> Contentsquare digital experience analytics under GDPR: cookies, session replay, heatmaps, EU vs US cluster, DPF, DPIA triggers and a ready consent notice. > > Canonical: https://www.flowconsent.com/en/services/analytics/contentsquare Analytics # Contentsquare Analytics Contentsquare is a French digital experience analytics platform providing session recording, heatmaps, zone-based click analytics, AI-powered insights, and customer journey analysis. It records individual user interactions including mouse movements, clicks, scroll depth, and navigation paths. Under GDPR and CNIL guidelines, session recording and heatmap features constitute personal data processing requiring opt-in consent. Contentsquare is a leading player in experience analytics but carries significant GDPR compliance obligations due to the nature of behavioural recording. [Block Contentsquare until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 7 - Third-party domains 7 - Servers Contentsquare operates a multi region infrastructure. EU customers can choose the European cluster hosted on AWS Frankfurt and Ireland. North American customers run on AWS Virginia and Oregon. The choice is made during contract signature and recorded in the data processing addendum. Overview ## What does Contentsquare do? ## **What Contentsquare actually does** Contentsquare is a French digital experience intelligence (DXI) platform headquartered in Paris. Since the 2021 acquisition of Hotjar, the product range covers session replay (DOM mutation recording with PII masking), zone based heatmaps, scroll maps, click maps, customer journey analytics, friction detection and integrated user surveys. Contentsquare is positioned as the European challenger to Quantum Metric and FullStory. ## **Cookies and storage set by Contentsquare** The Contentsquare tag (uxa.js) writes the following first party cookies on the publisher domain: \_cs\_id (pseudonymous visitor identifier, 13 months under the CNIL recommendation), \_cs\_s (session counter, 30 minutes), \_cs\_c (consent flag, 13 months) and \_cs\_ex (excluded user opt out, 13 months). Session replay data is captured as DOM mutations with masked input fields and transmitted to the Contentsquare ingestion endpoint. The replay payload may contain page URL, viewport, scroll position, mouse coordinates and form values when the masking is not configured properly. ## **Lawful basis and consent** Consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) is required before loading the Contentsquare tag. Session recording, heatmap and behaviour analytics are excluded from the CNIL analytics exemption because they capture detailed visitor behaviour that exceeds simple visit counting. The EDPB guidelines 2/2023 confirm that session recording requires informed and granular consent. The publisher must therefore gate the uxa.js tag behind the analytics or behaviour category of its CMP and never preload it. ## **International data transfers and EU cluster** Contentsquare offers an EU only cluster hosted on AWS Frankfurt and Ireland, which keeps raw replays and analytics inside the European Economic Area. Customer support, R\&D and SRE access from Paris and Tel Aviv (Israel, adequacy decision of 2011). Contentsquare US Inc. is certified under the EU US Data Privacy Framework since 8 December 2023 and serves global customers that opt for the worldwide tier. The Contentsquare DPA includes the EU Standard Contractual Clauses (module 2) and an exhaustive list of sub processors. ## **Practical compliance checklist** Choose the EU cluster during onboarding to keep data inside the EEA. Mask every input, label and aria attribute that may contain personal data (CSS class cs-mask, attribute data-cs-mask, content security policy on names, emails, addresses, payment data, health data). Configure the replay sample rate proportionately to the legitimate need; the CNIL has fined organisations for excessive recording. Run a DPIA under GDPR art. 35 because session replay typically meets the systematic monitoring criterion. Document Contentsquare SAS and Contentsquare US Inc. in your records of processing (GDPR art. 30) and update the privacy notice. ## **Alternatives** Direct alternatives include Hotjar (same group), FullStory (US), Glassbox (Israel), Quantum Metric (US), Mouseflow (Denmark) and the open source Heatmap.js. For privacy first heatmap only options, Matomo Heatmaps and Plausible Web Vitals offer EU hosting without session replay. Compliance ## Contentsquare and the GDPR Contentsquare is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (GDPR art. 6(1)(a) and ePrivacy art. 5(3)) for session recording, heatmaps, scroll maps and any visitor identifier. Legitimate interest cannot be invoked because session recording captures detailed behaviour that exceeds the analytics exemption. - Risk level high - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, CNIL deliberation 2020 091, EDPB