> How Qualaroo on-site surveys collect responses and set cookies, which GDPR and ePrivacy obligations apply and what US data transfers involve. > > Canonical: https://www.flowconsent.com/en/services/analytics/qualaroo Analytics # Qualaroo Analytics · [Official website](https://qualaroo.com) Qualaroo is an on-site survey and Nudge tool by ProProfs that targets website visitors with contextual micro-surveys using cookies and optional user identity data. Because it sets tracking cookies and transfers data to US servers, it requires explicit visitor consent under GDPR and the ePrivacy Directive. [Block Qualaroo until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers United States (AWS) Overview ## What does Qualaroo do? ## **What Is Qualaroo and How Does It Track Visitors** Qualaroo, now part of the ProProfs suite, is an on-site survey platform that delivers targeted micro-surveys called Nudges to website visitors and app users. It loads a JavaScript snippet hosted on Amazon S3 (s3.amazonaws.com) and communicates with its collection endpoint at cl.qualaroo.com. The tool uses browser cookies to identify returning visitors, control survey frequency, and record whether a user has already responded to a particular survey. Survey targeting can be refined using the Qualaroo Identity API, which allows operators to pass user properties such as an email address, a user ID, account plan, or other custom traits. These properties are used to segment audiences and personalise which survey a visitor sees. When identity data is passed, Qualaroo associates survey responses with a specific individual, making the data unambiguously personal under GDPR. ## **Data and Cookies Collected** Qualaroo sets several cookies in the visitor's browser. The primary cookie records whether the visitor has seen or responded to a survey and stores a unique visitor identifier. Additional cookies control throttling and survey suppression logic. The tool collects survey responses (which may include free-text answers containing personal information), technical metadata such as the page URL and referrer, and any user properties explicitly passed via the identity API. All collected data is transmitted to and stored on Qualaroo's AWS-based infrastructure in the United States. ## **GDPR and ePrivacy Implications** Under the ePrivacy Directive (implemented as national cookie laws across the EU), storing or accessing cookies on a user's device requires prior informed consent unless the cookie is strictly necessary for a service explicitly requested by the user. Survey and targeting cookies set by Qualaroo are not strictly necessary and therefore require opt-in consent before the Qualaroo script is loaded. Under GDPR, the processing of personal data collected through surveys requires a valid lawful basis. Given the targeting and profiling capabilities of the tool, consent under Article 6(1)(a) is the most appropriate and defensible basis for EEA visitors. ## **International Data Transfers** Because Qualaroo processes data on AWS servers in the United States, any use by EEA-based organisations constitutes a transfer of personal data to a third country under Chapter V of GDPR. ProProfs participates in the EU-US Data Privacy Framework (DPF), which provides an adequacy decision for transfers to certified US organisations. Operators should verify that the current certification is valid at the time of deployment and document this in their Records of Processing Activities (RoPA). As a belt-and-braces measure, many organisations also rely on Standard Contractual Clauses (SCCs) alongside DPF certification. ## **Consent Requirements and Implementation** Qualaroo must be classified under a consent-required category in your Consent Management Platform (CMP). The script tag or tag manager trigger should only fire after the visitor has actively accepted the relevant cookie category (typically labelled as Analytics, Feedback, or Research). The consent signal must be granular, freely given, specific, and informed. Pre-ticked boxes or implied consent are not valid under GDPR. ## **Practical Compliance Steps for Operators** To deploy Qualaroo compliantly in the EU: gate the S3-hosted script behind CMP consent; list all Qualaroo cookies (name, purpose, duration) in your cookie policy and CMP cookie declaration; include qualaroo.com and cl.qualaroo.com as third-party service providers in your Privacy Policy; sign a Data Processing Agreement (DPA) with ProProfs; document the transfer mechanism (DPF or SCCs) in your RoPA; and consider a DPIA if using identity data or conducting large-scale profiling. Provide visitors with a clear description of what Qualaroo does in your consent notice. Compliance ## Qualaroo and the GDPR Qualaroo is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) is required before loading the Qualaroo script and setting cookies. Legitimate interest may apply only for purely functional, non-tracking use cases, but survey targeting and profiling require explicit opt-in. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU-US Data Privacy Framework (DPF), CCPA ### Impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) should be considered when deploying Qualaroo for large-scale visitor profiling or when combining survey responses with other behavioural data. Key risk areas include: the transfer of personal data to the United States under AWS infrastructure; the use of persistent cookies to recognise returning visitors; the potential to collect sensitive information through open-ended survey questions; and the linking of survey responses to user identity via the traits API. Organisations should document the lawful basis for each processing activity, assess the necessity and proportionality of the data collected, and implement appropriate safeguards such as SCCs or reliance on the EU-US DPF before deployment. ### Sample text for your banner > We would like to use Qualaroo to display short surveys on this website to help us improve our service. Qualaroo uses cookies to recognise your visit and may transfer your responses to servers in the United States. Your participation is entirely voluntary. Please click "Accept" to allow survey cookies, or "Decline" to continue without them. Cookies and trackers ## What Qualaroo sets and contacts - Tracking method JavaScript snippet (S3-hosted), first-party and session cookies, optional user identity via traits API - Server location United States (AWS) - Data transferred outside the EU Survey response data and visitor identifiers are processed on AWS infrastructure in the United States. Qualaroo (ProProfs) relies on the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) as transfer mechanisms for EEA personal data. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------ | | \_qualaroo\_session | persistent | 1 year | Stores a unique visitor identifier used to recognise returning visitors and control survey display frequency across sessions. | | \_qualaroo\_s | persistent | 1 year | Records which surveys the visitor has already seen or completed to prevent repeated display of the same Nudge. | | \_qualaroo\_t | session | Session | Controls survey throttling and suppression logic within a single browsing session. | | \_qualaroo\_identity | persistent | 1 year | Stores user identity traits passed via the Qualaroo Identity API to enable targeted survey delivery to specific user segments. | ### Third-party domains contacted (3) - `qualaroo.com` - `cl.qualaroo.com` - `s3.amazonaws.com` Questions ## Frequently asked questions about Qualaroo Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Qualaroo set in visitors' browsers? Qualaroo sets a primary visitor identifier cookie that persists between sessions to recognise returning visitors and prevent survey repetition. It also sets session cookies to control survey display logic and throttling. The exact cookie names vary by account but are typically prefixed with "\_qualaroo" or similar identifiers. All cookies should be listed by name, purpose, and duration in your cookie declaration. ### Is visitor consent required before loading Qualaroo? Yes. Under the EU ePrivacy Directive, consent is required before Qualaroo sets any cookies on a visitor's device, as these cookies are not strictly necessary for a service the user has requested. Under GDPR, processing survey response data linked to identifiable individuals also requires a valid lawful basis, and consent is the most appropriate basis given the targeting and profiling features of the tool. ### What is the legal basis for processing data through Qualaroo? Consent under Article 6(1)(a) of GDPR is the recommended legal basis for deploying Qualaroo for EEA visitors, particularly when cookies are set or when the Identity API is used to link responses to individual users. Legitimate interest under Article 6(1)(f) might be argued for purely anonymous surveys without cookies, but this is difficult to sustain given Qualaroo's standard operation. Always document your chosen basis in your Records of Processing Activities. ### Does Qualaroo transfer data to the United States? Yes. Qualaroo is a US-based service operated by ProProfs, and all survey data is processed and stored on Amazon Web Services (AWS) infrastructure in the United States. This constitutes a transfer to a third country under GDPR Chapter V. ProProfs participates in the EU-US Data Privacy Framework (DPF), which provides an adequacy-equivalent mechanism. Operators should also consider executing Standard Contractual Clauses (SCCs) with ProProfs for additional legal certainty. ### Do I need a DPIA before deploying Qualaroo? A Data Protection Impact Assessment (DPIA) is recommended if you plan to use Qualaroo to profile visitors at scale, combine survey data with other behavioural datasets, or use the Identity API to link responses to individual users. A DPIA is mandatory under GDPR Article 35 when processing is "likely to result in a high risk" to individuals. Even if a full DPIA is not strictly required, documenting your risk assessment is good practice before deploying any third-party tool that transfers data to the US. ### How do I implement Qualaroo in a GDPR-compliant way? Integrate Qualaroo with your Consent Management Platform (CMP) so that the S3-hosted script only loads after the visitor has given explicit consent for the relevant cookie category. List all Qualaroo cookies in your cookie declaration, include Qualaroo and ProProfs in your Privacy Policy as sub-processors, sign a Data Processing Agreement (DPA) with ProProfs, and document the EU-US DPF or SCCs as the transfer mechanism in your Records of Processing Activities. Avoid using the Identity API unless you have a separate specific consent for that level of data linkage. ### What are privacy-friendly alternatives to Qualaroo? Privacy-friendly alternatives include Hotjar Ask (with EU data residency options), Typeform (with GDPR controls), or self-hosted open-source survey tools such as LimeSurvey, which can keep data entirely on your own infrastructure. For NPS-style surveys, tools with EU-based hosting or stronger data minimisation defaults may reduce compliance overhead. The right alternative depends on your feature requirements, audience size, and willingness to self-host. ### How do I update my cookie policy to include Qualaroo? Add a dedicated entry for Qualaroo in your cookie policy table, listing each cookie by name, type (analytics or targeting), duration, and purpose. Reference qualaroo.com and cl.qualaroo.com as the third-party domains involved. Update the service provider section of your Privacy Policy to name ProProfs as a data processor and describe the US data transfer. If you use an automated cookie scanner, scan after deploying Qualaroo to capture any newly detected cookies. Review and update at least annually or after any significant change to your Qualaroo configuration. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Plausible](https://www.flowconsent.com/en/services/analytics/plausible) [Plausible is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Plausible offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Plausible empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/plausible) [Analytics](https://www.flowconsent.com/en/services/analytics/plausible) · ### [Northbeam](https://www.flowconsent.com/en/services/analytics/northbeam) [Northbeam is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Northbeam offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Northbeam empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/northbeam) [Analytics](https://www.flowconsent.com/en/services/analytics/northbeam) · ### [Italiaonline](https://www.flowconsent.com/en/services/analytics/italiaonline) [Italiaonline is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Italiaonline supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Italiaonline enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/italiaonline) [Analytics](https://www.flowconsent.com/en/services/analytics/italiaonline) · ### [S\&P Global Mobility](https://www.flowconsent.com/en/services/analytics/s-p-global-mobility) [S\&P Global Mobility is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. S\&P Global Mobility supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, S\&P Global Mobility enables informed decisions that improve experience and.](https://www.flowconsent.com/en/services/analytics/s-p-global-mobility) [Analytics](https://www.flowconsent.com/en/services/analytics/s-p-global-mobility) · ### [Site24x7](https://www.flowconsent.com/en/services/analytics/site24x7) [Site24x7 is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Site24x7 provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Site24x7 helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/analytics/site24x7) [Analytics](https://www.flowconsent.com/en/services/analytics/site24x7) · ### [AiSpeed](https://www.flowconsent.com/en/services/analytics/aispeed) [AiSpeed is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. AiSpeed supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, AiSpeed remains a leading web development choice.](https://www.flowconsent.com/en/services/analytics/aispeed) [Analytics](https://www.flowconsent.com/en/services/analytics/aispeed) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)