> Twitter (X) Analytics sets tracking cookies and sends data to the US. Learn how GDPR, ePrivacy and post Schrems II rules require strict consent. > > Canonical: https://www.flowconsent.com/en/services/analytics/twitter-analytics Analytics # Twitter Analytics Analytics Twitter Analytics, now branded X Analytics, is the audience and content measurement platform of X Corp. It tracks impressions, engagements, and profile activity, and works alongside X widgets that set cookies on embedding websites. [Block Twitter Analytics until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 6 - Third-party domains 7 - Servers United States. X Corp processes data on infrastructure operated from the US, with edge presence on Akamai and Cloudflare. Some EU users may hit regional edge points but the controller remains X Corp in San Francisco. Overview ## What does Twitter Analytics do? ## **What Twitter Analytics is** Twitter Analytics, now usually called X Analytics, is the audience and content measurement platform of X Corp, the company that operates the social network previously branded Twitter. It gives account owners metrics on impressions, engagements, video views, profile visits, and follower demographics. The same telemetry powers ad reporting in the X Ads Manager and feeds the conversion measurement of the X Pixel. ## **What data and cookies are collected** Pages that embed Tweets, X timelines, follow buttons, or the X Pixel cause the browser to load resources from x.com, twitter.com, and abs.twimg.com. X writes identifiers such as guest\_id, personalization\_id, ct0, twid, lang, and the session cookie \_twitter\_sess. These cookies allow cross site tracking, ad attribution, and profile linkage for logged in X users, even on third party websites. ## **GDPR and ePrivacy implications** The cookies fall squarely within Art 5(3) of the ePrivacy Directive and the German TTDSG. X Corp acts as a separate controller for the data captured through its widgets, and a CJEU style joint controllership applies to the embedding website for the collection phase (Fashion ID, C 40/17). Because the processing involves profiling, the only realistic legal basis under Art 6(1) GDPR is the visitor's freely given, specific, informed, and unambiguous consent. ## **Consent requirements** Operators must block all X widgets, timelines, and the X Pixel before a visitor opts in through the consent banner. A pre ticked box, scroll based consent, or implicit acceptance is invalid (CJEU Planet49, C 673/17). The banner needs to describe the purposes, retention periods, the third country transfer, and offer a refuse option that is as easy as the accept button, in line with the EDPB 03/2022 guidelines and CNIL recommendations. ## **Transfers to the United States** X Corp processes personal data in the United States. The company withdrew from the EU US Data Privacy Framework in May 2023, so transfers now rely on Standard Contractual Clauses combined with supplementary measures. The Schrems II ruling requires a documented Transfer Impact Assessment covering US surveillance laws (FISA 702, EO 12333). Several EU regulators have already issued warnings about embedding US social media without solid safeguards. ## **Practical compliance steps** Load X embeds only after consent, use a CMP that exposes a granular X category, sign the X Pixel data processing addendum, run a Transfer Impact Assessment, and consider server side proxies or static screenshots of Tweets where possible. Document everything in the records of processing, list X Corp in the privacy notice, and offer a clear withdrawal path so visitors can revoke consent at any time. Compliance ## Twitter Analytics and the GDPR Twitter Analytics is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior opt in consent under Art 6(1)(a) GDPR and Art 5(3) ePrivacy Directive. Legitimate interest is not viable due to the profiling carried out by X Corp. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, French Loi Informatique et Libertés and CNIL guidelines, German TTDSG, Spanish LSSI and LOPDGDD, Italian Codice Privacy, DSA, Schrems II case law ### Impact assessment (DPIA) A DPIA under Art 35 GDPR is strongly recommended. Twitter Analytics relies on systematic profiling, behavioural tracking across sites, and transfers to a US controller that withdrew from the Data Privacy Framework in 2023. The DPIA should document Schrems II supplementary measures, retention, and joint controllership for X embeds. ### Sample text for your banner > We use Twitter (X) Analytics and X embeds to measure how our content performs on the X network. With your consent, X sets cookies such as guest\_id and personalization\_id, profiles your interaction, and transfers data to X Corp in the United States. You can refuse or change your choice at any time. Cookies and trackers ## What Twitter Analytics sets and contacts - Tracking method Client side cookies and pixel tracking from X (Twitter) widgets, Tweet embeds, video players, and the analytics back office. Identifiers such as guest\_id, personalization\_id, ct0, twid, and lang are written from x.com and twitter.com on pages embedding X content. - Server location United States. X Corp processes data on infrastructure operated from the US, with edge presence on Akamai and Cloudflare. Some EU users may hit regional edge points but the controller remains X Corp in San Francisco. - Data transferred outside the EU Personal data is transferred to X Corp in the United States. X Corp withdrew from the EU US Data Privacy Framework in May 2023, so transfers now rely on Standard Contractual Clauses combined with supplementary measures. Several EU DPAs have raised concerns about the adequacy of these safeguards. ### Cookies set (6) | Name | Type | Duration | Purpose | | ------------------- | --------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | guest\_id | third party tracking | around 2 years | Unique identifier assigned by X to non logged in visitors, used for analytics, fraud prevention and ad attribution across pages embedding X content. | | personalization\_id | third party advertising | around 2 years | Cross site identifier used by X to personalise advertising and content based on browsing behaviour on any page that loads X widgets or pixels. | | ct0 | third party security