Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Maze is a product research and usability testing platform used to run unmoderated user tests, prototype tests, and in product surveys. It captures how participants click, navigate, and respond, along with device and browser data and IP addresses, through a JavaScript widget or hosted test links. Maze is operated from the United States, so it sets analytics cookies that require prior consent under the GDPR and the ePrivacy Directive and involves a transfer of data to a third country.
Maze is a continuous product discovery and usability testing platform operated by Maze, Inc. in the United States. Teams use it to run unmoderated usability tests, prototype tests, surveys, and in product feedback widgets, then analyse how participants behave. When embedded on a live site or product, Maze loads a JavaScript widget that records interactions and stores cookies in the visitor browser.
Maze collects behavioural data such as clicks, taps, navigation paths, time on task, and survey answers, together with technical data like device type, browser, screen size, and IP address. Depending on configuration it can capture detailed interaction data and screen activity during tests. To do this it sets cookies and identifiers that persist across a participant session and, in some cases, across visits.
Because Maze sets non essential analytics cookies and processes detailed behavioural data, the ePrivacy Directive requires prior consent before the widget loads, and the GDPR requires a lawful basis and transparency. The behavioural and interaction data can be detailed enough to single out individuals, which raises the sensitivity of the processing. A data processing agreement with Maze is required because it acts as your processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain valid, prior, opt in consent before the Maze widget runs on a live site, and consent must be specific and as easy to withdraw as to give. For hosted test links, participants should be informed at the start and asked to agree before the test records their interactions. Block the Maze script behind your consent banner so nothing loads until the visitor accepts.
Maze, Inc. is based in the United States and processes data there, so using Maze involves a transfer to a third country under Chapter V of the GDPR. These transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. You should document the safeguards and the categories of data sent to the US.
To use Maze compliantly, gate the widget behind consent, sign a data processing agreement, and complete a transfer impact assessment for the US transfer. Minimise the personal data captured in tests, avoid collecting special category information, and set retention limits for recordings and results. List Maze in your cookie policy and privacy notice and review its subprocessors periodically.
Websites using Maze must obtain user consent under GDPR regulations.
DPIA considerations
Maze processes detailed behavioural and interaction data that can single out individuals, which raises its risk profile. Key DPIA points: (1) transfer of personal data to Maze, Inc. in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) capture of clicks, navigation, and potentially screen activity that can reveal sensitive context; (3) persistent identifiers enabling participant profiling across a test or visits; (4) risk of incidental collection of special category data in open ended survey answers; (5) the need for a data processing agreement and clear retention limits for results and recordings. A DPIA is recommended given the scale and detail of behavioural monitoring.
Sample consent text
We use Maze to test and improve our product experience. With your consent, Maze places cookies and records how you interact with prototypes, surveys, and pages, along with technical data such as your device and IP address. This data is processed by Maze, Inc. in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings.
Third-party domains contacted
maze.coapp.maze.cosnippet.maze.coCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| maze_session | Functional | Session | Maintains the test or survey session so responses and progress are recorded correctly. |
| maze_uid | Analytics | 1 year | Assigns a unique identifier to a participant to measure interactions and recognise returning testers. |
| maze_tracker | Analytics | 1 year | Records interaction events during a test, such as clicks and navigation, for later analysis. |
Maze collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Maze sets functional cookies that keep a test or survey session running and analytics identifiers that record how participants interact and, in some cases, recognise them across visits. These analytics cookies are not strictly necessary, so they require consent. The exact cookies depend on whether you use the in product widget or hosted test links.
Yes. On a live site the Maze widget sets non essential analytics cookies and records behaviour, so you must obtain prior, opt in consent before it loads. For hosted test links, inform participants and obtain their agreement before recording begins.
The behavioural analytics and interaction recording rely on consent (Art. 6(1)(a)) together with the ePrivacy Directive. You should not rely on legitimate interest alone for this kind of detailed behavioural monitoring on a live site.
Yes. Maze, Inc. is based in the United States and processes data there, so using Maze is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment.
A DPIA is recommended, and may be required, because Maze involves systematic behavioural monitoring and possible recording of interactions. Assess the US transfer, the detail of the data captured, retention periods, and the risk of collecting sensitive information in open responses.
Block the Maze widget behind your consent banner, sign a data processing agreement, and complete a transfer impact assessment for the US transfer. Minimise what you capture, avoid special category data, set retention limits, and document Maze in your cookie policy and privacy notice.
Yes. EU based or self hosted research and survey tools, or moderated interviews without behavioural tracking, can reduce cookies and third country transfers. Tools such as LimeSurvey (self hosted) or EU hosted usability platforms are more data minimal options to consider.
Add a Maze entry listing its functional and analytics cookies, their purposes and durations, and the fact that data is processed by Maze, Inc. in the United States. Link to Maze''s privacy notice and review the entry whenever Maze changes its cookies or subprocessors.