Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Decibel Insight, now part of Medallia, is a digital experience analytics platform that captures session replays, mouse movements, scrolling, clicks, form interactions and rage clicks to compute a Digital Experience Score (DXS). It sets persistent tracking cookies and transmits detailed behavioural data to Medallia's US cloud infrastructure. Because session replay can capture personal data including sensitive form field content, this constitutes high-risk processing under GDPR Article 35. Explicit consent is required before the Decibel tag may load, and a DPIA is mandatory.
Decibel Insight, acquired by Medallia Inc. in 2021, is a digital experience analytics platform whose JavaScript tag is loaded on publisher or e-commerce pages to capture a detailed record of every user's interaction with the page. The tag records mouse movements, cursor position, scrolling velocity and depth, click and tap events, hover dwell times, rage clicks (repeated rapid clicks indicating frustration), dead clicks (clicks on non-interactive elements) and form field interactions including focus, blur and text input events. This data is streamed to Medallia's cloud infrastructure and reconstructed as a session replay: a video-like playback of exactly what each user did during their visit.
Decibel also computes a proprietary Digital Experience Score (DXS) for each session, aggregating interaction signals into a numeric score that rates the quality of the user's experience. DXS scores are used to segment sessions, prioritise UX fixes and trigger automated alerts. Because the data captured is extraordinarily granular and may include personal data entered into forms, Decibel constitutes one of the highest-risk analytics tools in common web use.
Decibel sets persistent tracking cookies on decibelinsight.net to identify returning users and associate sessions with the same browser over time. The primary session cookie stores a pseudonymous visitor identifier; additional cookies record session metadata including page sequences, DXS scores and replay session identifiers. The data transmitted to Medallia's servers includes: full DOM snapshots and mutation records (enabling replay), mouse coordinate streams, scroll position time-series, click event data with target element identifiers, form interaction events (which may capture input values if masking is not correctly configured), viewport dimensions, browser and OS metadata, IP address and page URL sequences.
Session replay is categorised as high-risk processing under GDPR. The capture of detailed interaction data, form content and potentially special-category personal data (health, financial or authentication data entered into forms) triggers multiple risk factors under Article 35. The EDPB Opinion 8/2023 on facial recognition and subsequent DPA guidance confirm that session replay tools capturing form content require a mandatory DPIA. The ePrivacy Directive Article 5(3) requires prior consent before the Decibel tag may access or store anything on the user's device. Legitimate interest cannot justify this scope of data capture for analytics purposes, as confirmed by several national DPA enforcement actions against session replay deployments.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent must be obtained before the Decibel JavaScript tag initialises. The consent notice must accurately describe the nature of session replay (recording mouse movements, clicks and form interactions), identify Medallia Inc. as the US-based processor, disclose the international transfer and specify the retention period. The CMP must technically block the Decibel tag until consent is confirmed. Consent cannot be bundled with other analytics consents: the session replay disclosure must be specific enough that users understand they are consenting to a recording of their behaviour, not just anonymous page statistics.
Medallia Inc. is headquartered in San Francisco, California, and all session replay data captured by Decibel is processed on Medallia's cloud infrastructure, which includes US-based servers. Transfers of personal data from the EEA to the US rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). The DPIA must assess the adequacy of these safeguards for the specific sensitivity of session replay data. Additionally, the California Consumer Privacy Act (CCPA) applies to California-resident users, and publishers must ensure Medallia's role as a service provider is correctly defined to avoid CCPA sale-of-data implications.
To deploy Decibel in a GDPR-compliant manner, organisations must: (1) complete a comprehensive DPIA approved by the DPO before go-live; (2) technically block the Decibel tag until explicit consent is obtained via a clearly worded CMP notice that describes session replay; (3) configure Decibel's masking to ensure all sensitive form fields (passwords, payment data, health data, authentication fields) are masked before data leaves the browser; (4) sign a Data Processing Agreement with Medallia covering EU SCCs and DPF safeguards; (5) update the privacy policy and cookie notice to accurately describe session replay, the DXS profiling output, the US transfer and the 90-day retention period; (6) implement a functional consent withdrawal mechanism that stops future recording; (7) establish a process for responding to data subject access requests for session recordings; and (8) conduct annual DPIA reviews and verify Medallia's DPF certification status.
Websites using Decibel (Medallia) Digital Experience Analytics must obtain user consent under GDPR regulations.
DPIA considerations
A mandatory Data Protection Impact Assessment is required before deploying Decibel Insight. Session replay is explicitly identified by the EDPB and national DPAs as a high-risk processing activity requiring a DPIA under GDPR Article 35(3)(a) (automated processing producing significant effects) and Article 35(3)(b) (large-scale processing of personal data). The DPIA must comprehensively address: (1) the full scope of data captured by session replay, including mouse movements, keystrokes, form field content (including potential special-category data such as health information entered in forms), click sequences and scroll depth; (2) the Digital Experience Score (DXS) as an automated profiling output and its use in decision-making about UX changes; (3) the risks that masking configurations fail and sensitive form fields are captured unmasked, particularly on checkout, health, financial or authentication pages; (4) the transfer of all session replay data to Medallia Inc. in the US and the adequacy of SCC and DPF safeguards; (5) data retention periods for session recordings (often 90 days or more); (6) data subject rights including the right to erasure of session recordings; (7) the fact that session replay may capture third-party content or inadvertently record other users on shared devices; (8) the adequacy of Medallia's security measures to protect highly sensitive session data; (9) consent mechanisms ensuring the Decibel tag is technically blocked until valid consent is obtained; and (10) the CCPA implications for US visitors. The DPO must approve the DPIA before go-live. Annual reviews are required.
