Atlassian Confluence
Enterprise team workspace and knowledge base by Atlassian. When pages or status feeds are embedded on a site, Confluence drops session cookies, the atlassian.xsrf.token and analytics identifiers on the host domain.
What does Atlassian Confluence do?
What Atlassian Confluence is
Atlassian Confluence is a cloud collaboration workspace used to write documentation, meeting notes, product specifications and internal knowledge bases. Teams can publish pages externally, embed public pages on a marketing site, or expose a Statuspage feed. When embedded, the Confluence iframe loads scripts from the Atlassian domains and writes cookies on the host page that identify the visitor session.
Cookies and data collected
The Confluence embed sets the ATL session cookie, JSESSIONID for the Java backend, atlassian.xsrf.token to protect against cross site request forgery, and analytics cookies such as ajs_anonymous_id used by Atlassian product analytics. It also collects the visitor IP, the user agent, the referring page, and timestamps for each page view. Authenticated viewers additionally have their Atlassian account identifier processed.
GDPR and ePrivacy implications
The cookies set by the Confluence embed are not strictly necessary for the visitor of the host site, which means Article 5(3) of the ePrivacy Directive requires prior informed consent. Atlassian acts as a processor under Article 28 GDPR when the operator pushes its own users into Confluence, and as a controller for its own analytics. A data processing addendum signed with Atlassian is mandatory.
Consent and user controls
Block the Confluence iframe until the visitor gives consent through the consent management platform. Provide a placeholder explaining what will be loaded, why, and a clear button to accept or refuse. Visitors must be able to withdraw consent at any time, which should remove the embed and clear the cookies set on the host domain.
Data transfers and hosting
Atlassian Cloud is available with data residency in the United States, the European Union, the United Kingdom and Australia for Premium and Enterprise plans. Standard plans default to the US region. Atlassian is certified under the EU US Data Privacy Framework and signs Standard Contractual Clauses for transfers outside the EEA. Operators must check the actual residency of their workspace before stating no transfer occurs.
Practical compliance steps
Sign the Atlassian DPA, set the workspace data residency to EU when EU users are involved, list the Confluence cookies in the cookie policy, block the embed until consent is collected, document Atlassian as a processor in the records of processing, and review access logs and shared link permissions on a regular basis.
Atlassian Confluence and the GDPR
Atlassian Confluence is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive) for the embed cookies and analytics identifiers. Legitimate interest (Article 6(1)(f) GDPR) may cover strictly necessary session cookies for authenticated Confluence users acting on behalf of the operator.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive (Cookie Law), national implementations such as the French Data Protection Act and the German TDDDG, plus Schrems II case law for transfers to the United States.
Impact assessment (DPIA)
A DPIA is recommended when Confluence pages are embedded on public sites with significant audience, when sensitive categories of content are published, or when the workspace processes employee data at scale. Document the data residency choice, the categories of viewers, the retention of access logs and the role of Atlassian as processor.
Sample text for your banner
We embed pages from our Atlassian Confluence workspace to share documentation and status updates. Confluence sets session cookies and an XSRF token on this page, and may transfer data to the United States. We need your consent to load the embed. You can accept, refuse or withdraw your consent at any time.
What Atlassian Confluence sets and contacts
- Tracking method
- JavaScript embeds and HTTP session cookies set by the Confluence host on the embedding site
- Server location
- Atlassian Cloud (United States, European Union or Australia depending on the workspace data residency setting)
- Data transferred outside the EU
- Possible transfer to the United States when the Confluence workspace is hosted in the US Atlassian region or when Atlassian support and infrastructure providers process data outside the EEA. Atlassian relies on the EU US Data Privacy Framework and Standard Contractual Clauses for international transfers. EU and AU data residency options are available on Premium and Enterprise plans.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ATL | http_session | Session | Identifies the Atlassian session for the Confluence backend. |
| JSESSIONID | http_session | Session | Java application server session identifier for Confluence. |
| atlassian.xsrf.token | http_session | Session | Cross site request forgery protection token for Atlassian requests. |
| ajs_anonymous_id | http_persistent | 1 year | Anonymous visitor identifier used by Atlassian product analytics. |
| ajs_user_id | http_persistent | 1 year | Atlassian account identifier used by Atlassian product analytics for logged in users. |
Third-party domains contacted (4)
atlassian.comatlassian.netatl-paas.netstatuspage.io
Frequently asked questions about Atlassian Confluence
Can't find your question? Write to us, we answer fast.
