> Using Reactful behavioural personalisation under the GDPR: the cookies it sets, consent requirements, US and Canada data transfers and DPIA needs. > > Canonical: https://www.flowconsent.com/en/services/analytics/reactful Analytics # Reactful Analytics Reactful is a behavioral personalization and real time engagement tool that tracks mouse movement, scrolling and on page behavior, sets cookies and transfers data to North America, so consent is required. [Block Reactful until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Operated from North America with personal data processed in the United States and Canada Overview ## What does Reactful do? ## **What Reactful is** Reactful is a behavioral personalization and real time engagement platform aimed at website conversion optimization. It observes how visitors interact with a page, including mouse movement, scrolling, clicks and hesitation, and uses that signal to trigger personalized actions such as messages, nudges or content changes. The provider operates from North America, with processing in the United States and Canada. It is used by marketing and growth teams to lift engagement and conversion. ## **What data and cookies it collects** Reactful sets cookies and uses browser storage to recognise visitors and to maintain state across a session and between visits. It collects behavioral signals such as mouse coordinates, scroll depth, clicks, timing and navigation, together with technical metadata like the page, referrer, device and browser. This behavioral data can be linked to a persistent identifier, which makes it personal data even without a name. The combination supports profiling of how an individual behaves in order to personalize what they see. ## **GDPR and ePrivacy implications** Setting cookies and reading device storage for personalization is not strictly necessary, so it falls under Art. 5(3) of the ePrivacy Directive and requires prior consent. The behavioral monitoring and profiling are personal data processing under the GDPR, which needs a lawful basis, transparency under Art. 13 and a processor agreement. Because the tool profiles individuals to influence their behavior, regulators expect a careful necessity and proportionality analysis. This is a higher risk use case than simple analytics. ## **Consent requirements** You should obtain freely given, specific, informed and unambiguous consent before Reactful sets cookies or begins behavioral tracking. The tool must not load its tracking and personalization logic until the user has agreed, and declining must be as easy as accepting. Consent should be specific to personalization and profiling, not bundled with unrelated purposes. Keep records of consent and provide an easy way to withdraw it that stops the tracking. ## **International data transfers** Reactful processes data in the United States and Canada, both third countries from a European perspective. Canada has a partial adequacy decision that does not cover all situations, and the United States requires either reliance on the EU US Data Privacy Framework where the importer is certified or Standard Contractual Clauses with a transfer impact assessment. You should confirm which mechanism applies, document it and add supplementary measures where needed. Map the data flows so you know exactly what leaves the European Economic Area. ## **Practical compliance steps** Sign the Reactful data processing agreement and review where data is processed. Load the Reactful script only after consent through your consent management platform, so no cookies or tracking start beforehand. Configure the tool to minimise data, avoid capturing sensitive fields and set a sensible retention period. Complete a data protection impact assessment, document your transfer mechanism for the United States and Canada, and describe Reactful clearly in your privacy notice and cookie policy. Compliance ## Reactful and the GDPR Reactful is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Art. 6(1)(a) GDPR for the storage of and access to information on the device under Art. 5(3) ePrivacy Directive and for behavioral profiling, with legitimate interest generally inappropriate because the processing profiles individuals to influence their behavior - Risk level high - Applicable regulations GDPR, ePrivacy Directive, EU US Data Privacy Framework, Standard Contractual Clauses ### Impact assessment (DPIA) A data protection impact assessment is strongly recommended. Reactful systematically monitors mouse movement, scrolling, clicks and other on page behavior to build a real time understanding of each visitor and to trigger personalized actions, which is large scale behavioral tracking. Combined with cookies, persistent identifiers and transfers to the United States and Canada, this meets several criteria for a mandatory assessment. Document the necessity, the profiling logic, the safeguards and the transfer mechanism. ### Sample text for your banner > This site uses Reactful to personalize your experience. With your consent, Reactful sets cookies and analyzes your behavior such as mouse movement, scrolling and clicks to tailor content in real time, and may transfer this data to the United States and Canada. You can accept or decline, and you can change your choice at any time. Cookies and trackers ## What Reactful sets and contacts - Tracking method Client side JavaScript that monitors on page behavior in real time, including mouse movement, scrolling, clicks, timing and navigation, links these signals to a persistent visitor identifier stored in cookies and browser storage, and triggers personalized engagement actions - Server location Operated from North America with personal data processed in the United States and Canada - Data transferred outside the EU Reactful processes personal data in the United States and Canada, both third countries from a European perspective. Canada benefits only from a partial adequacy decision that does not cover all situations, and the United States transfer relies on the EU US Data Privacy Framework where the importer is certified or otherwise on Standard Contractual Clauses with a transfer impact assessment and supplementary measures. