> How Statsig tracks users for feature flags and A/B tests, what cookies and identifiers it stores, and how to keep Statsig compliant with GDPR and ePrivacy. > > Canonical: https://www.flowconsent.com/en/services/analytics/statsig Analytics # Statsig Analytics Statsig is a feature flagging, experimentation and product analytics platform used by engineering and product teams to run A/B tests, roll out features gradually and measure their impact. It deploys client and server SDKs that send event streams to Statsig's US cloud. For EU customers, Statsig requires careful configuration: prior consent for browser identifiers, optional EU data residency on enterprise plans, and a documented transfer mechanism when data leaves the EEA. [Block Statsig until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 2 - Third-party domains 4 - Servers United States. Statsig is a Seattle based company with primary infrastructure in US cloud regions. A separate EU data residency tier is available on enterprise plans. Overview ## What does Statsig do? ## **What Statsig is and how it works** Statsig is a feature flagging, experimentation and product analytics platform. It ships JavaScript, iOS, Android, Node, Python, Go and other SDKs. The SDKs assign or read a stable user identifier, send exposure logs when a feature flag is evaluated, and forward custom events to the Statsig cloud where dashboards and statistical tests run. ## **What data Statsig collects** Statsig collects stable user IDs, IP addresses, user agent, device platform, app version, language, country, timestamps, feature flag exposures, experiment assignments and custom events provided by the developer. Custom events can include order values, signup actions or any other product event. Statsig also stores cohort assignments for the duration of an experiment. ## **GDPR and ePrivacy implications** When Statsig runs in the browser, it reads or writes a stable user ID, typically in localStorage. Under article 5(3) ePrivacy, this requires prior consent unless the storage is strictly necessary. Experimentation and analytics are not strictly necessary, therefore consent is required. The merchant is the controller, Statsig the processor, and a DPA is mandatory. ## **Consent requirements** In the browser, the Statsig SDK should be gated behind the Consent Management Platform and only initialised when the user has accepted analytics. For mobile apps, the user must be informed at first launch and have the ability to opt out. Server side flags evaluated solely on first party signals (account ID, plan tier) can rely on legitimate interest after a balancing test. ## **International data transfers** By default Statsig stores data in US regions and EU user data is transferred to the US. Enterprise customers can request EU data residency which keeps event and exposure data in EU regions. Without EU residency, transfers must rely on SCCs and the EU US Data Privacy Framework where Statsig is certified, with supplementary measures such as encryption and IP truncation. ## **Practical compliance steps** Sign a DPA, evaluate EU data residency, gate Statsig behind consent for browser usage, document custom events in the records of processing, set conservative retention, avoid sending personal identifiers in event payloads, and audit who in the company can access Statsig dashboards. Refresh the cookie policy with any browser storage Statsig writes. Compliance ## Statsig and the GDPR Statsig is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Statsig stores stable identifiers on the device and shares them with a third party for analytics and experimentation. Prior consent under article 5(3) ePrivacy is required for these client side identifiers. Server side experimentation that does not rely on browser storage may rely on legitimate interest under article 6(1)(f) GDPR, provided a balancing test is documented. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, national cookie laws (CNIL, BfDI, AEPD), EU US Data Privacy Framework. ### Impact assessment (DPIA) A DPIA is recommended when Statsig is used for behavioural experimentation on large EU user bases. Document necessity, minimisation, retention, the use of stable user IDs, IP collection, transfer to the US under SCCs, and the availability and configuration of EU data residency. ### Sample text for your banner > We use Statsig to test and improve our product through feature flags and experiments. Statsig stores an identifier on your device and sends event data to its US cloud under Standard Contractual Clauses. We will only activate Statsig analytics if you accept. Cookies and trackers ## What Statsig sets and contacts - Tracking method Feature flagging, experimentation and product analytics. Statsig deploys JavaScript, iOS, Android and server SDKs that send event streams and exposure logs to its cloud. It uses stable user IDs, optional cookies and localStorage to identify users across sessions for A/B testing and metrics. - Server location United States. Statsig is a Seattle based company with primary infrastructure in US cloud regions. A separate EU data residency tier is available on enterprise plans. - Cookieless mode available Yes - Data transferred outside the EU By default Statsig transfers event and exposure data of EU users to the United States. Transfers rely on Standard Contractual Clauses and the EU US Data Privacy Framework where Statsig is certified. An EU data residency option is available on enterprise plans and should be requested for EU centric