> Is Sitefinity Insight GDPR compliant? Visitor profiling, contact data collection, US data transfers, consent requirements and steps for lawful use. > > Canonical: https://www.flowconsent.com/en/services/analytics/sitefinity-insight Analytics # Sitefinity Insight Analytics Sitefinity Insight is a customer data and digital experience analytics platform built into Progress Sitefinity CMS. It tracks visitor behaviour, builds individual contact profiles, segments audiences, and enables content personalisation based on interaction history. Because it profiles individual visitors and links anonymous behaviour to named contacts, its deployment on European websites requires prior consent under GDPR and the ePrivacy Directive. Data is processed in the US via Standard Contractual Clauses. [Block Sitefinity Insight until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States (Progress Software infrastructure, AWS) Overview ## What does Sitefinity Insight do? ## **What is Sitefinity Insight?** Sitefinity Insight is a built-in customer data and digital experience analytics module within the Progress Sitefinity CMS platform. It provides behavioural analytics, visitor journey tracking, contact profile management, audience segmentation, and content personalisation capabilities. When integrated with a Sitefinity-powered website, it tracks every page visit, content interaction, form submission, and conversion event, building individual contact profiles that persist across sessions. It acts as a customer data platform, enabling marketers to segment visitors and deliver targeted content without additional third-party tools. ## **What data does Sitefinity Insight collect?** Sitefinity Insight collects IP addresses, browser and device information, pages visited, time on page, scroll depth, content downloads, video interactions, form completions, and conversion events. It builds persistent contact profiles that link anonymous browsing sessions to identified contacts when a form is submitted or a login occurs. These profiles include interaction history, interest scores, segment membership, and lead scoring data. When integrated with a CRM, contact profiles can be enriched with sales and customer relationship data. ## **GDPR and ePrivacy implications** Sitefinity Insight's contact profiling and personalisation capabilities make it a high-risk tool under GDPR. The ePrivacy Directive requires consent before any tracking cookies are set. GDPR requires a lawful basis for building individual contact profiles. The automated linking of anonymous browsing data to named contacts (identity resolution) when a form is submitted is particularly sensitive and must be disclosed in your privacy policy. Content personalisation based on individual profiles requires that consent was obtained for the profiling activity. ## **Consent requirements** Consent must be obtained before Sitefinity Insight tracking scripts initialise. When using Sitefinity's built-in consent management, ensure it is configured to comply with GDPR requirements. The consent must cover both anonymous visitor analytics and the contact profile building that occurs when a form is submitted. Users must be informed that their browsing history will be linked to their contact profile and used for personalisation. Consent must be revocable, with immediate suppression of all tracking and profile updates. ## **Data transfers outside the EU** Progress Software Corporation is a US company and processes Sitefinity Insight data on US infrastructure. Standard Contractual Clauses apply as the transfer mechanism. Organisations using Sitefinity Insight should sign Progress Software's Data Processing Agreement, document the US transfer in their Records of Processing Activities, and ensure Sitefinity Insight is disclosed as a processor in their privacy policy. ## **Practical compliance steps** To use Sitefinity Insight compliantly: configure Sitefinity's consent management to block tracking until consent is obtained; categorise Sitefinity Insight cookies under analytics and personalisation; update your privacy policy to describe contact profile building and personalisation; sign a DPA with Progress Software; conduct a DPIA given the automated profiling; document the US transfer in your RoPA; configure contact data retention limits in the Insight admin panel; and ensure the right to erasure is implemented so that contact profiles and tracking history can be deleted on request. Compliance ## Sitefinity Insight and the GDPR Sitefinity Insight is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for behavioural tracking, visitor profiling, and personalisation cookies. Legitimate interest (Art. 6(1)(f)) may apply to basic, non-profiling analytics with a documented balancing test. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, CCPA ### Impact assessment (DPIA) A DPIA is recommended when Sitefinity Insight is used for automated visitor profiling at scale, personalisation based on individual interaction history, or when contact profiles are enriched with data from CRM or marketing systems. The combination of persistent cross-session visitor identification, contact profile building, and US data transfer warrants formal impact assessment. ### Sample text for your banner > We use Sitefinity Insight to analyse how visitors use our website and to personalise content based on your interaction history. Sitefinity Insight tracks pages visited, content engaged with, and form submissions to build a profile of your interests. This data is processed in the United States. Please accept to enable analytics and personalised content. Cookies and trackers ## What Sitefinity Insight sets and contacts - Tracking method JavaScript tracking script, first-party cookies, server-side analytics and visitor profiling, CDP data collection - Server location United States (Progress Software infrastructure, AWS) - Data transferred outside the EU Sitefinity Insight is a product of Progress Software Corporation, a US company. All analytics and visitor profile data is processed on US infrastructure. Transfers rely on Standard Contractual Clauses under GDPR Article 46. ### Cookies set (2) | Name | Type | Duration | Purpose | | ---------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------ | | sf\_insight\_vid | persistent | 1 year | Visitor