Microsoft Application Insights

Application Insights sets three cookies by default. The ai_user cookie (1 year) holds a randomly generated user identifier. The ai_session cookie (30 minutes) identifies the current browsing session. The ai_authUser cookie is set only when your website supplies an authenticated user identifier. All three can be disabled using the SDK cookieless mode or the disableCookiesUsage flag.

Yes. The ai_user and ai_session cookies are analytics cookies and are not strictly necessary. Under the ePrivacy Directive, consent must be obtained before those cookies are set. You should block the Application Insights snippet via your consent management platform and only release it after the user opts in to the analytics category.

The legal basis is consent under Article 6(1)(a) of the GDPR for the analytics cookies and telemetry. Consent must be freely given, specific, informed and unambiguous. If you use Application Insights only for strictly necessary performance monitoring without cookies and with anonymised IP, a case for legitimate interest under Article 6(1)(f) may be arguable, but consent remains the safest basis.

It depends on your Azure region configuration. If your Azure Monitor workspace is in a US region, or if Microsoft support staff access data from the United States, telemetry including IP-derived geolocation and user identifiers is transferred to the US. Microsoft relies on the EU US Data Privacy Framework and standard contractual clauses. To minimise transfers, configure your workspace in an EU region.

A DPIA is recommended if Application Insights is used to track authenticated users across sessions, if it is deployed on a high-traffic site processing large volumes of personal data, or if the Azure workspace is in a US region. The combination of persistent user identifiers, IP addresses and potential US transfers raises the risk level. If you enable cookieless mode, anonymise IPs and restrict the workspace to the EU, a DPIA may not be mandatory.

Block the JavaScript snippet via your consent management platform until analytics consent is granted. Use the SDK disableCookiesUsage flag or cookieless mode as a fallback for users who decline. Enable IP anonymisation in the SDK configuration. Set the Azure Monitor workspace to an EU region. Define a data retention period aligned with your privacy notice. Document Application Insights in your Records of Processing Activities.

Yes. Server-side analytics platforms such as Plausible Analytics, Fathom Analytics and Matomo (self-hosted) can provide performance metrics without setting persistent user cookies and with IP anonymisation by default. These reduce or eliminate the need for consent under the ePrivacy Directive and lower the risk of cross-border data transfers. Azure Monitor can also be used purely on the server side without the browser SDK.

Your cookie policy should list ai_user (duration 1 year, purpose analytics user identifier), ai_session (duration 30 minutes, purpose session identifier) and ai_authUser (duration session, purpose authenticated user identifier). Describe the data controller as Microsoft Corporation, the purpose as website performance monitoring, and the legal basis as consent. Reference the US data transfer safeguards if your Azure workspace is not in the EU.