Which cookies does the Atlassian Confluence embed set?
The embed writes ATL session and JSESSIONID cookies for the Atlassian backend, atlassian.xsrf.token for cross site request forgery protection, and analytics cookies such as ajs_anonymous_id and ajs_user_id from the Atlassian product analytics stack. Authenticated viewers also receive cookies tied to their Atlassian account session.
Is user consent required to load Confluence on a public site?
Yes. The cookies set by the embed are not strictly necessary for the visitor of the host site, so Article 5(3) of the ePrivacy Directive requires prior, freely given, informed consent before the iframe is loaded. Use a blocker that replaces the embed with a placeholder until consent is collected.
What is the legal basis for processing Confluence data?
For non essential cookies and the analytics identifiers the legal basis is consent under Article 6(1)(a) GDPR combined with Article 5(3) ePrivacy. For authenticated Confluence users acting on behalf of the operator, the legal basis is performance of a contract or legitimate interest under Article 6(1)(b) or 6(1)(f) GDPR, with Atlassian acting as processor.
Does data leave the European Economic Area?
It can. Atlassian Cloud Standard plans default to the United States. Premium and Enterprise plans allow EU, UK and Australia data residency. Even with EU residency, support, monitoring or sub processors may access data from the US or other regions. Atlassian relies on the EU US Data Privacy Framework and Standard Contractual Clauses.
Is a Data Protection Impact Assessment required?
A DPIA is recommended when Confluence is used at scale, when it processes employee data with monitoring features, when the embedded content targets minors or covers sensitive topics, or when the workspace is hosted outside the EEA. Document the data flows, the residency, the access controls and the retention periods.
How do I implement Confluence compliance correctly?
Sign the Atlassian Data Processing Addendum, choose EU data residency where possible, block the embed until consent is captured, configure the cookie scanner to detect ATL, JSESSIONID and atlassian.xsrf.token, restrict shared link permissions, and add Atlassian to the records of processing as a processor with the proper transfer safeguards.
Are there alternatives to embedding Confluence?
Yes. You can export pages to static HTML or PDF and host them on your own domain, use a self hosted wiki such as BookStack or Outline, or publish documentation through a generator like Docusaurus. These options avoid third party cookies and US transfers at the cost of losing real time updates from Confluence.
How do I update the cookie policy for Confluence?
List ATL, JSESSIONID, atlassian.xsrf.token and the Atlassian product analytics cookies with their purpose, duration and the third party that sets them. State that data may be transferred to Atlassian outside the EEA, mention the Data Privacy Framework and Standard Contractual Clauses, link to the Atlassian privacy policy, and offer a way to withdraw consent at any time.
Oreed
Oreed is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Oreed integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Oreed helps organizations maintain robust websites that meet user expectations and technical requirements.