and tracking | 6 hours to 1 year | CSRF token that also enables authenticated and unauthenticated tracking of interactions with X widgets and the X Pixel. | | twid | third party tracking | persistent | Identifier of the logged in X account, linked to the X user profile and used to attribute embed interactions to a known account. | | lang | third party preference | session | Stores the language preference used by X widgets and analytics so embedded content is rendered in the right locale. | | \_twitter\_sess | third party session | session | Session cookie of the X platform that maintains state when a visitor interacts with embedded Tweets, login flows or video players. | ### Third-party domains contacted (7) - `x.com` - `twitter.com` - `abs.twimg.com` - `platform.twitter.com` - `analytics.twitter.com` - `ads-twitter.com` - `t.co` Questions ## Frequently asked questions about Twitter Analytics Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Twitter Analytics set? Pages with X widgets or the X Pixel write cookies from x.com and twitter.com. Typical entries are guest\_id (visitor identification, around two years), personalization\_id (cross site targeting, around two years), ct0 (CSRF token, six hours to one year), twid (logged in user id, persistent), lang (language preference), and \_twitter\_sess (session). All are used for tracking, advertising, and analytics. ### Is consent required for Twitter Analytics? Yes. The cookies trigger Art 5(3) ePrivacy Directive and constitute profiling under Art 22 GDPR. Operators must collect prior, freely given, specific, informed, and unambiguous opt in consent before any X tag is loaded. A simple website notice or implicit consent is not sufficient under EDPB 03/2022 and CJEU Planet49. ### What legal basis applies? Only consent under Art 6(1)(a) GDPR is realistic. Legitimate interest under Art 6(1)(f) is ruled out by the systematic profiling, the cross site reach of the X graph, and the international transfer. Performance of a contract under Art 6(1)(b) is also unavailable because the data subject has no contract with the embedding website concerning the X cookies. ### Are data transferred to the United States? Yes. X Corp processes personal data in the US and withdrew from the EU US Data Privacy Framework in May 2023. Transfers rely on Standard Contractual Clauses with supplementary measures. Following Schrems II (C 311/18), operators must run a Transfer Impact Assessment that addresses FISA 702 and EO 12333 risks. ### Is a DPIA required? A DPIA under Art 35 GDPR is strongly recommended because the processing combines large scale profiling, behavioural cross site tracking, and a transfer to a third country without an adequacy decision. The DPIA should address technical safeguards, joint controllership, retention, and the right to object, in line with the EDPB list of high risk processing. ### How do I implement Twitter Analytics correctly? Block X widgets and Pixel by default in your tag manager, expose a granular consent category, only load the X scripts after opt in, document the joint controllership with X Corp, sign the X Data Processing Addendum, and run a Transfer Impact Assessment. Keep server logs of consent and provide a one click withdrawal. ### What are the alternatives? For audience measurement, EU based analytics such as Matomo, Plausible, Piwik PRO, or AT Internet (Piano Analytics) offer comparable insights with consent friendly modes. For social measurement, consider Buffer Analyze, Hootsuite, Iconosquare, or native LinkedIn and Mastodon analytics, ideally combined with static screenshots instead of live X embeds. ### How do I update the cookie policy? List X Corp as a third party recipient with US transfer, name the cookies (guest\_id, personalization\_id, ct0, twid, lang, \_twitter\_sess), state the retention periods, link to the X privacy policy, and explain how visitors can withdraw their consent. Update the policy whenever you add or remove X widgets or the X Pixel. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [HumCommerce](https://www.flowconsent.com/en/services/analytics/humcommerce) [HumCommerce is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. HumCommerce integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, HumCommerce helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/analytics/humcommerce) [Analytics](https://www.flowconsent.com/en/services/analytics/humcommerce) · ### [Moostik](https://www.flowconsent.com/en/services/analytics/moostik) [Moostik is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Moostik offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Moostik empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/moostik) [Analytics](https://www.flowconsent.com/en/services/analytics/moostik) · ### [SuperStats](https://www.flowconsent.com/en/services/analytics/superstats) [SuperStats is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SuperStats offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SuperStats empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/superstats) [Analytics](https://www.flowconsent.com/en/services/analytics/superstats) · ### [Clearbit Reveal](https://www.flowconsent.com/en/services/analytics/clearbit-reveal) [Clearbit Reveal is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Clearbit Reveal offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Clearbit Reveal empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/clearbit-reveal) [Analytics](https://www.flowconsent.com/en/services/analytics/clearbit-reveal) · ### [Graphly](https://www.flowconsent.com/en/services/analytics/graphly) [Graphly is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Graphly offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Graphly empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/graphly) [Analytics](https://www.flowconsent.com/en/services/analytics/graphly) · ### [BizSpring](https://www.flowconsent.com/en/services/analytics/bizspring) [BizSpring is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. BizSpring supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, BizSpring enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/bizspring) [Analytics](https://www.flowconsent.com/en/services/analytics/bizspring) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)