> Snowplow is an open source behavioural data platform. Running it on European infrastructure under the GDPR: cookies, consent and anonymous tracking. > > Canonical: https://www.flowconsent.com/en/services/analytics/snowplow-analytics Analytics # Snowplow Analytics Analytics Snowplow is an open source behavioural data platform used by data engineering teams who want full control over their event collection. Trackers send first party events to a publisher controlled collector that writes raw data to S3, Snowflake, BigQuery or Databricks. Self hosting on EU infrastructure makes Snowplow a strong GDPR compliant alternative to Google Analytics, especially for the public sector and regulated industries. [Block Snowplow Analytics until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 6 - Servers fully controlled by the operator; Snowplow BDP supports AWS regions including eu-west-1 (Ireland), eu-central-1 (Frankfurt) and us-east-1 Overview ## What does Snowplow Analytics do? ## **What is Snowplow Analytics** Snowplow is an open source behavioural data platform. Trackers running in browsers, mobile apps or servers send raw events to a Snowplow collector controlled by the operator. The events are then validated, enriched and loaded into the operator data warehouse (BigQuery, Snowflake, Redshift, Databricks). Snowplow is also available as a fully managed service called Snowplow BDP. ## **Data and cookies collected** The Snowplow JavaScript tracker sets first party cookies \_sp\_id (domain user id) and \_sp\_ses (session) by default. It captures pageviews, events, custom self describing payloads, performance metrics and, when configured, click and form interaction events. The IP address is recorded by the collector unless an IP truncation enrichment is applied. ## **GDPR and ePrivacy implications** Snowplow processes personal data because cookie identifiers and IP addresses qualify the visitor. Article 5(3) of the ePrivacy Directive requires consent for any cookie that is not strictly necessary, and Snowplow product analytics are not. With the right configuration (no marketing use, IP truncation, anonymous session id), some authorities accept a legitimate interest based deployment. ## **Consent and legal basis** The standard legal basis is article 6(1)(a) GDPR (consent), with Snowplow mentioned in the analytics category of the CMP. Legitimate interest under article 6(1)(f) can be defended for a strictly anonymous configuration: no marketing identifier, no advertising use case, IP truncated, retention limited and the balancing test documented. ## **Data transfers** Snowplow is self hosted, so the operator decides where the collector, enrichment pipeline and warehouse live. By default an EU based deployment on AWS Frankfurt or Ireland keeps all data inside the EEA. Snowplow BDP, the managed offering, lets the operator pick the AWS region; choose an EU region for European users. ## **Practical compliance steps** Deploy Snowplow in an EU AWS region, sign a DPA with Snowplow Analytics for the BDP offering, configure the IP truncation enrichment, integrate the tracker with your CMP, document the event schema, retention and warehouse access in the record of processing and run regular data minimisation reviews on the Iglu schemas. Compliance ## Snowplow Analytics and the GDPR Snowplow Analytics is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Article 6(1)(a) GDPR for the default cookie based tracker; article 6(1)(f) GDPR is acceptable for the anonymous configuration with hashed or dropped user identifiers, IP truncation and no marketing use case. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, UK GDPR, national CMP guidelines ### Impact assessment (DPIA) A DPIA is recommended when Snowplow ingests detailed behavioural events for marketing or personalisation, when the warehouse contains direct identifiers, or when the operator combines Snowplow with cross device matching, scoring and AI models. ### Sample text for your banner > We use Snowplow Analytics, an open source behavioural data platform that runs on our own servers. Snowplow stores cookies on your browser and records pages you visit and the events you trigger. Tracking only starts after you accept analytics cookies. Cookies and trackers ## What Snowplow Analytics sets and contacts - Tracking method open source event collection pipeline: JavaScript, mobile and server side trackers send events to a collector hosted by the operator, then enriched and stored in the operator data warehouse - Server location fully controlled by the operator; Snowplow BDP supports AWS regions including eu-west-1 (Ireland), eu-central-1 (Frankfurt) and us-east-1 - Cookieless mode available Yes ### Cookies set (4) | Name | Type | Duration | Purpose | | --------- | ------------ | ---------- | ------------------------------------------------------------------------- | | \_sp\_id | first\_party | 2 years | Stores the Snowplow visitor identifier used to recognise returning users. | | \_sp\_id | first\_party | 13 months | Pseudonymous visitor identifier used to stitch sessions across visits. | | \_sp\_ses | first\_party | 30 minutes | Stores the Snowplow session identifier. | | \_sp\_ses | first\_party | 30 minutes | Session identifier used to group events into a single visit. | ### Third-party domains contacted (6) - `snowplowanalytics.com` - `snowplow.io` - `snplow.net` - `iglucentral.com` - `collector.example.com (customer controlled)` - `(publisher controlled collector domain)` Questions ## Frequently asked questions about Snowplow Analytics Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Snowplow set? Snowplow sets \_sp\_id (visitor) and \_sp\_ses (session) first party cookies, plus any custom cookies declared in your schema. ### Which cookies does Snowplow set? Snowplow sets two first party cookies on the publisher domain: \_sp\_id (visitor identifier, 13 months) and \_sp\_ses (session identifier, 