Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
FAST ESP (Fast Search and Transfer Enterprise Search Platform) powers on site search experiences, indexing content and processing visitor search queries to return relevant results. To personalise results and measure search performance it can set functional and analytics cookies and log query behaviour.
FAST ESP, the Fast Search and Transfer Enterprise Search Platform, is an enterprise search engine that indexes large volumes of structured and unstructured content and serves fast, relevant results for on site search. Originally developed by the Norwegian company Fast Search and Transfer and later acquired by Microsoft, it underpins site search, faceted navigation and query suggestions across corporate websites, intranets and digital storefronts.
In a standard deployment the platform records the search terms visitors type, the results they click and basic session context used to tune relevance. It typically sets a functional session cookie to maintain search state and, where analytics are enabled, additional cookies that measure query volume, zero result searches and click through. Logged queries can occasionally contain personal data when visitors type names, email addresses or order numbers into the search box.
The strictly functional session cookie that keeps search working can usually rely on the ePrivacy exemption for cookies that are necessary to deliver a service the user requested. Analytics cookies and behavioural query logging used to optimise relevance go beyond what is strictly necessary and therefore require prior consent under the ePrivacy Directive, with the resulting processing governed by the GDPR. The site operator acts as controller and any hosting or support partner acts as a processor under a data processing agreement.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Core search functionality can run on the lawful basis of legitimate interest or necessity, so the search box itself does not have to be blocked behind a banner. Analytics cookies and any storage of identifiable query history should only be activated after the visitor gives explicit, informed and freely given consent through a consent management platform, and they must be just as easy to refuse as to accept.
FAST ESP can be self hosted entirely within the European Economic Area, which avoids any international transfer. Where it is run on US based cloud infrastructure or supported by Microsoft engineering teams, search index and query data may reach the United States. Such transfers need an appropriate safeguard, typically Standard Contractual Clauses or reliance on a vendor certified under the EU US Data Privacy Framework, supported by a transfer impact assessment.
Document the cookies and query logs in your privacy notice, gate analytics behind consent, and configure short retention periods for raw query logs. Where possible, anonymise or truncate logged queries, disable storage of identifiable searches, and keep hosting within the EEA. Sign a data processing agreement with any host or support provider and record transfer safeguards if data leaves the European Economic Area.
Websites using FAST ESP must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is usually not mandatory for standard on site search, but a screening assessment is advisable. Consider the volume of query logs, the risk that visitors type personal data into the search box, retention of behavioural analytics, and any transfer to the United States when hosted on US infrastructure.
Sample consent text
We use search analytics cookies to understand how visitors use our site search and to improve the relevance of results. These are only set with your consent. You can accept or decline analytics in our cookie settings at any time.
Third-party domains contacted
fastsearch.commicrosoft.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| fast_esp_session | functional | Session | Maintains search session state and pagination so results persist while the visitor browses. |
| fast_esp_relevance | functional | 30 days | Stores anonymous relevance and ranking preferences to tune search results for the visitor. |
| fast_esp_analytics | analytics | 13 months | Measures query volume, zero result searches and click through to improve search performance. |
FAST ESP collects user analytics data — you legally need a consent banner. Try FlowConsent free.
In a standard deployment FAST ESP sets a functional session cookie that keeps your search state during a visit, and where analytics are enabled it can set additional cookies that measure query volume, zero result searches and click through. The functional cookie is necessary for search to work, while analytics cookies are optional.
Consent is not required for the strictly necessary session cookie that makes the search box function, which can rely on necessity or legitimate interest. Consent is required before activating analytics cookies or storing identifiable query history, and it must be obtained through a consent banner with an equally easy refuse option.
Core on site search functionality typically relies on legitimate interest or contractual necessity. Analytics cookies and behavioural query logging rely on consent under the ePrivacy Directive, with the resulting personal data processing governed by the GDPR.
It depends on hosting. When self hosted within the European Economic Area there is no international transfer. When run on US based cloud infrastructure or supported by Microsoft teams, index and query data can reach the United States, which requires Standard Contractual Clauses or an EU US Data Privacy Framework certified provider plus a transfer impact assessment.
A full DPIA is usually not mandatory for standard on site search, but a screening assessment is recommended. Consider the volume of query logs, the chance visitors type personal data into the search box, retention of behavioural analytics and any transfer to the United States.
Document the cookies and query logs in your privacy notice, place analytics behind a consent banner, keep core search running on legitimate interest, and set short retention for raw logs. Anonymise or truncate logged queries where possible, host within the EEA, and sign a data processing agreement with any host or support partner.
European hosted search platforms and self hosted open source engines such as Elasticsearch, OpenSearch, Solr or Meilisearch can be deployed entirely within the EEA to avoid international transfers. The right alternative depends on indexing scale, language needs and your appetite for self hosting versus a managed service.
List the functional search cookie and any analytics cookies with their purpose and duration, explain that query data is logged to improve relevance, and state the lawful basis for each category. Disclose any US transfer and the safeguard used, and keep the policy in sync with your consent management platform.