Sample consent text
We use Decibel Insight, a digital experience analytics service provided by Medallia Inc. (United States), to record and replay your session on this website, including mouse movements, clicks, scrolling and form interactions. This recording helps us understand how users experience our website and improve its design. Session recordings may capture personal data you enter on this site. We use technical safeguards to mask sensitive fields, but you should be aware that your interaction data will be stored and processed by Medallia in the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework. This processing is based solely on your consent. You can withdraw your consent at any time via our privacy settings, which will stop future session recording. Previously recorded sessions may be retained for up to 90 days.
Third-party domains contacted
decibelinsight.netcdn.decibelinsight.netapi.decibelinsight.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| di_visitor_id | persistent | 90 days | Primary pseudonymous visitor identifier set by Decibel on decibelinsight.net; associates multiple page views and sessions with the same browser for session replay and DXS computation |
| di_session_id | session | Session | Session-level identifier linking page views within a single browsing session for Decibel session replay assembly and replay stitching |
| di_dxs | persistent | 30 days | Stores the most recent Digital Experience Score (DXS) computed for this visitor, used to segment users into experience quality cohorts and trigger UX alerts |
| di_consent | persistent | 365 days | Records the consent state for Decibel session replay; prevents the replay tag from reinitialising if the user has previously withdrawn consent |
| di_replay_ref | persistent | 90 days | Reference token linking browser-side interaction capture to the server-side session replay recording stored in Medallia cloud infrastructure |
| di_ab_bucket | persistent | 30 days | A/B test and sampling-rate allocation cookie used by Decibel to select which sessions are sampled for full replay recording versus summary-only capture |
Decibel (Medallia) Digital Experience Analytics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Decibel sets persistent tracking cookies on the decibelinsight.net domain to identify returning users and associate multiple page views with the same visitor over time. The primary cookie stores a pseudonymous visitor identifier; companion cookies store session metadata including the DXS score, page sequence identifiers and replay session references. These cookies are not used for cross-site advertising but do enable Decibel to link behaviour across multiple pages within the same site and across return visits, which constitutes personal data processing under GDPR.
Yes, explicit consent is mandatory. Decibel captures highly detailed personal data including mouse movements, form interactions and potentially the content of what users type into forms. The ePrivacy Directive Article 5(3) requires prior consent before the Decibel tag may access or write to the user's device. GDPR requires a valid legal basis for processing personal data of this sensitivity. Legitimate interest is not available for session replay tools of this scope: multiple European DPAs have taken enforcement action against session replay deployments without consent. The Decibel tag must be technically blocked until consent is confirmed.
The only permissible legal basis is explicit consent under GDPR Article 6(1)(a), in conjunction with ePrivacy Directive Article 5(3) for terminal access. If session replay captures special-category data (health, financial or other sensitive data typed into forms that are not properly masked), GDPR Article 9(2)(a) explicit consent is also required. Legitimate interest under Article 6(1)(f) is not available for this scope of behavioural recording, as confirmed by the EDPB and national DPA guidance on session replay and screen recording technologies.
Yes. Medallia Inc., the parent company of Decibel Insight, is headquartered in San Francisco, California. All session replay data is processed on Medallia's cloud infrastructure, which includes US-based servers. Transfers from the EEA rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). The DPIA must assess the adequacy of these transfer safeguards for the specific sensitivity of session replay data, which is far more granular than typical analytics data. The California Consumer Privacy Act (CCPA) also applies to California-resident users.
Yes, a DPIA is mandatory before deploying Decibel. Session replay is explicitly recognised by the EDPB and national DPAs as high-risk processing requiring a DPIA under GDPR Article 35(3)(a) (systematic large-scale processing producing significant effects on individuals) because it creates detailed records of user behaviour that go far beyond ordinary analytics. The DPIA must address session data scope, masking effectiveness, US transfer safeguards, retention, data subject rights and consent mechanisms. The DPO must approve the DPIA and it must be reviewed annually and whenever Medallia changes its processing terms.
Compliant deployment requires: a mandatory DPIA approved by the DPO; a CMP that technically blocks the Decibel tag until explicit, specific consent for session replay is obtained; correct masking configuration for all sensitive form fields (passwords, payment card numbers, health data, authentication inputs) before data leaves the browser; a Data Processing Agreement with Medallia covering SCCs and DPF; privacy policy and cookie notice updates accurately describing session replay; a functional consent withdrawal mechanism; a process for handling GDPR data subject access and erasure requests for session recordings; and annual compliance reviews.
Aggregate heatmap and click-map tools (such as open-source alternatives using anonymised event counting) can answer many of the same UX questions without recording individual sessions. Server-side analytics tools that measure page performance and conversion funnels without client-side session capture avoid the ePrivacy consent requirement. If session replay is a genuine business requirement, alternative providers such as Hotjar, FullStory or Microsoft Clarity offer similar functionality but each carries comparable GDPR and ePrivacy obligations and US transfer risks. Any session replay tool requires consent.
The cookie policy must include a dedicated section for Decibel describing: the cookie names and domain (decibelinsight.net), the retention period (typically 90 days or the session replay storage period), the purpose (session replay recording, Digital Experience Score computation and UX analytics), the controller and processor (Medallia Inc., USA), the US transfer and SCC/DPF safeguards, the fact that session replay captures mouse movements and form interactions, the masking measures in place for sensitive fields, and the user's right to withdraw consent and request deletion of recordings. The policy must be live before Decibel is deployed.