Ensighten

What Ensighten is

Ensighten, now part of Cheq and branded as Cheq Control and Compliance, is an enterprise tag management and website privacy platform. It lets organisations deploy, organise and govern the marketing and analytics tags that run on their websites through a single container. Beyond classic tag management, it focuses on consent enforcement by scanning the page and blocking unapproved or unconsented tags in the browser before they can collect any data. It supports both client side and server side deployment and produces audit trails that help demonstrate compliance. Because it sits in front of every other tracking tool, it has a powerful influence over how personal data is collected across the whole site.

Cookies and data collected

Ensighten itself stores the signals needed to record how a visitor has opted in or out of tracking technologies, typically in a first party cookie or in browser storage. The platform can be configured so that no non essential data is stored until a visitor has given consent. The far larger data footprint comes from the third party tags that Ensighten loads, since each analytics or advertising tag may set its own cookies and collect its own personal data. This makes the tag inventory the key artefact for compliance, because the cookies a visitor actually receives depend on which tags are allowed to fire. Operators should map every managed tag and the storage it creates so the cookie policy reflects reality.

GDPR and ePrivacy implications

Under the GDPR and the ePrivacy Directive, reading or writing non essential identifiers requires consent, and Ensighten is the control point that can make this lawful in practice. The strictly necessary function of enforcing consent and keeping an audit record can often rely on legitimate interest, but the marketing and analytics tags it releases almost always require consent. National rules such as the German TTDSG and French CNIL guidance reinforce that consent must be obtained before non essential tags fire. The website operator is the data controller responsible for the overall configuration, while Cheq acts as a processor for the platform. Correct configuration turns Ensighten from a compliance risk into a compliance safeguard.

Consent requirements and CMP integration

Ensighten can act as the enforcement layer for a consent management platform, ensuring that the choices a visitor makes are actually applied in the browser. Each managed tag should be mapped to a purpose category so that it only fires when the visitor has consented to that category. Because the platform blocks tags at the source rather than relying on each vendor to behave, it provides a strong technical guarantee that unconsented tracking does not occur. Operators should verify that withdrawing consent immediately stops the relevant tags and that the consent record is updated. Regular testing across browsers and pages confirms that enforcement works and that the audit trail matches the visible behaviour.

International data transfers

Ensighten is provided by Cheq, a vendor headquartered in the United States, so personal data may be processed in the United States and other third countries. Transfers outside the EEA should be governed by EU Standard Contractual Clauses and, where the recipient is certified, by the EU US Data Privacy Framework, supported by a transfer impact assessment. Operators should also consider where the container script and any server side endpoints are hosted, and whether EU or EEA processing options are available. Each third party tag that Ensighten loads can introduce its own onward transfers, so the transfer analysis must cover the whole tag stack. These mechanisms should be recorded in the record of processing activities.

Practical compliance steps

Start by building a complete inventory of the tags that Ensighten manages and the cookies each one sets, then map every tag to a consent purpose. Sign a data processing agreement with Cheq, confirm controller and processor roles, and document the transfer mechanisms for processing in the United States. Configure consent enforcement so that no non essential tag fires before opt in, and test that withdrawing consent stops the tags and updates the record. Update the privacy notice and cookie policy to reflect the managed tags and the audit logging, and keep them in sync as tags change. Finally, complete a Data Protection Impact Assessment given the platform broad influence over site wide tracking, and review the configuration whenever new tags are added.