identifier used to build persistent contact profiles and link anonymous browsing sessions to identified contacts | | sf\_session | session | Session | Session-level tracking cookie used to collect behavioural signals for real-time analytics and segment membership | ### Third-party domains contacted (3) - `progress.com` - `sitefinity.com` - `insight.sitefinity.com` Questions ## Frequently asked questions about Sitefinity Insight Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Sitefinity Insight set? Sitefinity Insight sets persistent first-party tracking cookies to maintain a visitor identifier across sessions, enabling the construction of individual contact profiles. It also sets session cookies for active visitor tracking. These cookies link anonymous browsing data to named contacts when a form is submitted, making them high-risk tracking cookies requiring prior consent. ### Does Sitefinity Insight require consent under GDPR? Yes. Sitefinity Insight sets tracking cookies and builds contact profiles, both of which require prior consent under the ePrivacy Directive and GDPR. Sitefinity CMS includes built-in consent management features that should be configured to block Insight tracking until consent is recorded. The consent must specifically cover both analytics tracking and contact profile building. ### What is the legal basis for using Sitefinity Insight? Consent under Article 6(1)(a) GDPR is required for behavioural tracking cookies and contact profile building. For basic, non-profiling page view analytics, legitimate interest under Article 6(1)(f) may apply with a documented balancing test. Once anonymous visitor data is linked to a named contact, consent is the appropriate basis for all subsequent profiling and personalisation activities. ### Does Sitefinity Insight transfer data outside the EU? Yes. Progress Software Corporation is a US company and processes Sitefinity Insight data on US infrastructure. Standard Contractual Clauses apply as the transfer mechanism under GDPR Article 46. Organisations should sign Progress Software's DPA and document the US transfer in their Records of Processing Activities. ### Do I need a DPIA for Sitefinity Insight? A DPIA is recommended when Sitefinity Insight is used for automated contact profiling at scale, lead scoring, or personalisation based on individual interaction history. The persistent cross-session contact profiling, automated segment membership, and US data transfer create a processing activity that warrants formal assessment under GDPR Article 35. ### How do I configure Sitefinity Insight for GDPR compliance? Use Sitefinity's built-in consent management to block all Insight tracking until consent is granted. Configure the consent categories to include analytics and personalisation separately. Set contact data retention limits in the Insight admin panel. Implement right-to-erasure functionality so contact profiles and tracking history can be deleted on request. Update your privacy policy and sign a DPA with Progress Software. ### Are there EU-hosted alternatives to Sitefinity Insight? Matomo Analytics can be self-hosted on EU infrastructure and provides visitor analytics without third-country transfers. For full CDP functionality with EU residency, Bloomreach and Optimizely Data Platform both offer EU hosting options. For Sitefinity users specifically, disabling Insight and using a self-hosted Matomo instance provides analytics with full data sovereignty. ### How do I handle the right to erasure for Sitefinity Insight contact profiles? Sitefinity Insight stores contact profiles that must be deleted upon a valid erasure request under GDPR Article 17. Navigate to the Insight admin panel, locate the contact profile by email address, and delete the contact record including all associated interaction history and segment data. Confirm in your data subject request response that the profile and associated tracking data have been deleted. Document the erasure in your data subject request log. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [GoatCounter](https://www.flowconsent.com/en/services/analytics/goatcounter) [GoatCounter is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. GoatCounter supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, GoatCounter enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/goatcounter) [Analytics](https://www.flowconsent.com/en/services/analytics/goatcounter) · ### [Snowplow Analytics](https://www.flowconsent.com/en/services/analytics/snowplow-analytics) [Snowplow Analytics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Snowplow Analytics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Snowplow Analytics empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/snowplow-analytics) [Analytics](https://www.flowconsent.com/en/services/analytics/snowplow-analytics) · ### [CNZZ](https://www.flowconsent.com/en/services/analytics/cnzz) [CNZZ is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. CNZZ supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, CNZZ enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/cnzz) [Analytics](https://www.flowconsent.com/en/services/analytics/cnzz) · ### [Parse.ly](https://www.flowconsent.com/en/services/analytics/parse-ly) [Parse.ly is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Parse.ly supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Parse.ly enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/parse-ly) [Analytics](https://www.flowconsent.com/en/services/analytics/parse-ly) · ### [Nimbata](https://www.flowconsent.com/en/services/analytics/nimbata) [Nimbata is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Nimbata offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Nimbata empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/nimbata) [Analytics](https://www.flowconsent.com/en/services/analytics/nimbata) · ### [MonsterInsights](https://www.flowconsent.com/en/services/analytics/monsterinsights) [MonsterInsights is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. MonsterInsights supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, MonsterInsights enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/monsterinsights) [Analytics](https://www.flowconsent.com/en/services/analytics/monsterinsights) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)