PostHog

PostHog sets a first party cookie named ph_<project_id>_posthog with a pseudonymous distinct_id used to stitch events together. It can also use localStorage and sessionStorage to keep configuration and the replay buffer. No third party cookie is set by default.

PostHog sets a first party cookie ph_<your_project_token>_posthog that stores the distinct_id and feature flag values. Without cookies, the SDK can also use localStorage.

Yes, in the default configuration. The PostHog SDK stores and reads identifiers on the visitor terminal and processes IPs and behavioural data, which triggers article 5(3) of the ePrivacy Directive and article 6(1)(a) GDPR. Use PostHog opt out APIs to delay loading until the user accepts your analytics consent.

Yes for product analytics, session replay and personalised feature flags. Anonymous, server side measurement with no persistent identifier may rely on legitimate interest in narrow cases.

The standard legal basis is article 6(1)(a) GDPR (consent). Legitimate interest under article 6(1)(f) GDPR can be considered only when the SDK is configured for minimal anonymous event counting, with IPs masked, no replay and no fingerprinting, and after a documented balancing test.

Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. Legitimate interest can apply only for strictly anonymous analytics without persistent identifiers.

PostHog Cloud US is hosted in the United States, so the answer is yes for that region. PostHog Cloud EU is hosted on AWS in Frankfurt, with no systematic US transfer. Self hosted PostHog stays within the operator infrastructure; pick the EU region or self host to keep data inside the EEA.

Yes by default on US Cloud. EU Cloud (Frankfurt) keeps data in the EU. Self hosting in the EU removes the transfer entirely.

A DPIA is recommended when session replay or heatmaps are enabled, when PostHog Cloud US is selected for EU users, when PostHog tracks sensitive verticals such as health and finance, or when used for large scale behavioural profiling. Plain anonymous event counting on PostHog Cloud EU is usually below the DPIA threshold.

Recommended, especially for session replay and personalised feature flags that can profile users.

Pick PostHog Cloud EU or self host, sign the PostHog DPA, integrate the SDK behind your CMP, mask sensitive elements in session replay, set a short retention, route the SDK through a reverse proxy on your domain to limit cross site cookies and document everything in the record of processing.

Pick EU Cloud, set opt_out_capturing_by_default, gate posthog.opt_in_capturing() behind your CMP, mask sensitive fields in replay and sign the DPA.

Matomo, Plausible, Fathom, Mixpanel, Amplitude, Heap, Snowplow. EU based options simplify compliance.

Comparable analytics and product analytics tools include Plausible, Matomo, Pirsch, Snowplow, Amplitude, Mixpanel, Heap and Statsig. EU based or self hosted options (Matomo, Plausible, Pirsch, Snowplow Self Hosted, PostHog Self Hosted) are best for an EU centric audience.

List the PostHog cookie name, the pseudonymous identifier, the retention and the purpose. State whether you use PostHog Cloud US, Cloud EU or self hosted, the transfer mechanism if applicable, and whether session replay is enabled. Link to the PostHog privacy notice and to your CMP preference centre.

Document the ph_*_posthog cookie, its purpose and duration, plus localStorage usage if active.