Maze
Maze is a product research and usability testing platform used to run unmoderated user tests, prototype tests, and in product surveys. It captures how participants click, navigate, and respond, along with device and browser data and IP addresses, through a JavaScript widget or hosted test links. Maze is operated from the United States, so it sets analytics cookies that require prior consent under the GDPR and the ePrivacy Directive and involves a transfer of data to a third country.
What does Maze do?
What Maze is
Maze is a continuous product discovery and usability testing platform operated by Maze, Inc. in the United States. Teams use it to run unmoderated usability tests, prototype tests, surveys, and in product feedback widgets, then analyse how participants behave. When embedded on a live site or product, Maze loads a JavaScript widget that records interactions and stores cookies in the visitor browser.
What data and cookies Maze collects
Maze collects behavioural data such as clicks, taps, navigation paths, time on task, and survey answers, together with technical data like device type, browser, screen size, and IP address. Depending on configuration it can capture detailed interaction data and screen activity during tests. To do this it sets cookies and identifiers that persist across a participant session and, in some cases, across visits.
GDPR and ePrivacy implications
Because Maze sets non essential analytics cookies and processes detailed behavioural data, the ePrivacy Directive requires prior consent before the widget loads, and the GDPR requires a lawful basis and transparency. The behavioural and interaction data can be detailed enough to single out individuals, which raises the sensitivity of the processing. A data processing agreement with Maze is required because it acts as your processor.
When consent is required
You must obtain valid, prior, opt in consent before the Maze widget runs on a live site, and consent must be specific and as easy to withdraw as to give. For hosted test links, participants should be informed at the start and asked to agree before the test records their interactions. Block the Maze script behind your consent banner so nothing loads until the visitor accepts.
Data transfers outside the EU
Maze, Inc. is based in the United States and processes data there, so using Maze involves a transfer to a third country under Chapter V of the GDPR. These transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. You should document the safeguards and the categories of data sent to the US.
Practical compliance steps
To use Maze compliantly, gate the widget behind consent, sign a data processing agreement, and complete a transfer impact assessment for the US transfer. Minimise the personal data captured in tests, avoid collecting special category information, and set retention limits for recordings and results. List Maze in your cookie policy and privacy notice and review its subprocessors periodically.
Maze and the GDPR
Maze is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) for behavioural analytics and interaction recording
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive (Cookie Law), CCPA
Impact assessment (DPIA)
Maze processes detailed behavioural and interaction data that can single out individuals, which raises its risk profile. Key DPIA points: (1) transfer of personal data to Maze, Inc. in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) capture of clicks, navigation, and potentially screen activity that can reveal sensitive context; (3) persistent identifiers enabling participant profiling across a test or visits; (4) risk of incidental collection of special category data in open ended survey answers; (5) the need for a data processing agreement and clear retention limits for results and recordings. A DPIA is recommended given the scale and detail of behavioural monitoring.
Sample text for your banner
We use Maze to test and improve our product experience. With your consent, Maze places cookies and records how you interact with prototypes, surveys, and pages, along with technical data such as your device and IP address. This data is processed by Maze, Inc. in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings.
What Maze sets and contacts
- Tracking method
- JavaScript widget for in product tests and surveys, plus hosted test links, using cookies
- Server location
- United States (Maze, Inc.)
- Data transferred outside the EU
- Maze, Inc. is based in the United States and processes data there. Transfers rely on Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the EU US Data Privacy Framework, and should be supported by a transfer impact assessment.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| maze_session | Functional | Session | Maintains the test or survey session so responses and progress are recorded correctly. |
| maze_uid | Analytics | 1 year | Assigns a unique identifier to a participant to measure interactions and recognise returning testers. |
| maze_tracker | Analytics | 1 year | Records interaction events during a test, such as clicks and navigation, for later analysis. |
Third-party domains contacted (3)
maze.coapp.maze.cosnippet.maze.co
Frequently asked questions about Maze
Can't find your question? Write to us, we answer fast.
What cookies does Maze set?
Maze sets functional cookies that keep a test or survey session running and analytics identifiers that record how participants interact and, in some cases, recognise them across visits. These analytics cookies are not strictly necessary, so they require consent. The exact cookies depend on whether you use the in product widget or hosted test links.
Do I need consent to use Maze?
Yes. On a live site the Maze widget sets non essential analytics cookies and records behaviour, so you must obtain prior, opt in consent before it loads. For hosted test links, inform participants and obtain their agreement before recording begins.
What is the legal basis for Maze?
The behavioural analytics and interaction recording rely on consent (Art. 6(1)(a)) together with the ePrivacy Directive. You should not rely on legitimate interest alone for this kind of detailed behavioural monitoring on a live site.
Does Maze transfer data to the US?
Yes. Maze, Inc. is based in the United States and processes data there, so using Maze is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment.
Is a DPIA needed for Maze?
A DPIA is recommended, and may be required, because Maze involves systematic behavioural monitoring and possible recording of interactions. Assess the US transfer, the detail of the data captured, retention periods, and the risk of collecting sensitive information in open responses.
How do I implement Maze compliantly?
Block the Maze widget behind your consent banner, sign a data processing agreement, and complete a transfer impact assessment for the US transfer. Minimise what you capture, avoid special category data, set retention limits, and document Maze in your cookie policy and privacy notice.
Are there alternatives to Maze?
Yes. EU based or self hosted research and survey tools, or moderated interviews without behavioural tracking, can reduce cookies and third country transfers. Tools such as LimeSurvey (self hosted) or EU hosted usability platforms are more data minimal options to consider.
How do I update my cookie policy for Maze?
Add a Maze entry listing its functional and analytics cookies, their purposes and durations, and the fact that data is processed by Maze, Inc. in the United States. Link to Maze''s privacy notice and review the entry whenever Maze changes its cookies or subprocessors.
Rybbit
Rybbit is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Rybbit supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Rybbit enables informed decisions that improve experience and drive results.
%22%3E%0A%3Cpath%20d%3D%22M23.588%2013.7977H17.8645L21.0433%201.6001L9.59998%2017.6476H15.3233L12.1445%2029.8451L23.588%2013.7977Z%22%20fill%3D%22white%22%2F%3E%0A%3C%2Fg%3E%0A%3C%2Fsvg%3E)
Sirge
Sirge is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Sirge offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Sirge empowers organizations to optimize strategy and maximize return on investment.
Wipe Analytics
Wipe Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Wipe Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Wipe Analytics enables informed decisions that improve experience and drive results.
WPS Visitor Counter
WPS Visitor Counter is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. WPS Visitor Counter supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, WPS Visitor Counter remains a leading web development choice.
Ringba
Ringba is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Ringba offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Ringba empowers organizations to optimize strategy and maximize return on investment.
Site24x7
Site24x7 is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Site24x7 provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Site24x7 helps deliver the right message to the right audience at the right time.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.