> GrowingIO cookies, automatic event capture, transfers to mainland China, PIPL exposure and how to deploy GrowingIO on European sites under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/analytics/growingio Analytics # GrowingIO Analytics GrowingIO is a Chinese product analytics platform operated by Growing Information Technology Co., Ltd. in Beijing. It provides automatic event capture, funnel analysis, retention reports, A/B testing and session replay across web, mobile and WeChat mini programs, with deep integration into the Alibaba Cloud and Tencent ad ecosystems. Because production data is processed in mainland China, GrowingIO is treated as a high risk vendor for European deployments under the GDPR and the ePrivacy Directive. [Block GrowingIO until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers GrowingIO is operated by Growing Information Technology Co., Ltd., headquartered in Beijing. Production data is processed on Alibaba Cloud regions in mainland China. Singapore and overseas regions are offered to selected customers but not the default. Overview ## What does GrowingIO do? ## **What GrowingIO is** GrowingIO is the Chinese product analytics suite of Growing Information Technology Co., Ltd., based in Beijing. It is widely used by Chinese SaaS, ecommerce and mobile teams for funnel analysis, retention, cohorts, A/B testing and session replay across web, native mobile apps and WeChat mini programs. Integrations with Alibaba Cloud and Tencent advertising are first class. ## **What data GrowingIO collects** The GrowingIO SDK auto captures page views, clicks, scroll, form interactions and exit events. It assigns a persistent visitor ID stored in first party cookies and links sessions across days. Optional session replay records DOM snapshots and visitor inputs. Custom user properties (registered ID, hashed email) can be set by the application. Data is then ingested into the GrowingIO warehouse and used for product analytics, marketing automation and audience activation. ## **GDPR and ePrivacy implications** The cookies fall under Article 5(3) ePrivacy. The persistent visitor ID, session replay and behavioural profiling are personal data processing under Article 4(1) GDPR. Consent is required under Article 6(1)(a) GDPR. Because session replay can capture sensitive content typed on screen, additional safeguards are needed (input masking, redaction). ## **Consent requirements** GrowingIO must be tag blocked until explicit, granular opt in consent has been given. The consent message must mention the operator, the destination country (mainland China) and the absence of an EU adequacy decision. Article 49(1)(a) explicit consent for the transfer is required in addition to the standard consent for cookies. ## **International data transfers** Production data is stored in mainland China on Alibaba Cloud. Mainland China has no GDPR adequacy decision and is exposed to the Cybersecurity Law, the Data Security Law and the PIPL. Transfers therefore require Standard Contractual Clauses and supplementary measures, and Article 49(1)(a) GDPR explicit consent for occasional transfers. ## **Practical compliance steps** Tag block the GrowingIO SDK until consent, prepare an Article 49(1)(a) consent flow that names mainland China, sign the GrowingIO DPA on SCC, document a transfer impact assessment, configure session replay with strict input masking, list GrowingIO in the privacy and cookie policies and consider EU based product analytics (Mixpanel EU, PostHog Cloud EU, Heap with Schrems II measures, Matomo Cloud) as the strategic option for European users. Compliance ## GrowingIO and the GDPR GrowingIO is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive) for the cookies and the persistent visitor profiling, plus explicit consent under Article 49(1)(a) GDPR for the transfer to mainland China. Legitimate interest is not admissible because GrowingIO performs detailed behavioural and session level analytics across sessions. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, EDPB Schrems II guidance, Chinese Personal Information Protection Law (PIPL), French CNIL guidelines, German TTDSG, Spanish LSSI, Italian Garante guidelines ### Impact assessment (DPIA) A DPIA is required for any meaningful EU deployment of GrowingIO due to detailed behavioural profiling, session replay, persistent identifiers, transfer to mainland China and exposure to the Chinese Cybersecurity Law and PIPL. The DPIA should evaluate whether SCC plus supplementary measures effectively guarantee EU level protection. ### Sample text for your banner > We use GrowingIO product analytics, operated from mainland China, to understand how the product is used. GrowingIO sets cookies, captures events automatically and transfers data to servers in China, which is not covered by an EU adequacy decision. Click Accept only if you understand and agree to this transfer. Cookies and trackers ## What GrowingIO sets and contacts - Tracking method JavaScript SDK loaded from growingio.com, mobile SDKs (iOS, Android, mini programs), automatic event capture (page views, clicks, scroll, form interactions), session replay, persistent visitor identifier in first party cookies, server side ingestion to GrowingIO product analytics warehouse. - Server location GrowingIO is operated by Growing Information Technology Co., Ltd., headquartered in Beijing. Production data is processed on Alibaba Cloud regions in mainland China. Singapore and overseas regions are offered to selected customers but not the default. - Data transferred outside the EU Personal data is transferred to mainland China. Mainland China has no GDPR adequacy decision and is exposed to the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law. Standard Contractual Clauses with supplementary measures and explicit consent under Article 49(1)(a) GDPR are typically required. EU data residency is not the default. