Dynatrace RUM

What Dynatrace RUM is and what it does

Dynatrace Real User Monitoring is the front end observability component of the Dynatrace platform. It runs as a JavaScript agent named ruxitagentjs that is either auto injected by the server side Dynatrace OneAgent or added manually to a page. Once loaded, it measures page load and route change timings, JavaScript and AJAX errors, Core Web Vitals, individual user actions such as clicks and form submits, third party resource performance and IP based geolocation. Optional session replay captures a reconstructed rendering of the user session. Dynatrace is provided as a SaaS service from clusters in the EU, the United States, APAC and AU, or as a self managed Dynatrace Managed deployment.

Data and cookies collected by Dynatrace RUM

The agent collects technical and behavioural data: full URL, referrer, page title, navigation and resource timings, JavaScript exceptions, AJAX endpoints, browser and operating system, screen resolution, connection type, IP address (used for geolocation and bot detection) and a persistent visitor identifier. With session replay enabled, it also captures DOM mutations, mouse movements and input events. By default Dynatrace sets cookies including dtCookie (session correlation), rxVisitor (long lived visitor id), rxvt (session expiry), dtPC (page context), dtLatC (latency) and dtSa (session attributes). A cookieless mode is available but reduces some session correlation features.

GDPR and ePrivacy implications

Because the agent is loaded on the user device and reads or writes information stored there (cookies, local storage, browser characteristics), it falls within Article 5(3) of the ePrivacy Directive and the national rules implementing it, including the French CNIL guidelines and the German TDDDG. The personal data processed (IP address, persistent visitor cookie, behavioural traces, optional session replay content) brings the activity within the GDPR. Risks include re identification of users from the combination of visitor id and behavioural signals, accidental capture of special category data through session replay, and lack of transparency when RUM is bundled with broader OneAgent deployments.

Consent requirements and legal basis

For the default RUM configuration, and in any deployment that uses session replay, captures user actions or enriches profiles, prior informed consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy is the safe legal basis. Some controllers rely on legitimate interest under Article 6(1)(f) GDPR for strictly anonymised performance monitoring (no session replay, masked IP, no persistent identifiers), but this requires a documented balancing test and remains contested by several supervisory authorities. Consent must be granular, freely given, as easy to withdraw as to give, and the script must be blocked until the user accepts.

Cross border data transfers and practical compliance steps

Data may flow to the EU, US, APAC or AU SaaS clusters depending on the tenant region. US transfers rely on Standard Contractual Clauses and on Dynatrace certification under the EU US Data Privacy Framework. To deploy compliantly, choose an EU tenant when possible, enable IP masking, mask input fields in session replay, exclude sensitive pages, shorten retention, use cookieless mode where feasible, integrate Dynatrace RUM into your Consent Management Platform so the agent only loads after consent, sign a Data Processing Agreement with Dynatrace, list cookies and domains in the cookie policy, and document the lawful basis analysis.