%20%20--%3E%0A%3Csvg%20height%3D%22100%25%22%20width%3D%22100%25%22%20version%3D%221.1%22%20id%3D%22Layer_1%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20x%3D%220px%22%20y%3D%220px%22%20viewBox%3D%220%200%20512%20512%22%20style%3D%22enable-background%3Anew%200%200%20512%20512%3B%22%20xml%3Aspace%3D%22preserve%22%3E%0A%3Cstyle%20type%3D%22text%2Fcss%22%3E%0A%09.st0%7Bfill-rule%3Aevenodd%3Bclip-rule%3Aevenodd%3Bfill%3A%23E55638%3B%7D%0A%09.st1%7Bfill-rule%3Aevenodd%3Bclip-rule%3Aevenodd%3Bfill%3A%23F4C942%3B%7D%0A%09.st2%7Bfill-rule%3Aevenodd%3Bclip-rule%3Aevenodd%3Bfill%3A%237B8FEA%3B%7D%0A%09.st3%7Bfill-rule%3Aevenodd%3Bclip-rule%3Aevenodd%3Bfill%3A%23D97EE8%3B%7D%0A%3C%2Fstyle%3E%0A%3Cg%3E%0A%09%3Cpath%20class%3D%22st0%22%20d%3D%22M446.1%2C17.1c20.6%2C10.9%2C37.4%2C27.8%2C48.3%2C48.4c11.1%2C20.9%2C17.1%2C41.6%2C17.1%2C98.6v100.2c0%2C1.3-0.8%2C2.5-2%2C3%20%20%20c-1.2%2C0.5-2.6%2C0.2-3.5-0.7v0l-37.8-37.8c-3-3-4.7-7.1-4.7-11.3v-46.3c0-42.8-4.5-58.3-12.8-74C442.6%2C81.7%2C430%2C69%2C414.5%2C60.8%20%20%20c-15.4-8.3-30.8-12.7-72.4-12.8l-62.4%2C0c-1.3%2C0-2.5-0.8-2.9-2s-0.2-2.6%2C0.7-3.5l37.8-37.8c3-3%2C7.1-4.7%2C11.3-4.7h21.2%20%20%20C404.6%2C0%2C425.3%2C5.9%2C446.1%2C17.1z%20M367.8%2C80c35.3%2C0%2C63.9%2C28.7%2C63.9%2C64v40.5c0%2C1.3-0.8%2C2.4-1.9%2C2.9s-2.5%2C0.3-3.5-0.6l-51.5-49.3%20%20%20c-3.4-3.4-7.4-5.9-11.6-7.4c-3.6-1.4-7.4-2.1-11.3-2.1h-152c-1.3%2C0-2.5-0.8-3-2c-0.5-1.2-0.2-2.6%2C0.7-3.5l37.8-37.9%20%20%20c3-3%2C7-4.7%2C11.3-4.7H367.8z%22%2F%3E%0A%09%3Cpath%20class%3D%22st1%22%20d%3D%22M469%2C277.5l37.8%2C37.8c3%2C3%2C4.7%2C7.1%2C4.7%2C11.3v21.3c0%2C57-5.9%2C77.7-17.1%2C98.6c-10.9%2C20.6-27.7%2C37.5-48.3%2C48.4%20%20%20c-20.8%2C11.1-41.5%2C17.1-98.4%2C17.1h-100c-1.3%2C0-2.5-0.8-2.9-2s-0.2-2.6%2C0.7-3.5v0l37.8-37.8c3-3%2C7.1-4.7%2C11.3-4.7h46.2%20%20%20c42.7%2C0%2C58.2-4.5%2C73.8-12.8c15.4-8.2%2C28-20.8%2C36.2-36.3c8.3-15.6%2C12.8-31.2%2C12.8-74v-61.2c0-1.3%2C0.8-2.4%2C2-2.9%20%20%20C466.7%2C276.3%2C468.1%2C276.6%2C469%2C277.5z%20M389.2%2C197.5l37.8%2C37.9c3%2C3%2C4.7%2C7.1%2C4.7%2C11.3V368c0%2C35.3-28.6%2C64-63.9%2C64h-40.4%20%20%20c-1.3%2C0-2.4-0.8-2.9-1.9s-0.3-2.5%2C0.6-3.5v0l49.2-51.6c3.4-3.4%2C5.9-7.4%2C7.4-11.7c1.4-3.6%2C2.1-7.4%2C2-11.3V199.7c0-1.3%2C0.8-2.5%2C2-3%20%20%20C386.9%2C196.3%2C388.3%2C196.5%2C389.2%2C197.5z%22%2F%3E%0A%09%3Cpath%20class%3D%22st2%22%20d%3D%22M6%2C245.5l37.8%2C37.8c3%2C3%2C4.7%2C7.1%2C4.7%2C11.3v46.3c0%2C42.8%2C4.4%2C58.3%2C12.8%2C74c8.2%2C15.4%2C20.8%2C28.1%2C36.2%2C36.3%20%20%20c15.6%2C8.4%2C31.1%2C12.8%2C73.8%2C12.8h61.1c1.3%2C0%2C2.5%2C0.8%2C3%2C2c0.5%2C1.2%2C0.2%2C2.6-0.7%2C3.5l-37.8%2C37.8c-3%2C3-7.1%