Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Kilkaya is a real time content analytics and audience platform built for publishers and media teams. Based in Oslo, Norway, it tracks article performance as it happens, runs headline and AB tests, and builds audience and prediction models. It relies on a first party analytics identifier and behavioural event tracking, so its analytics cookie requires consent under the ePrivacy rules in the European Union.
Kilkaya is a real time content analytics and audience platform created for publishers and media organisations. It shows editorial teams how each article and piece of content performs the moment it goes live, so newsrooms can react quickly. The platform also runs headline and AB testing and builds audience and prediction models. It originates from Oslo, Norway, and has strong Nordic roots, which means its core infrastructure sits inside Europe.
Kilkaya works with a first party analytics identifier and behavioural event tracking. It sets a persistent visitor cookie, typically named kuid, and a short session cookie, and it records page views, scroll behaviour and engagement signals. These events feed the real time dashboards and the audience models. Because the identifier persists across visits, the data can describe an individual reader over time, which brings it within the scope of the data protection rules.
The ePrivacy rules, transposed in each member state, govern the act of reading and writing the analytics cookie on a device, while the GDPR governs the processing of the resulting personal data. Storing an analytics cookie that is not strictly necessary needs prior consent under ePrivacy art. 5(3). Where the deployment is configured for strictly anonymised single site audience measurement, the CNIL exemption for audience measurement may remove the consent requirement, but only if the strict conditions are met.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In the default configuration the lawful basis is consent under art. 6(1)(a) of the GDPR, paired with the ePrivacy consent for the cookie. Consent must be freely given, specific, informed and as easy to withdraw as to give. In practice this means Kilkaya should fire only after the visitor accepts the analytics category in your consent banner. Until that point no analytics cookie should be written and no events should be sent.
As a European provider, Kilkaya processes data within the EEA, so in the standard setup there is no transfer to a third country. A transfer can only arise if a sub processor located outside the EEA is involved. In that case you should rely on the EU Standard Contractual Clauses and a transfer impact assessment. The practical step is to confirm in the contract and the data processing agreement exactly where your data is stored and which sub processors are used.
Place Kilkaya behind a consent management platform so it loads only after consent for analytics. List the kuid and session cookies in your cookie policy with their purpose and lifetime. Sign the data processing agreement, document retention periods and review who can access the audience models. If you rely on the audience measurement exemption, keep written evidence that the strict anonymisation and single site conditions are satisfied.
Websites using Kilkaya must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is not usually mandatory for standard single site content analytics, but a documented assessment is recommended because Kilkaya builds audience and prediction models from behavioural events. Assess the volume of tracking, profiling logic, retention periods and whether any sub processor sits outside the EEA. Where processing stays anonymised and within the EEA, the residual risk is moderate.
Sample consent text
We use Kilkaya to measure how our content performs and to understand our audience. With your consent, Kilkaya sets a first party analytics cookie and records how you interact with our pages. You can accept or decline, and you may withdraw consent at any time in our cookie settings.
Third-party domains contacted
kilkaya.comcl.kilkaya.comcount.kilkaya.comcdn.kilkaya.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| kuid | analytics | persistent (up to 1 year) | Kilkaya first party visitor identifier used to measure content performance and build audience models. |
| _kk_session | analytics | session | Short lived session cookie used to group events within a single visit for real time analytics. |
| _kk_uid | analytics | persistent (up to 1 year) | Secondary Kilkaya first party analytics identifier used to deduplicate visits and support audience and prediction models. |
Kilkaya collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Kilkaya uses a first party setup. It typically sets a persistent visitor identifier called kuid for analytics and a short lived session cookie. These store a reader identifier and engagement data used for the real time dashboards and audience models.
Yes, in the standard configuration. Because the analytics cookie is not strictly necessary, ePrivacy art. 5(3) requires prior consent before it is set. Kilkaya should therefore load only after the visitor accepts the analytics category in your consent banner.
The lawful basis is consent under art. 6(1)(a) of the GDPR, combined with ePrivacy consent for the cookie. In some cases a strictly anonymised single site audience measurement configuration may fall under the CNIL exemption, which removes the consent requirement if the strict conditions are met.
No in the standard setup. Kilkaya is a European provider that processes data within the EEA. A transfer only arises if a sub processor outside the EEA is used, in which case you rely on the EU Standard Contractual Clauses, so confirm the data location in your contract.
A full DPIA is not usually mandatory for standard single site content analytics. However, a documented assessment is recommended because Kilkaya builds audience and prediction models from behavioural events. Review the tracking volume, retention and whether processing stays anonymised and inside the EEA.
Load Kilkaya through a consent management platform so it fires only after analytics consent. List the kuid and session cookies in your cookie policy with purpose and lifetime, sign the data processing agreement, and document retention periods. Verify the data location and any sub processors in the contract.
Other content analytics and audience tools exist, including European options and privacy first analytics that can run without persistent identifiers. The right choice depends on whether you need real time editorial insight, headline testing and audience modelling, and on your appetite for consent dependent tracking.
Add Kilkaya as an analytics provider in your cookie policy. Describe the kuid visitor identifier and the session cookie, their purpose, their duration and the fact that they are first party. State that data is processed within the EEA and explain how visitors can withdraw consent.