Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Userback is a visual feedback and bug reporting widget that captures screenshots, session recordings, console logs and browser metadata, which makes consent and a careful transfer assessment necessary.
Userback is a visual feedback and bug reporting tool provided by an Australian company. Website owners embed a JavaScript widget that lets visitors and testers annotate the page, leave comments and report issues. To reproduce those issues accurately, Userback can record the page, capture screenshots and collect detailed technical context. It is widely used by product and engineering teams during development and after release.
The public feedback widget mainly relies on browser localStorage to remember configuration and the reporter email, while the Userback customer dashboard uses cookies for authentication and session state. Beyond storage, Userback can capture screenshots, screen and session recordings, console logs, network errors, the IP address, a device identifier, browser and operating system metadata and any identity you pass to it. Recordings and screenshots can inadvertently include personal or even special category data shown on screen. Privacy controls allow you to mask fields and block specific pages or elements from capture.
Storing or reading information on a user device, whether through cookies or localStorage, falls under Art. 5(3) of the ePrivacy Directive, which requires prior consent unless the access is strictly necessary for a service the user explicitly requested. Session recording and the capture of console logs and screenshots go well beyond strict necessity, so they require consent. In parallel the GDPR applies to all the personal data processed, so you need a lawful basis under Art. 6, transparent information under Art. 13 and a data processing agreement with Userback as your processor. The combination of behavioural capture and rich technical metadata makes this a high attention deployment.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because Userback records sessions and reads from device storage for non essential purposes, you should obtain freely given, specific, informed and unambiguous consent before the widget activates these features. Consent must be as easy to withdraw as to give, and the widget should not record until the user has agreed. A strictly necessary feedback button that only opens on click and stores nothing until submission can sit closer to a legitimate interest basis, but the recording and replay features clearly need consent. Document the consent flow and keep records of when and how consent was captured.
Userback is based in Australia and hosts personal data on Amazon Web Services across regions that include Australia and the United States. Australia has no European adequacy decision, so transfers there rely on Standard Contractual Clauses supported by a transfer impact assessment and supplementary measures. For United States subprocessors you should check whether they are certified under the EU US Data Privacy Framework and otherwise fall back to Standard Contractual Clauses. Map the subprocessors Userback lists and keep your transfer documentation current.
Sign the Userback data processing agreement and review its subprocessor list. Gate the recording and replay features behind your consent management platform so nothing is captured before consent. Enable field masking and exclude pages that show sensitive information, and set retention so recordings are deleted when no longer needed. Complete a data protection impact assessment, document your transfer impact assessment for Australia and the United States, and update your privacy notice and cookie policy to describe Userback clearly.
Websites using Userback must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is strongly recommended. Userback records screenshots, session recordings, console logs and network activity that can capture sensitive personal data, combined with IP address and device identifiers and transfers to Australia and the United States. The systematic capture of user interactions on a large scale, together with third country transfers without an adequacy decision for Australia, raises the risk profile and warrants a documented assessment of necessity, proportionality and safeguards.
Sample consent text
We use Userback to collect your feedback and reproduce reported issues. With your consent, Userback may capture screenshots, session recordings, console logs and technical information about your browser and device, and may transfer this data to Australia and the United States. You can accept or decline this at any time.
Third-party domains contacted
userback.iostatic.userback.ioapp.userback.ioapi.userback.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _userback_session | first party | session | Maintains the authenticated dashboard session for Userback customers. |
| userback_io | first party | persistent | Stores widget configuration and reporter preferences in browser storage to recognise a returning feedback reporter. |
| XSRF-TOKEN | first party | session | Provides cross site request forgery protection for the Userback application. |
| ub_uid | third party | persistent | Associates feedback with a visitor identity passed by the host site for follow up and deduplication. |
Userback collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The public feedback widget mainly uses browser localStorage rather than cookies, storing configuration and the reporter email to identify a returning reporter. The Userback customer dashboard uses cookies such as a session cookie for authentication and interface state. Because localStorage is read from and written to the device, it is treated like a cookie under the ePrivacy rules. You should disclose both the dashboard cookies and the widget storage.
Yes for the non essential features. Session recording, screenshot capture, console logging and reading or writing device storage for those purposes require prior consent under Art. 5(3) ePrivacy. A minimal feedback button that opens only on click and stores nothing until the user submits can be closer to strictly necessary. In practice you should gate the recording features behind consent.
For the storage and capture features the lawful basis is consent under Art. 6(1)(a) GDPR, aligned with the ePrivacy consent for device access. Strictly necessary feedback handling can rely on legitimate interest under Art. 6(1)(f) after a balancing test. The provider acts as your processor, so a data processing agreement under Art. 28 is also required. Always document which basis applies to which feature.
Yes, Userback is based in Australia and hosts data on AWS in regions that include Australia and the United States. Both are third countries from a European perspective, and Australia has no adequacy decision. Transfers rely on Standard Contractual Clauses with a transfer impact assessment and supplementary measures. Check whether US subprocessors are certified under the EU US Data Privacy Framework.
Very likely yes. The systematic recording of user sessions, screenshots and console output can capture sensitive data on a large scale and is combined with third country transfers. These factors meet several of the criteria that trigger a data protection impact assessment. Document necessity, proportionality, the safeguards in place and the residual risk.
Sign the data processing agreement, then connect the recording features to your consent management platform so nothing is captured before consent. Enable field masking, exclude sensitive pages and set a short retention period for recordings. Update your privacy notice and cookie policy and complete your DPIA and transfer impact assessment before going live.
Yes. For lighter needs a simple feedback form that stores nothing on the device avoids most consent issues. EU hosted feedback and session tools reduce transfer complexity, and privacy first analytics can cover usage measurement without recordings. Choose the least intrusive option that meets your goal, and reserve full session capture for cases where it is genuinely necessary.
List the dashboard cookies and the widget localStorage entries with their purpose and duration, and describe the recording and capture features clearly. State that data is processed by Userback as a processor and transferred to Australia and the United States under Standard Contractual Clauses. Explain how users can give and withdraw consent, and keep the policy in step with the subprocessor list.