Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Lytics is a customer data platform based in Portland, Oregon that builds rich behavioural profiles, runs machine learning audience segmentation and activates audiences to advertising and marketing platforms. Its JavaScript tag, the jstag, sets a first party identifier and tracks behaviour across the site, which is large scale profiling under the GDPR. The tag and profiling are not strictly necessary, so they need prior consent and a valid legal basis. Because Lytics is US based, transfers rely on the EU US Data Privacy Framework and the Standard Contractual Clauses with a transfer impact assessment, and a DPIA is recommended.
Lytics is a customer data platform based in Portland, Oregon in the United States. It collects behavioural data from a website, builds rich profiles of each visitor and uses machine learning to group people into audience segments. Those segments can then be activated, meaning they are pushed to advertising and marketing platforms to drive targeted campaigns. For European organisations, Lytics sits between the website and a wide range of downstream tools, which makes it a central and high impact part of the marketing stack.
The Lytics JavaScript tag, known as the jstag, sets a first party identifier such as seerid and records page views, clicks and other behavioural events as the visitor moves through the site. Additional cookies such as ly_segs hold segment membership and helpers such as _li support the tag. Over time these identifiers build a detailed behavioural profile that can be enriched with known customer attributes. Because none of this is needed to deliver the website, the tag and its cookies are non essential trackers that require consent under the ePrivacy rules.
Building behavioural profiles and segmenting people with machine learning is profiling under the GDPR, and activating those audiences to other platforms multiplies the number of recipients of the data. Article 5(3) of the ePrivacy Directive requires prior consent for the jstag and its cookies, while the GDPR governs the profiles themselves. Lytics normally acts as a processor, so an article 28 data processing agreement is required, along with transparency about the profiling logic and the onward sharing of audiences. The scale and the activation element together push this into clearly high risk territory.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is the correct basis for the jstag and for the profiling and audience building that Lytics performs, because legitimate interest is hard to defend for large scale profiling and onward activation. Consent must be obtained before the tag fires, must clearly cover the profiling and advertising purposes, and must be as easy to withdraw as to give. In practice the tag should be held behind a consent management platform, the consent signal should be passed to Lytics, and segment building and activation should stop for anyone who declines or withdraws.
Lytics is a United States company and processes data on Google Cloud in the United States, so European deployments involve a transfer of personal data across the Atlantic. Where Lytics is certified under the EU US Data Privacy Framework, transfers to it can rely on that framework, and many organisations also sign the EU Standard Contractual Clauses as a backup supported by a transfer impact assessment. You should verify the current certification status of Lytics, document the safeguard you are relying on, and note that CPRA may also apply where Californian residents data is involved.
Sign a data processing agreement, complete a data protection impact assessment and confirm the transfer mechanism, whether the Data Privacy Framework or the Standard Contractual Clauses, before launch. Route the jstag through your consent management platform so it stays dormant until the visitor accepts, and pass the consent state to Lytics so profiling and activation respect it. Apply data minimisation, set clear retention limits on profiles and segments, and update your privacy notice and cookie policy to name Lytics, describe the profiling and audience activation and explain the United States transfer. Review the setup regularly and keep evidence to demonstrate accountability.
Websites using Lytics must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is recommended for Lytics because it performs behavioural profiling, machine learning segmentation and audience activation at scale. Map the data captured by the jstag, the first party identifier, the profiles and segments built and the platforms the audiences are pushed to. Assess the transfer to the United States under the EU US Data Privacy Framework and the Standard Contractual Clauses, and consider CPRA where Californian data is involved. Document the risks of profiling and the mitigations such as consent gating, minimisation and retention limits before launch.
Sample consent text
We use Lytics to understand how you interact with our site and to build audience segments so we can personalise content and advertising. This relies on a first party tag and only runs after you accept, and it may transfer your data to Lytics in the United States under the EU US Data Privacy Framework and EU approved clauses. You can refuse or withdraw your consent at any time.
Third-party domains contacted
lytics.ioc.lytics.ioapi.lytics.iolytics.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| seerid | analytics | persistent (up to 1 year) | Persistent Lytics user identifier set by the jstag to track behaviour and link it to a behavioural profile. |
| ly_segs | advertising | persistent (up to 1 year) | Stores the audience segments the visitor belongs to so they can be activated to advertising and marketing platforms. |
| _li | functional | persistent | Helper cookie that supports the operation of the Lytics jstag. |
Lytics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The Lytics jstag sets a first party identifier such as seerid, a segment cookie such as ly_segs and a helper such as _li. They track behaviour, store audience membership and feed profiling and activation, so they are not strictly necessary and require consent.
Yes. The jstag and the profiling it powers are not strictly necessary, so you must obtain prior, specific and freely given consent before the tag fires. The tag should stay blocked until the visitor opts in, and segment building should not run for those who decline.
The appropriate basis is consent under GDPR article 6(1)(a) for the profiling and audience building, together with the prior consent required by article 5(3) ePrivacy for the jstag. Legitimate interest is hard to defend given the scale of profiling and the onward activation of audiences.
Yes. Lytics is based in the United States and processes data on Google Cloud there. Transfers rely on the EU US Data Privacy Framework where Lytics is certified and on the EU Standard Contractual Clauses with a transfer impact assessment. CPRA may also apply where Californian data is involved.
A DPIA is recommended. Lytics carries out behavioural profiling, machine learning segmentation and audience activation at scale, which are higher risk activities. Document the data captured, the profiles and segments, the recipients of activated audiences and the US transfer, and record your mitigations before launch.
Sign a data processing agreement, complete a DPIA and confirm your transfer mechanism first. Gate the jstag behind a consent management platform, pass the consent state to Lytics so profiling and activation respect it, apply data minimisation and clear retention, and disclose the profiling and US transfer in your notices.
Other customer data platforms offer EU hosting or simpler transfer positions, which can ease compliance. If audience activation is not essential, lighter first party analytics with a cookieless option may reduce risk. Whichever tool you pick, consent gating and a DPIA remain necessary for large scale profiling.
List each Lytics cookie with its purpose and duration, explain that the platform builds behavioural profiles and activates audiences, and disclose the transfer to the United States under the Data Privacy Framework and the Standard Contractual Clauses. Link to your consent settings and review the entry when the configuration changes.