guidelines 03/2022 on deceptive design, TTDSG (Germany), LOPDGDD (Spain), LIL (France) ### Impact assessment (DPIA) A DPIA is recommended because Contentsquare captures session recordings, scroll heatmaps and interaction patterns that can constitute large scale behavioural monitoring. Document data masking, retention and the legal basis. ### Sample text for your banner > We use Contentsquare, a French digital experience analytics platform, to understand how visitors use this site. Contentsquare records masked session replays, scroll and click heatmaps, and aggregated journey analytics. Your data is processed on the Contentsquare EU cluster (AWS Frankfurt and Ireland). When you visit our site, a cookie named \_cs\_id stores a pseudonymous identifier for up to 13 months. Contentsquare runs only after you accept the analytics or behaviour category in our cookie preferences, and you can withdraw your consent at any time. Cookies and trackers ## What Contentsquare sets and contacts - Tracking method session\_recording\_heatmap\_javascript\_beacon - Server location Contentsquare operates a multi region infrastructure. EU customers can choose the European cluster hosted on AWS Frankfurt and Ireland. North American customers run on AWS Virginia and Oregon. The choice is made during contract signature and recorded in the data processing addendum. - Data transferred outside the EU Contentsquare SAS is headquartered in Paris. The EU cluster keeps customer data inside the European Economic Area. Contentsquare US Inc. operates the US cluster from Virginia and serves as a sub processor for global customers using the worldwide tier. Transfers to the United States rely on the EU US Data Privacy Framework certification of Contentsquare US Inc. and on the EU Standard Contractual Clauses. Customer support may access EU data from France and Israel under adequacy. ### Cookies set (7) | Name | Type | Duration | Purpose | | ------------ | --------------------------- | ---------- | --------------------------------------------------------------------------------------- | | \_cs\_id | First party (Contentsquare) | 13 months | Anonymous visitor identifier used to link sessions and replays. | | \_cs\_id | persistent | 13 months | Contentsquare unique visitor identifier for session recording and behavioural analytics | | \_cs\_s | First party (Contentsquare) | 30 minutes | Session cookie used to group page views into a single visit. | | \_cs\_s | session | Session | Contentsquare session identifier grouping interactions within a single user session | | \_cs\_ex | First party (Contentsquare) | 7 days | Cross domain identifier used when Contentsquare tracks multiple domains. | | \_cs\_optout | First party (Contentsquare) | 13 months | Records that the visitor has opted out of Contentsquare tracking. | | \_cs\_mk | First party (Contentsquare) | 7 days | Used by the marketing analytics module to attribute traffic sources. | ### Third-party domains contacted (7) - `contentsquare.net` - `contentsquare.com` - `contentsquare.com` - `t.contentsquare.net` - `uxa.io` - `cs.contentsquare.net` - `static.cdn.contentsquare.net` Questions ## Frequently asked questions about Contentsquare Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Contentsquare require GDPR consent? Yes. Contentsquare session recording, heatmaps, and behavioural analytics constitute personal data processing requiring opt-in consent under the ePrivacy Directive and CNIL guidelines. The Contentsquare tag must be blocked until analytics consent is given. ### What does Contentsquare record? Contentsquare records mouse movements, click positions, scroll depth, navigation paths, page views, and time spent on page elements. Session recordings capture the full visual replay of individual user sessions. Heatmaps aggregate interaction data across all visitors. ### Does Contentsquare capture form data? By default, Contentsquare can capture form interactions. This must be configured with comprehensive input masking to prevent capture of names, emails, passwords, payment data, or any sensitive information. Enable masking for all text inputs as a baseline configuration. ### Do I need a DPIA for Contentsquare? Yes. Session recording of all website visitors at individual level constitutes large-scale systematic monitoring of individuals, which is one of the specific triggers for a mandatory DPIA under GDPR Article 35. ### What legal basis applies to Contentsquare? Consent (Art. 6(1)(a)) is required. The CNIL has specifically addressed session replay tools as requiring consent. Legitimate interest cannot justify recording individual user sessions across an entire website. ### How do I configure Contentsquare for GDPR compliance? Enable comprehensive input masking. Exclude authenticated areas, payment pages, and sensitive content from recording. Set recording retention limits (30-90 days recommended). Restrict access to session recording features. Load