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------ | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------- | | gioenc | persistent | 2 years | Encrypted GrowingIO visitor identifier used to link auto captured events to a unique browser across sessions. | | gr\_session | session | Session | Session level identifier maintained by the GrowingIO SDK for the duration of a single visit. | | gr\_user\_id | persistent | 2 years | Persistent user identifier that links anonymous activity to authenticated profiles when the application calls the identify API. | ### Third-party domains contacted (4) - `growingio.com` - `gio.cn` - `assets.giocdn.com` - `napi.growingio.com` Questions ## Frequently asked questions about GrowingIO Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does GrowingIO set? GrowingIO sets first party cookies (gioenc, gr\_session, gr\_user\_id) on the customer domain to identify a unique browser, persist sessions and link auto captured events. Localstorage is also used to buffer events offline. ### Do I need consent to use GrowingIO? Yes. The cookies fall under Article 5(3) ePrivacy and the persistent profiling under Article 6(1)(a) GDPR. The transfer to mainland China additionally requires explicit consent under Article 49(1)(a) GDPR. ### What is the legal basis for GrowingIO? Consent for the cookies and the cross session profiling, plus explicit consent for the transfer to mainland China. Legitimate interest is not admissible because of the depth of behavioural analytics, the optional session replay and the destination country risk profile. ### Does GrowingIO transfer data to China? Yes. Production data is stored in mainland China on Alibaba Cloud. Mainland China is exposed to the Cybersecurity Law, Data Security Law and PIPL, and there is no GDPR adequacy decision. SCC plus supplementary measures plus explicit consent are typically needed. ### Do I need a DPIA for GrowingIO? Yes for any meaningful EU deployment. Detailed behavioural profiling, session replay, persistent identifiers, mainland China transfer and PIPL exposure jointly trigger the DPIA criteria of WP248 and the EDPB threshold guidance. ### How do I implement GrowingIO compliantly? Tag block the SDK until consent, prepare an Article 49(1)(a) consent flow that names mainland China, sign the GrowingIO DPA on SCC, document a transfer impact assessment, mask sensitive inputs in session replay, list GrowingIO in the privacy and cookie policies and consider migrating EU users to an EU based product analytics tool. ### What are the alternatives to GrowingIO? EU friendlier product analytics options include Mixpanel EU, PostHog Cloud EU, Heap (with Schrems II safeguards), Amplitude EU, Pendo EU, Matomo Cloud and June. For self hosted setups, PostHog self hosted on EU infrastructure or Plausible plus a custom event store are common choices. ### How do I update the cookie policy for GrowingIO? List GrowingIO with the operator (Growing Information Technology Co., Ltd., Beijing), the purpose (product analytics, session replay), the cookies (gioenc, gr\_session, gr\_user\_id) with retention, the legal basis (consent and Article 49(1)(a) explicit consent), the transfer destination (mainland China) and the safeguards (SCC, supplementary measures, transfer impact assessment). Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Detectizr](https://www.flowconsent.com/en/services/analytics/detectizr) [Detectizr is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Detectizr supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Detectizr enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/detectizr) [Analytics](https://www.flowconsent.com/en/services/analytics/detectizr) · ### [Snoobi](https://www.flowconsent.com/en/services/analytics/snoobi) [Snoobi is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Snoobi offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Snoobi empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/snoobi) [Analytics](https://www.flowconsent.com/en/services/analytics/snoobi) · ### [Dynatrace RUM](https://www.flowconsent.com/en/services/analytics/dynatrace-rum) [Dynatrace RUM is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Dynatrace RUM provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Dynatrace RUM helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/analytics/dynatrace-rum) [Analytics](https://www.flowconsent.com/en/services/analytics/dynatrace-rum) · ### [ostr.io](https://www.flowconsent.com/en/services/analytics/ostr-io) [ostr.io is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. ostr.io offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, ostr.io empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/ostr-io) [Analytics](https://www.flowconsent.com/en/services/analytics/ostr-io) · ### [SmartDX](https://www.flowconsent.com/en/services/analytics/smartdx) [SmartDX is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. SmartDX supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, SmartDX enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/smartdx) [Analytics](https://www.flowconsent.com/en/services/analytics/smartdx) · ### [CaliberMind](https://www.flowconsent.com/en/services/analytics/calibermind) [CaliberMind is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. CaliberMind offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, CaliberMind empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/calibermind) [Analytics](https://www.flowconsent.com/en/services/analytics/calibermind) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)