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------------- | ----------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------- | | reactful\_uid | third party | persistent | Stores a persistent visitor identifier used to recognise returning visitors and link behavioral signals for personalization. | | reactful\_session | third party | session | Maintains the current session so behavioral tracking and personalization stay consistent across pages. | | reactful\_seg | third party | persistent | Records the behavioral segment or personalization state assigned to the visitor for real time engagement actions. | ### Third-party domains contacted (4) - `reactful.com` - `cdn.reactful.com` - `api.reactful.com` - `app.reactful.com` Questions ## Frequently asked questions about Reactful Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Reactful set? Reactful sets cookies and uses browser storage to recognise visitors, maintain session state and link behavioral signals to a persistent identifier. Typical entries include a visitor identifier cookie and a session cookie that support personalization across pages and visits. Because these are not strictly necessary, they require consent. You should list them in your cookie policy with their purpose and duration. ### Is consent required for Reactful? Yes. Reactful sets non essential cookies and carries out behavioral tracking and profiling, both of which require prior consent under Art. 5(3) ePrivacy and the GDPR. The script should not load and no cookies should be set until the user has agreed. Declining must be as easy as accepting. Consent should be specific to personalization and profiling. ### What is the legal basis for processing? The lawful basis is consent under Art. 6(1)(a) GDPR, aligned with the ePrivacy consent for cookies and device access. Legitimate interest is generally not appropriate here because the processing involves profiling to influence behavior, which weighs against the individual. The provider acts as your processor, so an Art. 28 data processing agreement is also required. Document the basis and the consent flow. ### Does Reactful transfer data to the US? Yes. Reactful processes data in the United States and Canada. The United States transfer needs either the EU US Data Privacy Framework where the importer is certified or Standard Contractual Clauses with a transfer impact assessment. Canada has only partial adequacy, so confirm whether your use is covered. Document the mechanism and add supplementary measures where needed. ### Is a DPIA needed for Reactful? Very likely yes. Systematic behavioral monitoring and profiling of visitors on a large scale, combined with cookies, persistent identifiers and third country transfers, triggers several criteria for a data protection impact assessment. You should assess necessity, proportionality and the risk that profiling poses to individuals. Document the safeguards and the residual risk before launch. ### How do I implement Reactful compliantly? Sign the data processing agreement, then load Reactful only after consent through your consent management platform so nothing tracks beforehand. Minimise the data captured, exclude sensitive fields and set a sensible retention period. Complete your DPIA and transfer impact assessment, and describe the personalization and profiling clearly in your privacy notice. Provide an easy way to withdraw consent that stops the tracking. ### Are there alternatives to Reactful? Yes. If you only need usage measurement, privacy first cookieless analytics avoids most consent and transfer issues. For personalization, EU hosted tools reduce transfer complexity, and rule based personalization that does not profile individuals can be lighter on consent. Choose the least intrusive approach that meets your conversion goal, and reserve behavioral profiling for cases where it is genuinely justified. ### How do I update my cookie policy for Reactful? List the Reactful cookies and storage entries with their names, purpose and duration, and explain that they support behavioral personalization and profiling. State that Reactful acts as a processor and that data is transferred to the United States and Canada under the relevant safeguards. Explain how users can give and withdraw consent. Keep the policy aligned with the actual cookies the tool sets. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Acquia Customer Data Platform](https://www.flowconsent.com/en/services/analytics/acquia-customer-data-platform) [Acquia Customer Data Platform is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Acquia Customer Data Platform provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Acquia Customer Data Platform ensures optimal performance at scale.](https://www.flowconsent.com/en/services/analytics/acquia-customer-data-platform) [Analytics](https://www.flowconsent.com/en/services/analytics/acquia-customer-data-platform) · ### [Powster](https://www.flowconsent.com/en/services/analytics/powster) [Powster is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Powster supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Powster enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/powster) [Analytics](https://www.flowconsent.com/en/services/analytics/powster) · ### [Heap](https://www.flowconsent.com/en/services/analytics/heap) [Heap is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Heap supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Heap enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/heap) [Analytics](https://www.flowconsent.com/en/services/analytics/heap) · ### [UI Avenue](https://www.flowconsent.com/en/services/analytics/ui-avenue) [UI Avenue is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. UI Avenue offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, UI Avenue empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/ui-avenue) [Analytics](https://www.flowconsent.com/en/services/analytics/ui-avenue) · ### [Splunk RUM](https://www.flowconsent.com/en/services/analytics/splunk-rum) [Splunk RUM is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Splunk RUM enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Splunk RUM empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/analytics/splunk-rum) [Analytics](https://www.flowconsent.com/en/services/analytics/splunk-rum) · ### [CaliberMind](https://www.flowconsent.com/en/services/analytics/calibermind) [CaliberMind is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. CaliberMind offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, CaliberMind empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/calibermind) [Analytics](https://www.flowconsent.com/en/services/analytics/calibermind) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)