Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Kaltura is a video platform used for hosting, streaming, and embedding video across websites, learning environments, and enterprise portals. Its embedded player can set cookies and collect viewing analytics such as plays, watch time, and device information, along with the IP address. For European websites the analytics and embed cookies require prior consent, while a strictly necessary player function may operate on a different basis.
Kaltura is a video technology platform used to host, stream, and embed video in websites, online courses, and enterprise portals. It provides a customisable player, transcoding and delivery, and detailed video analytics, and it is common in media, education, and corporate communications.
When a Kaltura player is embedded, it can set cookies to keep player state and to support analytics. It records viewing events such as plays, pauses, and watch time, and processes the IP address and device and browser information. In portals where viewers sign in, viewing data can be tied to a user account, which increases the sensitivity of the processing.
Viewing analytics and the identifiers behind them are personal data under the GDPR, and storing or reading cookies on the device is governed by the ePrivacy Directive. A cookie that is strictly necessary to play a video the user has requested can be exempt, but analytics, audience measurement, and cross session identification are not, so they require a lawful basis and clear information.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Where Kaltura sets analytics or marketing cookies, prior consent is required, and the player should be configured so those cookies are not set until the visitor accepts. Consent must be freely given, specific, informed, and easy to withdraw. A practical pattern is to load the player only after consent, or to use a privacy preserving embed that defers analytics until the user agrees.
Kaltura is a United States company, so personal data may be processed in the United States and transfers must rely on the EU US Data Privacy Framework or on Standard Contractual Clauses. Some plans offer regional hosting, which can keep delivery and analytics closer to your users and reduce transfer exposure.
Map which Kaltura cookies are strictly necessary and which are analytics, gate the non essential ones behind consent, sign a data processing agreement, and choose regional hosting where available. Document the processing, set retention limits for viewing analytics, and describe Kaltura in your cookie policy and privacy notice.
Websites using Kaltura must obtain user consent under GDPR regulations.
DPIA considerations
Assess what viewing analytics the Kaltura player collects, whether viewers can be identified across sessions, the retention of analytics, and the transfers to the United States. A targeted assessment is useful where video viewing is linked to user accounts.
Sample consent text
We use Kaltura to play and measure videos. Kaltura may set cookies and collect viewing statistics such as watch time. These features run only after you accept the relevant cookies.
Third-party domains contacted
kaltura.comcdnapisec.kaltura.comcfvod.kaltura.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| kaltura_session | Functional | Session | Maintains the state of the video player during playback. |
| pid | Analytics | 1 year | Identifies the browser for video viewing analytics. |
| vid | Analytics | 1 year | Records unique video views and watch behaviour for reporting. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
The Kaltura player can set a session cookie to keep playback state and analytics cookies to identify a browser and record viewing behaviour. The session cookie may be strictly necessary, while the analytics cookies are not and belong in the analytics category of your banner.
You need consent for the analytics and any marketing cookies the player sets. A cookie strictly necessary to play a video the visitor explicitly requested can be exempt, but viewing analytics require prior consent under the ePrivacy Directive.
Consent under Article 6(1)(a) of the GDPR is the basis for analytics and audience measurement. A strictly necessary playback cookie can rely on the ePrivacy exemption, and account based viewing should be covered in your wider privacy notice.
Yes, Kaltura is a United States company and may process data there, so transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Regional hosting, where available, can reduce this exposure.
A full assessment is not always required, but a targeted one is wise where viewing is linked to identified users or used to profile audiences. Document the analytics collected, the retention, and the transfers.
Configure the player so analytics cookies wait for consent, or load the embed only after the visitor accepts. Sign a data processing agreement, choose regional hosting if offered, and describe the cookies in your policy.
Alternatives include Vimeo, Dailymotion, JW Player, and self hosted players, as well as privacy modes that disable tracking. The same consent rules apply to any embedded player that sets non essential cookies.
List the Kaltura cookies with their purpose and duration, separate strictly necessary from analytics, name Kaltura as the recipient, and mention the United States transfer. Update it whenever you change the player configuration.