deployments. ### Cookies set (2) | Name | Type | Duration | Purpose | | ------------------ | ---------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | statsig.stable\_id | persistent | 2 years | Stable user identifier stored in localStorage (or fallback cookie) used by Statsig to consistently assign users to experiment variants. Requires consent. | | statsig.overrides | persistent | 30 days | Optional storage of feature flag overrides for the current user, used during development and QA. Requires consent if used in production. | ### Third-party domains contacted (4) - `statsig.com` - `events.statsigapi.net` - `api.statsig.com` - `featuregates.org` Questions ## Frequently asked questions about Statsig Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What does Statsig store on the device? Statsig stores a stable user identifier in localStorage (or a fallback cookie when localStorage is unavailable) and an exposure cache so that flag evaluations stay consistent across page loads. Server side use of Statsig does not store anything on the user device. ### Does Statsig require consent? Yes, in the browser. Article 5(3) ePrivacy requires prior consent before Statsig writes its stable identifier to localStorage. Server side use that does not rely on browser storage and that processes only first party account data can rely on legitimate interest after a documented balancing test. ### What is the legal basis for Statsig? Browser analytics: user consent under article 6(1)(a) GDPR and article 5(3) ePrivacy. Server side experimentation on first party data: legitimate interest under article 6(1)(f) GDPR, with a balancing test that considers the necessity, the user impact and the safeguards in place. ### Does Statsig transfer data to the US? By default yes. Statsig is a US company and stores data in US regions. Enterprise customers can request EU data residency. Without it, transfers must rely on SCCs, the EU US Data Privacy Framework where Statsig is certified, and supplementary safeguards. ### Do we need a DPIA for Statsig? A DPIA is recommended for large scale behavioural experimentation, particularly on consumer products. It should document the purpose, the categories of data, retention, transfers, the use of stable identifiers and the controls preventing harmful experiments. ### How do we implement Statsig compliantly? Sign a DPA, evaluate the EU data residency option, gate the browser SDK behind consent, avoid sending direct personal identifiers in event payloads (use pseudonymous IDs), limit retention, restrict access to dashboards and document the practice in the records of processing. ### What alternatives to Statsig exist? Alternatives include Eppo, GrowthBook (open source and EU hostable), Unleash (open source), Flagsmith (EU hosted available), LaunchDarkly (US, with EU data residency option), and Optimizely Feature Experimentation. EU hosted or self hosted options reduce transfer risk. ### How do we update the cookie policy when using Statsig? List Statsig in the cookie policy with vendor name, purposes (feature flagging, A/B testing, product analytics), storage type (localStorage and optional cookies), lifetime, third country transfer to the US, and legal basis (consent). Update the policy whenever the Statsig SDK adds new storage or transfers data to new regions. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Hotjar](https://www.flowconsent.com/en/services/analytics/hotjar) [Hotjar is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hotjar offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hotjar empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/hotjar) [Analytics](https://www.flowconsent.com/en/services/analytics/hotjar) · ### [Webtrends](https://www.flowconsent.com/en/services/analytics/webtrends) [Webtrends is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Webtrends supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Webtrends enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/webtrends) [Analytics](https://www.flowconsent.com/en/services/analytics/webtrends) · ### [Rambler](https://www.flowconsent.com/en/services/analytics/rambler) [Rambler is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Rambler offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Rambler empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/rambler) [Analytics](https://www.flowconsent.com/en/services/analytics/rambler) · ### [Amplitude](https://www.flowconsent.com/en/services/analytics/amplitude) [Amplitude is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Amplitude offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Amplitude empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/amplitude) [Analytics](https://www.flowconsent.com/en/services/analytics/amplitude) · ### [Litmus](https://www.flowconsent.com/en/services/analytics/litmus) [Litmus is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Litmus offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Litmus empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/litmus) [Analytics](https://www.flowconsent.com/en/services/analytics/litmus) · ### [Analysys Ark](https://www.flowconsent.com/en/services/analytics/analysys-ark) [Analysys Ark is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Analysys Ark supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Analysys Ark enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/analysys-ark) [Analytics](https://www.flowconsent.com/en/services/analytics/analysys-ark) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)