Mixpanel

Yes. Mixpanel stores a persistent distinct_id in localStorage or cookies to track individual users. This requires consent under the ePrivacy Directive before the Mixpanel SDK loads. Block Mixpanel via your CMP and call mixpanel.opt_out_tracking() when users decline.

Yes. Mixpanel launched EU data residency (Amsterdam) in 2023. Set api_host to api-eu.mixpanel.com in your Mixpanel SDK initialisation. EU residency ensures data never leaves the EU and eliminates the need for SCCs.

Consent (Art. 6(1)(a)) for client-side tracking via localStorage and cookies. Server-side event tracking without client-side storage may rely on legitimate interest for aggregate analytics, but the default Mixpanel client SDK requires consent.

Yes. Sign the Mixpanel Data Processing Agreement before using Mixpanel on EU-facing products. For US-hosted deployments, the DPA includes SCCs. For EU region deployments, the DPA covers EU-resident processing.

Use the Mixpanel Deletion API (POST /engage#delete-profile endpoint) to delete user profiles by distinct_id. Submit deletion requests within 30 days of receiving the erasure request. Mixpanel processes deletions and removes data from systems and backups.

Yes. Use anonymous distinct_ids (random UUIDs) rather than email addresses. Avoid user properties containing names, emails, or other PII. Implement server-side ID stitching if you need to link anonymous events to identified users after consent.

Recommended for large-scale deployments. Mixpanel processes individual-level behavioural data which can create detailed user profiles. Use EU data residency to simplify the transfer component of the DPIA.

EU-based product analytics alternatives include PostHog (self-hostable, EU cloud), Piwik PRO (EU-based), and Amplitude (EU region available). Mixpanel itself with EU residency enabled is a strong GDPR-compliant option.

Mixpanel prefers localStorage to store distinct_id. When localStorage is unavailable a first party cookie mp_<token>_mixpanel is set (12 months). No third party cookies are deposited by the SDK itself.

Yes. Mixpanel stores a persistent identifier and tracks behavioural events, both non essential. Prior consent is required under Art. 5(3) ePrivacy. Recent CNIL and DSK guidance confirms that localStorage access is subject to the same consent obligation as cookies.

Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for the SDK. Contract performance (Art. 6(1)(b)) can apply to logged in product analytics needed to deliver the contracted feature, but only with proper notice.

By default yes (AWS US). EU residency (Frankfurt) is available on Enterprise plans by setting api_host to https://api eu.mixpanel.com. Admin plane and support remain in the US. Transfers covered by EU SCCs and the EU US Data Privacy Framework.

A DPIA is recommended for user level analytics at scale or when Mixpanel is combined with logged in identifiers. Document the EU/US data flow and retention.

Provision the EU project, sign the DPA, block the SDK behind your CMP, disable IP collection (ip:false), wire opt_out_tracking to the CMP, mask sensitive event properties, set a short retention, document Mixpanel in the Article 30 record.

Privacy first product analytics: PostHog (EU/US, can self host), Amplitude (US), Heap (US, Contentsquare), Pendo (US), June.so (Switzerland), Plausible (EU, simpler analytics), Matomo (EU). For self hosting: PostHog Open Source.

List the mp_<token>_mixpanel cookie and the distinct_id localStorage entry. Mention the EU US Data Privacy Framework, the chosen residency region (EU or US) and link to Mixpanel's privacy policy.