Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Reactful is a behavioral personalization and real time engagement tool that tracks mouse movement, scrolling and on page behavior, sets cookies and transfers data to North America, so consent is required.
Reactful is a behavioral personalization and real time engagement platform aimed at website conversion optimization. It observes how visitors interact with a page, including mouse movement, scrolling, clicks and hesitation, and uses that signal to trigger personalized actions such as messages, nudges or content changes. The provider operates from North America, with processing in the United States and Canada. It is used by marketing and growth teams to lift engagement and conversion.
Reactful sets cookies and uses browser storage to recognise visitors and to maintain state across a session and between visits. It collects behavioral signals such as mouse coordinates, scroll depth, clicks, timing and navigation, together with technical metadata like the page, referrer, device and browser. This behavioral data can be linked to a persistent identifier, which makes it personal data even without a name. The combination supports profiling of how an individual behaves in order to personalize what they see.
Setting cookies and reading device storage for personalization is not strictly necessary, so it falls under Art. 5(3) of the ePrivacy Directive and requires prior consent. The behavioral monitoring and profiling are personal data processing under the GDPR, which needs a lawful basis, transparency under Art. 13 and a processor agreement. Because the tool profiles individuals to influence their behavior, regulators expect a careful necessity and proportionality analysis. This is a higher risk use case than simple analytics.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You should obtain freely given, specific, informed and unambiguous consent before Reactful sets cookies or begins behavioral tracking. The tool must not load its tracking and personalization logic until the user has agreed, and declining must be as easy as accepting. Consent should be specific to personalization and profiling, not bundled with unrelated purposes. Keep records of consent and provide an easy way to withdraw it that stops the tracking.
Reactful processes data in the United States and Canada, both third countries from a European perspective. Canada has a partial adequacy decision that does not cover all situations, and the United States requires either reliance on the EU US Data Privacy Framework where the importer is certified or Standard Contractual Clauses with a transfer impact assessment. You should confirm which mechanism applies, document it and add supplementary measures where needed. Map the data flows so you know exactly what leaves the European Economic Area.
Sign the Reactful data processing agreement and review where data is processed. Load the Reactful script only after consent through your consent management platform, so no cookies or tracking start beforehand. Configure the tool to minimise data, avoid capturing sensitive fields and set a sensible retention period. Complete a data protection impact assessment, document your transfer mechanism for the United States and Canada, and describe Reactful clearly in your privacy notice and cookie policy.
Websites using Reactful must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is strongly recommended. Reactful systematically monitors mouse movement, scrolling, clicks and other on page behavior to build a real time understanding of each visitor and to trigger personalized actions, which is large scale behavioral tracking. Combined with cookies, persistent identifiers and transfers to the United States and Canada, this meets several criteria for a mandatory assessment. Document the necessity, the profiling logic, the safeguards and the transfer mechanism.
Sample consent text
This site uses Reactful to personalize your experience. With your consent, Reactful sets cookies and analyzes your behavior such as mouse movement, scrolling and clicks to tailor content in real time, and may transfer this data to the United States and Canada. You can accept or decline, and you can change your choice at any time.
Third-party domains contacted
reactful.comcdn.reactful.comapi.reactful.comapp.reactful.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| reactful_uid | third party | persistent | Stores a persistent visitor identifier used to recognise returning visitors and link behavioral signals for personalization. |
| reactful_session | third party | session | Maintains the current session so behavioral tracking and personalization stay consistent across pages. |
| reactful_seg | third party | persistent | Records the behavioral segment or personalization state assigned to the visitor for real time engagement actions. |
Reactful collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Reactful sets cookies and uses browser storage to recognise visitors, maintain session state and link behavioral signals to a persistent identifier. Typical entries include a visitor identifier cookie and a session cookie that support personalization across pages and visits. Because these are not strictly necessary, they require consent. You should list them in your cookie policy with their purpose and duration.
Yes. Reactful sets non essential cookies and carries out behavioral tracking and profiling, both of which require prior consent under Art. 5(3) ePrivacy and the GDPR. The script should not load and no cookies should be set until the user has agreed. Declining must be as easy as accepting. Consent should be specific to personalization and profiling.
The lawful basis is consent under Art. 6(1)(a) GDPR, aligned with the ePrivacy consent for cookies and device access. Legitimate interest is generally not appropriate here because the processing involves profiling to influence behavior, which weighs against the individual. The provider acts as your processor, so an Art. 28 data processing agreement is also required. Document the basis and the consent flow.
Yes. Reactful processes data in the United States and Canada. The United States transfer needs either the EU US Data Privacy Framework where the importer is certified or Standard Contractual Clauses with a transfer impact assessment. Canada has only partial adequacy, so confirm whether your use is covered. Document the mechanism and add supplementary measures where needed.
Very likely yes. Systematic behavioral monitoring and profiling of visitors on a large scale, combined with cookies, persistent identifiers and third country transfers, triggers several criteria for a data protection impact assessment. You should assess necessity, proportionality and the risk that profiling poses to individuals. Document the safeguards and the residual risk before launch.
Sign the data processing agreement, then load Reactful only after consent through your consent management platform so nothing tracks beforehand. Minimise the data captured, exclude sensitive fields and set a sensible retention period. Complete your DPIA and transfer impact assessment, and describe the personalization and profiling clearly in your privacy notice. Provide an easy way to withdraw consent that stops the tracking.
Yes. If you only need usage measurement, privacy first cookieless analytics avoids most consent and transfer issues. For personalization, EU hosted tools reduce transfer complexity, and rule based personalization that does not profile individuals can be lighter on consent. Choose the least intrusive approach that meets your conversion goal, and reserve behavioral profiling for cases where it is genuinely justified.
List the Reactful cookies and storage entries with their names, purpose and duration, and explain that they support behavioral personalization and profiling. State that Reactful acts as a processor and that data is transferred to the United States and Canada under the relevant safeguards. Explain how users can give and withdraw consent. Keep the policy aligned with the actual cookies the tool sets.