Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Spinnakr is a website analytics and personalization tool that tracks visitor behaviour and delivers targeted on site messages and content based on audience segments. Its JavaScript tag sets cookies to identify returning visitors and measure engagement, processing data on servers in the United States. Under the GDPR and the ePrivacy Directive, its analytics and personalization cookies require prior consent.
Spinnakr is a web analytics and personalization service that helps websites understand their audience and show targeted messages, such as banners or offers, to specific visitor segments. It loads a JavaScript tag that records visits and behaviour and uses that data to decide which content to display. It is a United States based product aimed at marketers.
The Spinnakr tag sets cookies and reads device and behavioural data such as IP address, browser, pages viewed, referrer and approximate location. It uses persistent identifiers to recognise returning visitors, group them into segments and measure how they respond to personalised content. This builds a behavioural profile used for targeting.
The analytics and personalization cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. Because Spinnakr profiles visitors to personalise content, the GDPR transparency and fairness duties around profiling apply, and the data is processed in the United States.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block the Spinnakr tag until the visitor accepts analytics and personalization cookies through a Consent Management Platform. Do not set its identifiers or load the script before opt in, log consent, and let visitors refuse or withdraw as easily as they accept.
Spinnakr processes visitor data on servers in the United States, so transfers of EU personal data must rely on Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment. Record the transfer and the safeguards in your documentation.
List the Spinnakr cookies and domain in your cookie policy, classify them as analytics or personalization, and gate them behind consent. Document the profiling, your legal basis and the US transfer safeguards, and provide a clear way for visitors to manage their choices. Review the setup if Spinnakr changes its tag or, given the product maturity, consider a maintained alternative.
Websites using Spinnakr must obtain user consent under GDPR regulations.
DPIA considerations
Spinnakr sets cookies and reads device and behavioural data (IP address, browser, pages viewed, referrer, approximate location) to profile visitors and personalise content. Key DPIA considerations: (1) analytics and personalization cookies are persistent identifiers needing consent; (2) profiling of visitors triggers the GDPR transparency and fairness duties; (3) data is processed in the United States, requiring transfer safeguards; (4) systematic behavioural monitoring is involved. A DPIA is advisable because of the profiling and the transfer.
Sample consent text
We use Spinnakr to analyse our audience and show personalised content. Spinnakr sets cookies that recognise returning visitors, group them into segments and measure engagement, with processing in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
spinnakr.comjs.spinnakr.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _spinnakr | Analytics / Personalization | 1 year | Persistent identifier that recognises returning visitors and assigns them to audience segments. |
| _spinnakr_session | Functional / Analytics | Session | Tracks the current visit and measures engagement with personalised content. |
Spinnakr collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Spinnakr sets cookies that act as persistent identifiers to recognise returning visitors, assign them to audience segments and measure engagement with personalised content. These analytics and personalization cookies are not strictly necessary, so they require consent before the tag runs.
Yes. Spinnakr sets analytics and personalization cookies and profiles visitors, which under the GDPR and the ePrivacy Directive requires prior consent. The tag should not load and no identifiers should be set until the visitor has accepted the relevant cookie categories.
The lawful basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) of the ePrivacy Directive for storing the cookies. Because the tool profiles visitors to personalise content, legitimate interest is not an adequate basis for the tracking.
Yes. Spinnakr processes data on servers in the United States, so EU personal data is transferred there. The transfer must be covered by Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment.
A DPIA is advisable because Spinnakr involves systematic monitoring of visitor behaviour and profiling for personalisation, combined with a US transfer. Documenting the purposes, the profiling logic, the risks and the safeguards supports Article 35 GDPR compliance.
Load Spinnakr only after consent through a CMP, disclose its cookies and the profiling in your notices, and document the US transfer safeguards. Keep identifiers from being set before opt in and provide a way to withdraw. Verify behaviour after any change to the tag.
Privacy friendly analytics tools such as Matomo, Plausible and Fathom avoid cross site profiling, and EU hosted personalization tools reduce transfer exposure. Given that Spinnakr is a mature product, evaluating a supported alternative may also improve reliability and compliance.
Add the Spinnakr cookies to your cookie policy with their purpose and duration, name the Spinnakr domain, and state that data is processed in the United States. Explain the profiling and personalisation in your privacy notice and keep both aligned with the integration.