Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
CallTrackingMetrics is a United States based call tracking and contact center platform that ties each inbound call, text or form to the marketing source, campaign and keyword.
CallTrackingMetrics is a United States based call tracking and contact center platform. Using dynamic number insertion it shows unique phone numbers to visitors and ties each inbound call, text or form to the marketing source, campaign and keyword. It also offers call recording, routing and conversation analytics.
CallTrackingMetrics sets cookies that hold a visitor identifier and session information so a phone call can be attributed to a web journey. It processes caller numbers, call duration, location and, if enabled, recorded audio and transcripts. This joins online behaviour with offline contact data.
The attribution cookies are non essential and trigger the ePrivacy consent requirement, while the call data and recordings are personal and sometimes sensitive. Because the vendor is in the United States, the processing also involves an international data transfer. Together these make CallTrackingMetrics a higher risk activity for an EU audience.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Obtain prior consent before the CallTrackingMetrics script runs, since the identifiers are not strictly necessary. Where calls are recorded, inform callers at the start of the call and rely on a valid basis, normally consent. Provide an easy way to decline tracking and to object to recording.
Data is processed in the United States, so you must put a transfer mechanism in place such as the EU US Data Privacy Framework or standard contractual clauses, with a transfer impact assessment. Document the safeguards, sign the data processing agreement and disclose the transfer in your privacy policy.
Load the tag only after consent, enable IP and data minimisation options, and set short retention for recordings and transcripts. Configure a caller recording notice, verify your transfer paperwork, and keep your records of processing and cookie policy aligned with both web and telephony data.
Websites using CallTrackingMetrics must obtain user consent under GDPR regulations.
DPIA considerations
Linking online identifiers to calls and recordings, together with a transfer to the United States, points to higher risk. A DPIA is usually required to document the data flows, retention and safeguards.
Sample consent text
We use CallTrackingMetrics to understand which marketing source led to your call. With your consent we set an attribution identifier; calls may be recorded and you will be informed beforehand.
Third-party domains contacted
calltrackingmetrics.comapp.calltrackingmetrics.comtctm.coCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __ctmid | Marketing | 1 year | Stores a visitor identifier used to attribute a later phone call, text or form to the originating web source and campaign. |
| ctm_session | Analytics | 30 minutes | Tracks the current browsing session so it can be matched to an incoming call. |
CallTrackingMetrics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
It sets a visitor identifier and session cookies so an inbound call can be attributed to the web source and campaign. These are non essential marketing and analytics cookies, not strictly necessary ones.
Yes. The attribution cookies need prior consent, and any call recording requires its own valid basis and a caller notice. Do not load the script before consent is given.
The tracking identifiers rely on consent (Art. 6(1)(a) GDPR). Call recording also depends on consent or another appropriate basis, combined with clear information to the caller.
Yes. The vendor is United States based, so the processing is an international transfer that requires a mechanism such as the EU US Data Privacy Framework or standard contractual clauses and a transfer impact assessment.
Usually yes. Linking online identifiers with calls and recordings, plus a transfer to the United States, points to higher risk, so a DPIA helps document the flows, retention and safeguards.
Gate the script behind consent, minimise captured data, set short retention for recordings, and add a caller notice. Confirm your transfer mechanism and reflect both web and call processing in your documentation.
Alternatives include CallRail, Dexem, Ringover and Invoca. For EU audiences, vendors that host within the European Union can simplify the transfer position.
List the CallTrackingMetrics cookies with their purpose and duration, and describe call recording and the United States transfer in your privacy notice. Review whenever you change tracking or recording settings.