2C4.7-11.3%2C4.7h-21.2%20%20%20c-56.9%2C0-77.6-5.9-98.4-17.1c-20.6-10.9-37.4-27.8-48.3-48.4c-11-20.7-16.9-41.1-17.1-96.9l0-101.9c0-1.3%2C0.8-2.4%2C2-2.9%20%20%20C3.7%2C244.3%2C5.1%2C244.6%2C6%2C245.5z%20M85.8%2C325.2L85.8%2C325.2l51.5%2C49.3c3.4%2C3.4%2C7.4%2C5.9%2C11.6%2C7.4c3.5%2C1.3%2C7.3%2C2.1%2C11.3%2C2.1h152%20%20%20c1.3%2C0%2C2.5%2C0.8%2C2.9%2C2c0.5%2C1.2%2C0.2%2C2.6-0.7%2C3.5l-37.8%2C37.9c-3%2C3-7.1%2C4.7-11.3%2C4.7H144.2c-17%2C0-33.2-6.8-45.2-18.8%20%20%20c-12-12-18.7-28.3-18.7-45.2v-40.5c0-1.3%2C0.8-2.4%2C1.9-2.9S84.9%2C324.3%2C85.8%2C325.2z%22%2F%3E%0A%09%3Cpath%20class%3D%22st3%22%20d%3D%22M184.7%2C80c1.3%2C0%2C2.4%2C0.8%2C2.9%2C1.9c0.5%2C1.2%2C0.3%2C2.5-0.6%2C3.5L137.8%2C137c-3.4%2C3.4-5.9%2C7.4-7.4%2C11.7%20%20%20c-1.4%2C3.6-2.1%2C7.4-2.1%2C11.3v152.3c0%2C1.3-0.8%2C2.4-2%2C2.9c-1.2%2C0.5-2.6%2C0.2-3.5-0.7L85%2C276.7c-3-3-4.7-7.1-4.7-11.3V144%20%20%20c0-35.3%2C28.6-64%2C63.9-64H184.7z%20M264.3%2C0c1.3%2C0%2C2.5%2C0.8%2C2.9%2C2s0.2%2C2.6-0.7%2C3.5l-37.8%2C37.8c-3%2C3-7.1%2C4.7-11.3%2C4.7h-46.2%20%20%20c-42.7%2C0-58.2%2C4.5-73.8%2C12.8C82%2C69%2C69.4%2C81.7%2C61.2%2C97.1c-8.3%2C15.5-12.7%2C30.8-12.8%2C72.6l0%2C62.6c0%2C1.3-0.8%2C2.4-2%2C2.9%20%20%20s-2.6%2C0.2-3.5-0.7L5.2%2C196.7c-3-3-4.7-7.1-4.7-11.3v-21.3c0-57%2C5.9-77.7%2C17.1-98.6C28.5%2C44.9%2C45.3%2C28%2C65.9%2C17.1%20%20%20C86.5%2C6.1%2C107%2C0.1%2C162.6%2C0L264.3%2C0z%22%2F%3E%0A%3C%2Fg%3E%0A%3C%2Fsvg%3E)
Prismic
Prismic is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Prismic supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Prismic ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Kubio Builder
Kubio Builder is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Kubio Builder supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Kubio Builder enables informed decisions that improve experience and drive results.
FlexCMP
FlexCMP provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, FlexCMP supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, FlexCMP delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and search engine visibility.
Jive
Jive is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Jive is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Jive offers reliable solutions that scale with organizational needs and evolving web standards.
Sarka-SPIP
Sarka-SPIP is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sarka-SPIP integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sarka-SPIP helps organizations maintain robust websites that meet user expectations and technical requirements.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.