Rudderstack

What RudderStack is and how it fits in a website stack

RudderStack is an open source, warehouse first customer data platform that captures events from web and mobile applications, the server side and even other data sources, then routes those events to a wide range of destinations: data warehouses (Snowflake, BigQuery, Redshift, Databricks), analytics tools (GA4, Amplitude, Mixpanel), marketing platforms (Meta, Google Ads, Klaviyo), reverse ETL connectors and customer support systems. Engineers consume RudderStack through the rudder-sdk-js library on the website, through server side SDKs in Node.js, Python, Java and Go and through transformation pipelines.

What data RudderStack collects

RudderStack collects identify, track, page, screen, group and alias events that include a user identifier or anonymous identifier, the page URL and Referer, the User Agent, the IP address, custom properties, traits and event context. By default the JavaScript SDK persists a pseudonymous anonymous_id in a first party cookie or in localStorage so that events can be tied to the same visitor over time. Server side events can be sent without any cookie. The platform also keeps queues, dead letter logs and audit trails that contain personal data.

GDPR and ePrivacy implications

RudderStack handles tracking events that are by nature analytics or marketing data, which triggers the ePrivacy consent rule for the JavaScript SDK and the GDPR consent requirement under Article 6(1)(a) for events routed to analytics or advertising destinations. Strict server side or transactional events that are necessary to operate the service can rely on performance of a contract under Article 6(1)(b) GDPR, while abuse and fraud signals can be processed under legitimate interest under Article 6(1)(f) GDPR. RudderStack offers a native consent management integration that propagates the consent state to each downstream destination.

International data transfers

RudderStack Cloud offers an EU region (eu-west-1 Dublin) alongside US and APAC. Even with an EU workspace, account, billing and observability data are processed in the United States. Transfers rely on the RudderStack Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework, with TLS 1.3, encryption at rest, SOC 2 Type II, ISO 27001 and HIPAA (with a BAA) controls. Customers who require the strictest residency can self host RudderStack open source on AWS, GCP, Azure or OVHcloud in the EU.

Practical compliance steps

Sign the RudderStack Data Processing Addendum, deploy your workspace in eu-west-1 or self host the open source distribution in the EU, integrate a consent management platform so that the JavaScript SDK only fires after consent, and configure destination level filtering to forward events only to consented destinations. Document the RudderStack pipeline in your record of processing activities, set short event retention windows in the warehouse, and review downstream destinations that may push personal data outside the EU.