Spinnakr
Spinnakr is a website analytics and personalization tool that tracks visitor behaviour and delivers targeted on site messages and content based on audience segments. Its JavaScript tag sets cookies to identify returning visitors and measure engagement, processing data on servers in the United States. Under the GDPR and the ePrivacy Directive, its analytics and personalization cookies require prior consent.
What does Spinnakr do?
What is Spinnakr?
Spinnakr is a web analytics and personalization service that helps websites understand their audience and show targeted messages, such as banners or offers, to specific visitor segments. It loads a JavaScript tag that records visits and behaviour and uses that data to decide which content to display. It is a United States based product aimed at marketers.
What data and cookies does it collect?
The Spinnakr tag sets cookies and reads device and behavioural data such as IP address, browser, pages viewed, referrer and approximate location. It uses persistent identifiers to recognise returning visitors, group them into segments and measure how they respond to personalised content. This builds a behavioural profile used for targeting.
GDPR and ePrivacy implications
The analytics and personalization cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. Because Spinnakr profiles visitors to personalise content, the GDPR transparency and fairness duties around profiling apply, and the data is processed in the United States.
Consent requirements
Block the Spinnakr tag until the visitor accepts analytics and personalization cookies through a Consent Management Platform. Do not set its identifiers or load the script before opt in, log consent, and let visitors refuse or withdraw as easily as they accept.
Data transfers
Spinnakr processes visitor data on servers in the United States, so transfers of EU personal data must rely on Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment. Record the transfer and the safeguards in your documentation.
Practical compliance steps
List the Spinnakr cookies and domain in your cookie policy, classify them as analytics or personalization, and gate them behind consent. Document the profiling, your legal basis and the US transfer safeguards, and provide a clear way for visitors to manage their choices. Review the setup if Spinnakr changes its tag or, given the product maturity, consider a maintained alternative.
Spinnakr and the GDPR
Spinnakr is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR)
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive (Cookie Law)
Impact assessment (DPIA)
Spinnakr sets cookies and reads device and behavioural data (IP address, browser, pages viewed, referrer, approximate location) to profile visitors and personalise content. Key DPIA considerations: (1) analytics and personalization cookies are persistent identifiers needing consent; (2) profiling of visitors triggers the GDPR transparency and fairness duties; (3) data is processed in the United States, requiring transfer safeguards; (4) systematic behavioural monitoring is involved. A DPIA is advisable because of the profiling and the transfer.
Sample text for your banner
We use Spinnakr to analyse our audience and show personalised content. Spinnakr sets cookies that recognise returning visitors, group them into segments and measure engagement, with processing in the United States. You can withdraw your consent at any time through our cookie settings.
What Spinnakr sets and contacts
- Tracking method
- JavaScript analytics tag and cookies
- Server location
- United States
- Data transferred outside the EU
- Spinnakr is a US based service, so visitor analytics data is processed on servers in the United States. Transfers from the EU rely on Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment.
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _spinnakr | Analytics / Personalization | 1 year | Persistent identifier that recognises returning visitors and assigns them to audience segments. |
| _spinnakr_session | Functional / Analytics | Session | Tracks the current visit and measures engagement with personalised content. |
Third-party domains contacted (2)
spinnakr.comjs.spinnakr.com
Frequently asked questions about Spinnakr
Can't find your question? Write to us, we answer fast.
What cookies does Spinnakr set?
Spinnakr sets cookies that act as persistent identifiers to recognise returning visitors, assign them to audience segments and measure engagement with personalised content. These analytics and personalization cookies are not strictly necessary, so they require consent before the tag runs.
Does Spinnakr require cookie consent?
Yes. Spinnakr sets analytics and personalization cookies and profiles visitors, which under the GDPR and the ePrivacy Directive requires prior consent. The tag should not load and no identifiers should be set until the visitor has accepted the relevant cookie categories.
What is the legal basis for Spinnakr?
The lawful basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) of the ePrivacy Directive for storing the cookies. Because the tool profiles visitors to personalise content, legitimate interest is not an adequate basis for the tracking.
Does Spinnakr transfer data outside the EU?
Yes. Spinnakr processes data on servers in the United States, so EU personal data is transferred there. The transfer must be covered by Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment.
Do I need a DPIA for Spinnakr?
A DPIA is advisable because Spinnakr involves systematic monitoring of visitor behaviour and profiling for personalisation, combined with a US transfer. Documenting the purposes, the profiling logic, the risks and the safeguards supports Article 35 GDPR compliance.
How do I implement Spinnakr compliantly?
Load Spinnakr only after consent through a CMP, disclose its cookies and the profiling in your notices, and document the US transfer safeguards. Keep identifiers from being set before opt in and provide a way to withdraw. Verify behaviour after any change to the tag.
Are there alternatives to Spinnakr?
Privacy friendly analytics tools such as Matomo, Plausible and Fathom avoid cross site profiling, and EU hosted personalization tools reduce transfer exposure. Given that Spinnakr is a mature product, evaluating a supported alternative may also improve reliability and compliance.
How do I update my cookie policy for Spinnakr?
Add the Spinnakr cookies to your cookie policy with their purpose and duration, name the Spinnakr domain, and state that data is processed in the United States. Explain the profiling and personalisation in your privacy notice and keep both aligned with the integration.
Podkite
Podkite is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Podkite offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Podkite empowers organizations to optimize strategy and maximize return on investment.
Triple Whale
Triple Whale is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Triple Whale offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Triple Whale empowers organizations to optimize strategy and maximize return on investment.
Request Metrics
Request Metrics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Request Metrics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Request Metrics empowers organizations to optimize strategy and maximize return on investment.
The Hotels Network
The Hotels Network is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. The Hotels Network offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, The Hotels Network empowers organizations to optimize strategy and maximize return on investment.
SuperStats
SuperStats is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SuperStats offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SuperStats empowers organizations to optimize strategy and maximize return on investment.
Cloudflare Browser Insights
Cloudflare Browser Insights is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Cloudflare Browser Insights supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Cloudflare Browser Insights enables informed decisions that.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.