30 minutes). In cookieless mode neither cookie is set; visitor stitching is replaced by an in memory device fingerprint that is reset on every visit. ### Do I need consent? Yes by default because of the persistent identifier. Anonymous server side measurement without \_sp\_id can sometimes rely on legitimate interest. ### Is consent required to use Snowplow? Yes when Snowplow stores \_sp\_id or \_sp\_ses on the visitor terminal: prior consent under Art. 5(3) ePrivacy is required. In cookieless mode aligned with the CNIL R32 exemption (IP truncation, no fingerprinting, no cross site tracking, opt out exposed) Snowplow can be deployed without consent on legitimate interest grounds. ### What is the legal basis? Consent for behavioural tracking. Legitimate interest for anonymous aggregate analytics with strict safeguards. ### What is the legal basis for processing through Snowplow? Consent (Art. 6(1)(a) GDPR) for the cookied mode. Legitimate interest (Art. 6(1)(f)) for the cookieless exempt mode. Either way the publisher is the sole data controller because Snowplow is self hosted. ### Are any data transferred to the United States? Not for the pipeline if you deploy in an EU region. Snowplow BDP support in the UK or US may access infrastructure under SCCs. ### Does Snowplow transfer data to the United States? No, when self hosted on AWS Frankfurt or Dublin or on Snowplow BDP managed with EU residency. The default open source deployment depends on the iglucentral schema registry hosted on Cloudfront, which only ships JSON schemas (no personal data) so it does not constitute a personal data transfer. ### Is a DPIA needed? Recommended because Snowplow can record very granular user behaviour and is often integrated with other personal data. ### Do I need a DPIA for Snowplow? A DPIA is recommended only when Snowplow combines clickstream events with personal identifiers (logged in users, CRM enrichment) at scale. Pure cookieless behavioural collection with IP truncation usually does not trigger the Art. 35 DPIA criteria. ### How do I implement compliance correctly? Deploy in EU regions, define a clear schema, anonymise IPs, use cookieless mode, gate behind a CMP and pass the consent flag as a custom context. ### How do I implement Snowplow for GDPR compliance? Deploy the collector in an EU region, activate IP truncation, disable fingerprinting in the JavaScript tracker, wire the tracker to your CMP if you stay in cookied mode, document Snowplow in your Article 30 register and use schema versioning so every change in the data contract is traceable. ### What are the alternatives to Snowplow? Other privacy first analytics include Matomo (PHP, EU hosted), Plausible Analytics (EU, cookieless), Fathom (cookieless), Umami (open source), Pirsch (Germany) and Simple Analytics (Netherlands). For high volume warehouse native data, RudderStack and Segment are the closest commercial competitors. ### What are the alternatives? Matomo, PostHog, Plausible, Adobe Analytics, Google Analytics 4, mParticle. Open source alternatives reduce vendor risk. ### How do I update the cookie policy? Document \_sp\_id, \_sp\_ses and any custom cookies, their purpose and duration, and version the policy with each schema change. ### How do I keep my cookie policy up to date with Snowplow? List \_sp\_id and \_sp\_ses with their lifetime and purpose if you operate in cookied mode. State that the data is collected on first party infrastructure (no third country transfer). Update the policy when you change the IP truncation level, sampling, retention or schema versioning policy. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Naver RUA](https://www.flowconsent.com/en/services/analytics/naver-rua) [Naver RUA is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Naver RUA supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Naver RUA enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/naver-rua) [Analytics](https://www.flowconsent.com/en/services/analytics/naver-rua) · ### [ANS](https://www.flowconsent.com/en/services/analytics/ans) [ANS is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. ANS offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, ANS empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/ans) [Analytics](https://www.flowconsent.com/en/services/analytics/ans) · ### [KnoCommerce](https://www.flowconsent.com/en/services/analytics/knocommerce) [KnoCommerce is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. KnoCommerce supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, KnoCommerce enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/knocommerce) [Analytics](https://www.flowconsent.com/en/services/analytics/knocommerce) · ### [Gemius](https://www.flowconsent.com/en/services/analytics/gemius) [Gemius is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Gemius supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Gemius enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/gemius) [Analytics](https://www.flowconsent.com/en/services/analytics/gemius) · ### [Panelbear](https://www.flowconsent.com/en/services/analytics/panelbear) [Panelbear is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Panelbear supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Panelbear enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/panelbear) [Analytics](https://www.flowconsent.com/en/services/analytics/panelbear) · ### [WP Live Visitor Counter](https://www.flowconsent.com/en/services/analytics/wp-live-visitor-counter) [WP Live Visitor Counter is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. WP Live Visitor Counter supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, WP Live Visitor Counter remains a leading web.](https://www.flowconsent.com/en/services/analytics/wp-live-visitor-counter) [Analytics](https://www.flowconsent.com/en/services/analytics/wp-live-visitor-counter) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)