Segment
Segment (by Twilio) is a Customer Data Platform (CDP) that collects user events from websites and apps, and routes them to hundreds of downstream analytics, marketing, and data warehouse tools. As a central data router, Segment multiplies the GDPR compliance surface area: every connected destination tool inherits Segment-collected personal data, and each destination requires its own lawful basis and transfer mechanism. Consent routing in Segment (blocking events per destination until the relevant consent category is given) is essential for GDPR-compliant deployments.
What does Segment do?
What is Segment?
Segment is a Customer Data Platform (CDP) that serves as a central hub for collecting, standardising, and routing user event data to downstream tools. Instead of installing multiple analytics and marketing SDKs on a website or app, developers install Segment once, then configure which events are forwarded to which destination tools (Google Analytics, Mixpanel, Amplitude, Salesforce, Klaviyo, etc.). Segment currently integrates with over 300 destination tools, making it the backbone of many marketing and analytics technology stacks.
Why Segment multiplies GDPR complexity
Segment's routing architecture means that personal data collected by the Segment SDK is forwarded to every enabled destination. Each destination has its own GDPR requirements: its own legal basis, its own DPA, its own transfer mechanism if US-hosted. If you have 15 destinations connected to Segment, you effectively have 15 separate GDPR compliance obligations for the same underlying data. This makes Segment deployments among the most complex GDPR compliance scenarios.
Consent routing: the essential configuration
Segment provides consent management features that allow events to be routed to specific destinations only when the relevant consent category has been given. For example, if a user consents to analytics but not advertising, Segment should forward events to Mixpanel (analytics) but not to Klaviyo (marketing). Configure Segment's consent object to map consent categories to destination groups. Integrate with your CMP to pass consent signals to Segment's consent APIs.
Practical compliance steps
Sign the Segment DPA and SCCs. Audit all connected destinations and sign DPAs with each. Implement consent routing so events are only forwarded to destinations with valid consent. Block the Segment analytics.js SDK until base analytics consent is given. Configure Segment Protocols to enforce data schemas that exclude PII from event properties. Implement the Segment Deletion and Suppression API for erasure requests: this propagates deletions to supported downstream destinations.
Segment and the GDPR
Segment is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) required for client-side tracking cookies and localStorage. As a CDP routing data to multiple destinations, Segment multiplies the GDPR surface area: each destination tool must have its own lawful basis. Implementing consent routing in Segment (blocking destination-specific events until relevant consent is given) is essential.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, SCCs for US transfers. Each destination tool requires its own GDPR assessment.
Impact assessment (DPIA)
A DPIA is strongly recommended for Segment deployments. As a CDP routing personal data to multiple destination systems, the cumulative privacy risk of all connected destinations must be assessed together. Document all destinations, their legal bases, transfer mechanisms, and consent requirements.
Sample text for your banner
This website uses Segment to collect analytics data and route it to our analytics and marketing tools. Segment and its destination tools may process your data in the US. You can manage which tracking categories are active in your cookie preferences.
What Segment sets and contacts
- Tracking method
- Customer Data Platform (CDP), JavaScript analytics.js library, server-side tracking, data pipeline routing to 300+ destinations, identity resolution, event collection
- Server location
- United States (Segment/Twilio is a US company)
- Data transferred outside the EU
- Segment (acquired by Twilio) is a US-based Customer Data Platform. All data collection and routing occurs on US infrastructure. EU personal data transfers require Standard Contractual Clauses. Segment provides a GDPR-compliant DPA. As a data router, Segment forwards EU personal data to all configured destination tools, each of which may require its own transfer mechanism.
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ajs_anonymous_id | persistent | 1 year | Segment anonymous user identifier for event tracking before user identification |
| ajs_user_id | persistent | 1 year | Segment identified user ID linking events to known user profiles across sessions |
Third-party domains contacted (3)
segment.comcdn.segment.comapi.segment.io
Frequently asked questions about Segment
Can't find your question? Write to us, we answer fast.
Does Segment require GDPR consent?
Yes. Segment's analytics.js sets cookies and localStorage identifiers requiring consent. Additionally, each destination Segment routes data to may require its own consent category. Implement consent routing to block destination-specific flows until relevant consent is given.
How does Segment consent routing work?
Segment maps consent categories to destination groups. Events only flow to a destination when the corresponding consent category is confirmed. Integrate with a CMP like OneTrust or Cookiebot that supports Segment consent routing.
Does Segment transfer data outside the EU?
Yes. All Segment data is processed in the US requiring SCCs. Every US-hosted destination tool also requires its own transfer mechanism. Sign the Segment DPA which includes SCCs.
What legal basis applies to Segment?
Consent for the Segment SDK itself. Each destination requires its own legal basis: analytics may use consent, CRM may use legitimate interest or contract performance, advertising requires consent.
Do I need a DPIA for Segment?
Yes. As a CDP routing data to multiple systems, assess the cumulative risk across all destinations in a single DPIA covering all active destinations, data categories, legal bases, and transfer mechanisms.
How do I handle erasure requests in Segment?
Use the Segment Privacy Portal API (DELETE /regulations) to submit deletion requests. Segment deletes from its systems and propagates requests to supported downstream destinations.
Can I use Segment server-side to avoid cookie consent?
Server-side tracking avoids client-side cookies. However, if the data still relates to individual users from browser sessions, GDPR obligations remain regardless of where the tracking code runs.
Are there EU-based alternatives to Segment CDP?
Rudderstack (self-hostable, EU cloud), Piwik PRO Tag Manager (EU-based), and mParticle (EU options) are the main alternatives.
Sitefinity Insight
Sitefinity Insight is a web analytics platform that provides businesses with actionable insights into website traffic, user behavior, and conversion performance. It offers real-time data collection, customizable dashboards, and advanced reporting to help organizations understand their audience. Sitefinity Insight supports event tracking, funnel analysis, and audience segmentation, enabling data-driven decision making that improves user experience and drives business growth across digital channels.
Hotjar Incoming Feedback
Hotjar Incoming Feedback is a survey and feedback collection platform that helps businesses gather valuable customer insights through customizable questionnaires, polls, and NPS surveys. It offers advanced logic branching, multi-channel distribution, and real-time analytics. Hotjar Incoming Feedback enables organizations to measure customer satisfaction, collect product feedback, and conduct market research. Its reporting tools transform raw feedback data into actionable insights.
Yxper
Yxper is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Yxper offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Yxper empowers organizations to optimize strategy and maximize return on investment.
Pingdom Uptime Monitoring
Pingdom Uptime Monitoring is a website monitoring and uptime tracking solution that ensures your digital properties remain available and performant around the clock. It provides real-time alerts, status page hosting, and detailed performance reports. Pingdom Uptime Monitoring monitors websites, APIs, and servers from multiple global locations, detecting downtime and degradation before they impact users. With incident management and SLA tracking, Pingdom Uptime Monitoring helps maintain reliability and trust.
Alloka
Alloka is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Alloka supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Alloka enables informed decisions that improve experience and drive results.
MARS FLAG
Mars Flag is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Mars Flag offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Mars Flag empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.