only after analytics consent. Implement IP anonymisation. ### Does Contentsquare transfer data outside the EU? Contentsquare is a French company but operates global infrastructure. Verify with Contentsquare whether your account is configured for EU data residency. Sign the Contentsquare DPA which addresses any transfer mechanisms required. ### Are there GDPR-compliant alternatives to Contentsquare? EU-based session recording alternatives include Hotjar (EU region available), Microsoft Clarity (free, but US-hosted requiring SCCs), and Lucky Orange (US). For pure EU residency without US transfers, Hotjar with EU region is the most established alternative. ### What cookies does Contentsquare set? First party cookies \_cs\_id (visitor identifier, 13 months), \_cs\_s (session, 30 minutes), \_cs\_ex (cross domain, 7 days), \_cs\_optout (opt out flag, 13 months) and \_cs\_mk (marketing attribution, 7 days). ### Do I need consent for Contentsquare? Yes. Session replay, heatmaps and zoning are non essential analytics that process personal data through cookies. Prior consent under Art. 5(3) ePrivacy Directive is required. The CNIL specifically classifies session replay as a high impact technology that requires explicit consent. ### What is the legal basis? Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive). Legitimate interest is not appropriate because of the granular behavioural data collected. ### Does Contentsquare transfer data to the US? The core product runs on AWS in Ireland and Contentsquare offers an EU Sovereign region. The 2024 Heap integration may introduce US sub processors for product analytics; check the contract. Transfers are covered by EU SCCs and, where applicable, the EU US Data Privacy Framework. ### Do I need a DPIA for Contentsquare? A DPIA is recommended because session replay can produce large scale behavioural monitoring. Document the masking rules, retention period and the legal basis. ### How do I implement Contentsquare compliantly? Sign the DPA, block the script behind your CMP, enable strict masking, limit retention (90 to 180 days), document the processing in your Article 30 record, perform a DPIA and review each connected module separately. ### What are the alternatives to Contentsquare? Hotjar (Contentsquare group, EU), Smartlook (Czech Republic), FullStory (US), Mouseflow (Denmark), Microsoft Clarity (US, free), LogRocket (US), Piwik PRO (EU, includes heatmaps) and Matomo Heatmap & Session Recording (EU). ### How do I update my cookie policy for Contentsquare? List each Contentsquare cookie with purpose, retention and legal basis (consent). Mention the EU hosting, the masking rules and the link to Contentsquare's privacy policy. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Koala](https://www.flowconsent.com/en/services/analytics/koala) [Koala is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Koala supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Koala enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/koala) [Analytics](https://www.flowconsent.com/en/services/analytics/koala) · ### [Pubperf](https://www.flowconsent.com/en/services/analytics/pubperf) [Pubperf is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pubperf offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pubperf empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/pubperf) [Analytics](https://www.flowconsent.com/en/services/analytics/pubperf) · ### [OpinionBar](https://www.flowconsent.com/en/services/analytics/opinionbar) [OpinionBar is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. OpinionBar supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, OpinionBar enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/opinionbar) [Analytics](https://www.flowconsent.com/en/services/analytics/opinionbar) · ### [Perfmatters](https://www.flowconsent.com/en/services/analytics/perfmatters) [Perfmatters is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Perfmatters supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Perfmatters enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/perfmatters) [Analytics](https://www.flowconsent.com/en/services/analytics/perfmatters) · ### [WatchThemLive](https://www.flowconsent.com/en/services/analytics/watchthem) [WatchThem is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. WatchThem offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, WatchThem empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/watchthem) [Analytics](https://www.flowconsent.com/en/services/analytics/watchthem) · ### [Graphly](https://www.flowconsent.com/en/services/analytics/graphly) [Graphly is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Graphly offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Graphly empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/graphly) [Analytics](https://www.flowconsent.com/en/services/analytics/graphly) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)