> Smartlook under GDPR: cookies set, session recordings, EU hosting in the Czech Republic, consent requirements and best practice for European websites. > > Canonical: https://www.flowconsent.com/en/services/analytics/smartlook Analytics # Smartlook Analytics Smartlook is a Czech session replay and behavioural analytics platform headquartered in Brno. Data is hosted in the European Union, which makes it a popular alternative to Hotjar for European publishers. [Block Smartlook until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 10 - Third-party domains 10 - Servers European Union (Czech Republic, AWS Frankfurt) Overview ## What does Smartlook do? ## What Smartlook is Smartlook is a session replay, heatmaps and funnels platform operated by Smartsupp.com sro in Brno, Czech Republic. It records visitor sessions on websites and mobile apps and provides analytics on click, scroll and form interactions. Data is hosted on AWS infrastructure within the European Union. ## Data and cookies set Smartlook sets first party cookies SL\_C\_\*, SL\_S\_\* and SL\_GWPT\_Show\_Hide\_tmp that identify the visitor and the session. The session replay engine records DOM mutations, clicks, scrolls and form interactions, with masking available for sensitive elements. ## GDPR and ePrivacy implications Session replay is treated as non essential by CNIL and German DPAs: consent is required under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. The CNIL has fined publishers for activating session replay before consent. ## Consent requirements Block the Smartlook script until consent is granted. Smartlook provides a smartlook.consentAPI to grant or revoke consent for forms, IP and API usage. ## Data transfers outside the EEA Recordings stay in AWS EU. Cisco AppDynamics, the parent group of Smartsupp acquirers in some markets, may provide global support under SCCs. ## Practical compliance steps Block Smartlook before consent, mask password fields and any field with sensitive data, restrict recordings to specific pages, run a DPIA, sign the DPA and document the EU hosting. Compliance ## Smartlook and the GDPR Smartlook is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy) for session recordings and behavioural analytics - Risk level high - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, French CNIL guidelines, German TDDDG, Spanish LSSI ### Impact assessment (DPIA) A DPIA is recommended because session replays can capture inputs, mouse movements and form interactions. Mask sensitive fields, restrict replay scope and rely on EU hosting to limit risk. ### Sample text for your banner > Our website uses Smartlook, a session replay and behavioural analytics platform operated by Smartsupp.com sro (Czech Republic). The recordings are stored within the European Union and are activated only with your prior consent. Cookies and trackers ## What Smartlook sets and contacts - Tracking method javascript\_tag - Server location European Union (Czech Republic, AWS Frankfurt) ### Cookies set (10) | Name | Type | Duration | Purpose | | ------------------------- | ------------ | ---------- | --------------------------------------------------------------------------------------------- | | SL\_C\_{key}\_KEY | first\_party | 10 years | Unique visitor identifier used to link sessions across visits. | | SL\_C\_23361dd035530\_KEY | first\_party | 1 year | Pseudonymous visitor identifier used to stitch session recordings and heatmap events. | | SL\_C\_\\_VID | first-party | 10 years | Stores the pseudonymous Smartlook visitor identifier across sessions. | | SL\_C\_23361dd035530\_VID | first\_party | 1 year | Visitor identifier mapped to the recording chunks uploaded to the Smartlook EU cluster. | | SL\_C\_\\_SID | first-party | session | Identifies the current Smartlook session and links its replay events. | | SL\_C\_{key}\_SID | first\_party | 30 minutes | Current session identifier. | | SL\_C\_23361dd035530\_SID | first\_party | session | Session identifier; used to group events into a single replay. | | SL\_GWPT\_Show\_Hide\_tmp | first\_party | Session | Stores Smartlook dashboard preferences. | | SL\_C\_\\_KEY | first-party | 10 years | Stores configuration of the Smartlook recording (rate, masking, allowed origins). | | SL\_GWPT\_Show\_Hide\_tmp | third-party | session | Smartlook dashboard cookie set on smartlook.com to remember UI preferences for project users. | ### Third-party domains contacted (10) - `smartlook.com` - `smartlook.com` - `smartlook.com` - `rec.smartlook.com` - `rec.smartlook.com` - `rec.smartlook.com` - `eu-rec.smartlook.com` - `web-sdk.smartlook.com` - `eu.smartlook.cloud` - `web-sdk.smartlook.com` Questions ## Frequently asked questions about Smartlook Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Smartlook set? Smartlook sets first party cookies SL\_C\_\\_VID (visitor id), SL\_C\_\\_SID (session id) and SL\_C\_\\_KEY (configuration), plus a third party cookie on smartlook.com for the dashboard. All cookies are described in the Smartlook cookie documentation and need to be listed in the operator cookie policy. ### Which cookies does Smartlook set? First party cookies SL\_C\_{key}\_KEY, SL\_C\_{key}\_SID and SL\_GWPT\_Show\_Hide\_tmp store the visitor identifier, session and dashboard preferences. ### Which cookies does Smartlook set? Smartlook sets up to three first party cookies on the publisher domain: SL\_C\_...\_KEY (visitor key, 1 year), SL\_C\_...\_VID (visitor identifier, 1 year) and SL\_C\_...\_SID (session identifier, session). They are pseudonymous and used to stitch the recording chunks together. ### Do I need consent? Yes. Session replay is not strictly necessary and consent is required under Article 5(3) ePrivacy. ### Is consent required to use Smartlook? Yes. Session replay, heatmaps and clickmaps are systematic monitoring under GDPR and require prior, granular and freely revocable consent under Art. 5(3) ePrivacy and Art. 6(1)(a) GDPR. The CNIL, the Garante and the BfDI have all confirmed this position. ### Is consent required to load Smartlook? Yes. Smartlook implements session replay, which is treated as systematic behavioural monitoring by the EDPB and EU regulators. The SDK reads and writes information on the visitor terminal and must therefore be blocked until the visitor accepts analytics cookies in the CMP. ### What is the legal basis? Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. ### What is the legal basis for processing data through Smartlook? The legal basis is article 6(1)(a) GDPR (consent). Legitimate interest is not adequate because session replay captures DOM mutations and may inadvertently process personal data, and EU regulators have repeatedly stated that consent is required for this category of analytics. ### What is the legal basis for processing through Smartlook? Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy). Legitimate interest is not appropriate for session replay because the systematic capture of behaviour creates a high risk to data subject rights, and the EDPB Guidelines 8/2020 recommend consent for any tracking that goes beyond strict aggregate measurement. ### Does Smartlook transfer data to the United States? Smartlook stores session replays on AWS Frankfurt, inside the EEA. As part of the Cisco group, Smartlook may grant access to its parent company from the US or India under Cisco master data protection terms. Check the current sub processor list and sign the appropriate Standard Contractual Clauses. ### Does Smartlook transfer data to the United States? Not for EU customers. Smartlook hosts EU customer data in Brno (Czech Republic) and AWS Ireland and the DPA states no transfer outside the EEA. Cisco is the US parent company but EU operations are run independently. North American customers have a separate US data centre. ### Are any data transferred to the United States? No in standard configuration. Smartlook is hosted in AWS EU. ### Do I need a DPIA for Smartlook? Yes. Session replay is listed among the criteria for mandatory DPIA in the EDPB Guidelines on DPIAs (systematic monitoring, large scale processing). Cover the masking strategy, the retention period, the sampling, the recipients and the visitor exercise of rights. ### Do I need a DPIA before using Smartlook? Yes, a DPIA is strongly recommended. Session replay is classified by the EDPB as systematic behavioural monitoring, which is one of the criteria for high risk processing. Conduct and document the DPIA before activating Smartlook on production traffic. ### Is a DPIA needed? Recommended given the granularity of session replays. Mask sensitive elements to limit risk. ### How do I implement Smartlook for GDPR compliance? Sign the DPA from the Smartlook dashboard, choose EU residency at sign up, set masking on every personal data field, enable IP anonymisation, gate the SDK behind your CMP analytics or session replay category and use smartlook.consent or smartlook.disable to react to the visitor decision. ### How do I implement Smartlook in a GDPR compliant way? Sign the Smartlook DPA, enable IP anonymisation, gate the SDK behind your CMP, mark every form and personal data element with smartlook hide, exclude payment and health pages, configure a short retention and document everything in the record of processing. ### How do I implement compliance correctly? Block the script before consent, use smartlook.consentAPI to grant or revoke, mask form fields by default and limit recordings to specific pages. ### What are the alternatives to Smartlook? Other session replay tools include Hotjar (acquired by Contentsquare), Microsoft Clarity (free, US hosted), FullStory (US hosted), LogRocket, Mouseflow (Denmark, EU hosted) and the open source OpenReplay which can be self hosted on EU infrastructure. ### Are there privacy friendly alternatives to Smartlook? EU based or self hosted alternatives include Matomo Heatmaps and Session Recording, Mouseflow EU, Contentsquare with EU residency, PostHog Self Hosted and Plausible (with no replay). Each option offers different trade offs in terms of features, retention and data location. ### What are the alternatives? Hotjar, Microsoft Clarity, PostHog session replay, Mouseflow, FullStory. EU based options simplify compliance. ### How should I update the cookie policy for Smartlook? List the SL\_C\_\\_VID, SL\_C\_\\_SID and SL\_C\_\\_KEY cookies with their purpose and retention, mention the third party cookie on smartlook.com, indicate that Smartlook records session replays, link to the Smartlook privacy notice and to your CMP preference centre. ### How do I keep my cookie policy up to date with Smartlook? List all three SL\_C\_... cookies with their lifetime and purpose. Re scan the storefront after every Smartlook SDK upgrade because the cookie naming convention may evolve. Update the policy when you change the masking strategy, retention period or sampling rate. ### How do I update the cookie policy? Document SL\_C\_\* and SL\_S\_\* cookies, their purpose, duration and the EU hosting. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Webolytics](https://www.flowconsent.com/en/services/analytics/webolytics) [Webolytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Webolytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Webolytics enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/webolytics) [Analytics](https://www.flowconsent.com/en/services/analytics/webolytics) · ### [AvidTrak](https://www.flowconsent.com/en/services/analytics/avidtrak) [AvidTrak is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. AvidTrak supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, AvidTrak enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/avidtrak) [Analytics](https://www.flowconsent.com/en/services/analytics/avidtrak) · ### [Dexem](https://www.flowconsent.com/en/services/analytics/dexem) [Dexem is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Dexem supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Dexem enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/dexem) [Analytics](https://www.flowconsent.com/en/services/analytics/dexem) · ### [OneAPM](https://www.flowconsent.com/en/services/analytics/oneapm) [OneAPM is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. OneAPM supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, OneAPM enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/oneapm) [Analytics](https://www.flowconsent.com/en/services/analytics/oneapm) · ### [Podkite](https://www.flowconsent.com/en/services/analytics/podkite) [Podkite is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Podkite offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Podkite empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/podkite) [Analytics](https://www.flowconsent.com/en/services/analytics/podkite) · ### [Google Analytics 4](https://www.flowconsent.com/en/services/analytics/google-analytics-4) [Google Analytics 4 is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Google Analytics 4 offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Google Analytics 4 empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/google-analytics-4) [Analytics](https://www.flowconsent.com/en/services/analytics/google-analytics-4) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)