callers that the call will be recorded. Set retention limits for call recordings in CallRail's settings. Add CallRail to your privacy policy and cookie notice, listing it as a US processor. Train staff who access recordings on data protection obligations.
EU-hosted call tracking alternatives with better data residency include Aircall (French company, EU data centre options), Ringba (offers data region selection), and Nimbata (European-oriented). For businesses willing to reduce tracking sophistication, configuring separate published phone numbers per channel (without dynamic insertion) eliminates cookies and recording concerns while still providing basic attribution. This approach has no cookie or consent requirements beyond informing callers of recording if applicable.
Your cookie policy must list CallRail's session tracking cookies including names, type (tracking), duration, purpose (call attribution), and the entity setting them (callrail.com, cdn.callrail.com). Your privacy policy must include a section on call tracking and call recording: explain that CallRail swaps phone numbers to attribute calls, that calls may be recorded, the legal basis for recording (consent), how long recordings are retained, and that data is transferred to the US under the DPF and SCCs. Provide contact details for data subject rights requests related to call recordings.