Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
GoSquared is a real time website analytics, live chat and customer data platform from the United Kingdom. It tracks visitor behaviour and traffic sources, powers a live chat inbox, and unifies visitor profiles in its Customer Data Hub. Because it relies on first party cookies and can identify individual visitors, it requires consent under European privacy law.
GoSquared is a real time website analytics, live chat and customer data platform operated by a United Kingdom based company. It shows live visitor activity, traffic sources, popular pages and conversion trends, and it pairs this analytics view with a live chat inbox for talking to visitors directly. Its Customer Data Hub unifies behavioural events and contact details into a single profile for each known person. Website owners install a small first party JavaScript snippet, and additional server side and API based tracking is available for known users. Because the product can identify individuals and build profiles, it sits closer to a customer data platform than to a purely anonymous analytics tool.
GoSquared sets first party cookies in the visitor browser. The gs_u cookie stores a randomly generated device identifier and lasts around two years, the gs_v cookie stores the identifier assigned when a visitor is identified for the Customer Data Hub and also lasts around two years, and the short lived gs_p cookie records the previously viewed page for up to sixty seconds. The platform collects pageviews, sessions, device and browser details, referrers and engagement, and anonymises IP addresses by default. When live chat or identification is used it can also store names, email addresses and conversation content. These cookies are first party only and do not track visitors across unrelated websites.
Under the ePrivacy Directive, storing or reading analytics cookies that are not strictly necessary requires prior consent, and the gs_u and gs_v cookies fall into that category. Under the GDPR, the identifiers and profiles GoSquared creates are personal data, so a valid lawful basis and clear information are required. Because the Customer Data Hub builds identifiable profiles and live chat captures conversation content, the processing goes beyond simple aggregate measurement. National rules such as the German TTDSG and guidance from the French CNIL reinforce that consent must be obtained before these cookies are set. Treating GoSquared as a tool that needs informed consent is the safest position for European websites.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The GoSquared tracking snippet should be loaded only after the visitor has given consent through your consent management platform. Configure the snippet so that it is blocked by default and triggered only when the analytics or chat category is accepted. Most consent platforms let you assign the GoSquared script to a custom category and fire it on the consent event. Consent must be freely given, specific and revocable, so provide an equally easy way to withdraw it and stop further tracking. If you use the Customer Data Hub or live chat, make sure the consent text mentions profiling and support conversations, not just basic analytics.
GoSquared is provided by a United Kingdom company and processes data on cloud infrastructure that includes servers in the United States, so visitor data is transferred outside the European Economic Area. Transfers to the United States rely on Standard Contractual Clauses and, where the provider participates, the EU US Data Privacy Framework, supplemented by safeguards such as IP anonymisation. Transfers to the United Kingdom are covered by the existing adequacy decision. You should record these transfers in your records of processing and reference the relevant safeguards in your privacy policy. A transfer impact assessment helps document that the safeguards are effective for the data involved.
Start by signing a data processing agreement with GoSquared and confirming the configured data regions and retention settings. Block the tracking snippet until consent is captured, and map the GoSquared cookies to the correct category in your consent platform. List the gs_u, gs_v and gs_p cookies and their durations in your cookie policy, and explain the analytics, chat and Customer Data Hub purposes. Keep IP anonymisation enabled and use the Deletion API to honour erasure and objection requests promptly. Review the setup periodically so that the cookie inventory, transfer documentation and consent records stay accurate.
Websites using GoSquared must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is recommended when GoSquared is used beyond basic aggregate analytics. The Customer Data Hub builds unified, identifiable visitor profiles, and the live chat inbox captures conversation content that can include personal data. Combining behavioural tracking with identification increases the risk of profiling, so the assessment should document the categories of data, retention periods and the lawful basis. International transfers to United States infrastructure and the use of the Deletion API for erasure requests should also be assessed. Where high risk profiling is likely, a full DPIA under GDPR Article 35 is advisable.
Sample consent text
We use GoSquared to understand how visitors use our site and to provide live chat support. This sets first party cookies and may create a visitor profile. Do you accept these analytics and chat cookies?
Third-party domains contacted
data.gosquared.comapi.gosquared.comcdn.gosquared.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gs_u_{TOKEN} | first party analytics | 2 years | Stores a randomly generated device identifier used to recognise a returning browser for analytics. |
| gs_v_{TOKEN} | first party analytics | 2 years | Stores the visitor identifier assigned when a visitor is identified for the Customer Data Hub and Inbox. |
| gs_p_{TOKEN} | first party analytics | 60 seconds | Records the previously viewed page within a session to attribute the next pageview. |
GoSquared collects user analytics data — you legally need a consent banner. Try FlowConsent free.
GoSquared sets first party cookies including gs_u, which stores a random device identifier for about two years, and gs_v, which stores the identifier of a visitor identified for the Customer Data Hub, also for about two years. A short lived gs_p cookie records the previously viewed page for up to sixty seconds. These cookies are first party only and do not track visitors across other websites.
Yes. The gs_u and gs_v cookies are analytics and identification cookies that are not strictly necessary, so the ePrivacy Directive requires prior consent before they are set. Because the Customer Data Hub and live chat can identify visitors, consent is the appropriate basis. You should block the tracking snippet until the visitor accepts.
The lawful basis is consent under GDPR Article 6(1)(a), because GoSquared sets non essential cookies and can build identifiable visitor profiles. Legitimate interest under Article 6(1)(f) is generally not sufficient given the profiling and live chat content involved. Consent must be informed, freely given and easy to withdraw.
Yes. GoSquared is a United Kingdom company that processes data on cloud infrastructure including United States servers, so visitor data is transferred outside the EEA. These transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supplemented by IP anonymisation. You should document the transfers and reference the safeguards in your privacy policy.
A data protection impact assessment is recommended when you use the Customer Data Hub or live chat, because they create identifiable profiles and capture conversation content. The assessment should cover the data categories, retention, the consent basis and the United States transfers. A full DPIA under Article 35 is advisable where high risk profiling is likely.
Sign a data processing agreement, keep IP anonymisation enabled, and load the tracking snippet only after consent through your consent management platform. Map the gs_u, gs_v and gs_p cookies to the correct category and list them in your cookie policy. Use the Deletion API to handle erasure and objection requests promptly.
Privacy friendly analytics alternatives include cookieless tools such as Plausible, Fathom, Cronitor and Splitbee, which avoid identification cookies. If you need live chat and a customer data hub, the trade off is that those features inherently process more personal data. Choosing a cookieless option can reduce or remove the need for a consent banner.
List the gs_u, gs_v and gs_p cookies with their purposes and durations, and state that they are first party. Explain the analytics, live chat and Customer Data Hub processing, and mention the transfers to the United States and the safeguards used. Review the entries whenever GoSquared changes its cookies or your configuration.