> Atlassian Confluence is a cloud knowledge base. Which cookies its embeds set, when GDPR consent is needed, how to handle US transfers and what to disclose.
>
> Canonical: https://www.flowconsent.com/en/services/cms/atlassian-confluence

CMS

# Atlassian Confluence

Unclassified · [Official website](https://www.atlassian.com/software/confluence/overview/team-collaboration-software)

Enterprise team workspace and knowledge base by Atlassian. When pages or status feeds are embedded on a site, Confluence drops session cookies, the atlassian.xsrf.token and analytics identifiers on the host domain.

[Block Atlassian Confluence until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [CMS](https://www.flowconsent.com/en/services/cms)

- Consent

  Unclassified

- Prior consent

  Required

- Documented cookies

  5

- Third-party domains

  4

- Servers

  Atlassian Cloud (United States, European Union or Australia depending on the workspace data residency setting)

Overview

## What does Atlassian Confluence do?

## **What Atlassian Confluence is**

Atlassian Confluence is a cloud collaboration workspace used to write documentation, meeting notes, product specifications and internal knowledge bases. Teams can publish pages externally, embed public pages on a marketing site, or expose a Statuspage feed. When embedded, the Confluence iframe loads scripts from the Atlassian domains and writes cookies on the host page that identify the visitor session.

## **Cookies and data collected**

The Confluence embed sets the ATL session cookie, JSESSIONID for the Java backend, atlassian.xsrf.token to protect against cross site request forgery, and analytics cookies such as ajs\_anonymous\_id used by Atlassian product analytics. It also collects the visitor IP, the user agent, the referring page, and timestamps for each page view. Authenticated viewers additionally have their Atlassian account identifier processed.

## **GDPR and ePrivacy implications**

The cookies set by the Confluence embed are not strictly necessary for the visitor of the host site, which means Article 5(3) of the ePrivacy Directive requires prior informed consent. Atlassian acts as a processor under Article 28 GDPR when the operator pushes its own users into Confluence, and as a controller for its own analytics. A data processing addendum signed with Atlassian is mandatory.

## **Consent and user controls**

Block the Confluence iframe until the visitor gives consent through the consent management platform. Provide a placeholder explaining what will be loaded, why, and a clear button to accept or refuse. Visitors must be able to withdraw consent at any time, which should remove the embed and clear the cookies set on the host domain.

## **Data transfers and hosting**

Atlassian Cloud is available with data residency in the United States, the European Union, the United Kingdom and Australia for Premium and Enterprise plans. Standard plans default to the US region. Atlassian is certified under the EU US Data Privacy Framework and signs Standard Contractual Clauses for transfers outside the EEA. Operators must check the actual residency of their workspace before stating no transfer occurs.

## **Practical compliance steps**

Sign the Atlassian DPA, set the workspace data residency to EU when EU users are involved, list the Confluence cookies in the cookie policy, block the embed until consent is collected, document Atlassian as a processor in the records of processing, and review access logs and shared link permissions on a regular basis.

Compliance

## Atlassian Confluence and the GDPR

Atlassian Confluence is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

- Legal basis

  Consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive) for the embed cookies and analytics identifiers. Legitimate interest (Article 6(1)(f) GDPR) may cover strictly necessary session cookies for authenticated Confluence users acting on behalf of the operator.

- Risk level

  medium

- Applicable regulations

  GDPR, ePrivacy Directive (Cookie Law), national implementations such as the French Data Protection Act and the German TDDDG, plus Schrems II case law for transfers to the United States.

### Impact assessment (DPIA)

A DPIA is recommended when Confluence pages are embedded on public sites with significant audience, when sensitive categories of content are published, or when the workspace processes employee data at scale. Document the data residency choice, the categories of viewers, the retention of access logs and the role of Atlassian as processor.

### Sample text for your banner

> We embed pages from our Atlassian Confluence workspace to share documentation and status updates. Confluence sets session cookies and an XSRF token on this page, and may transfer data to the United States. We need your consent to load the embed. You can accept, refuse or withdraw your consent at any time.

Cookies and trackers

## What Atlassian Confluence sets and contacts

- Tracking method

  JavaScript embeds and HTTP session cookies set by the Confluence host on the embedding site

- Server location

  Atlassian Cloud (United States, European Union or Australia depending on the workspace data residency setting)

- Data transferred outside the EU

  Possible transfer to the United States when the Confluence workspace is hosted in the US Atlassian region or when Atlassian support and infrastructure providers process data outside the EEA. Atlassian relies on the EU US Data Privacy Framework and Standard Contractual Clauses for international transfers. EU and AU data residency options are available on Premium and Enterprise plans.

### Cookies set (5)

| Name                 | Type             | Duration | Purpose                                                                               |
| -------------------- | ---------------- | -------- | ------------------------------------------------------------------------------------- |
| ATL                  | http\_session    | Session  | Identifies the Atlassian session for the Confluence backend.                          |
| JSESSIONID           | http\_session    | Session  | Java application server session identifier for Confluence.                            |
| atlassian.xsrf.token | http\_session    | Session  | Cross site request forgery protection token for Atlassian requests.                   |
| ajs\_anonymous\_id   | http\_persistent | 1 year   | Anonymous visitor identifier used by Atlassian product analytics.                     |
| ajs\_user\_id        | http\_persistent | 1 year   | Atlassian account identifier used by Atlassian product analytics for logged in users. |

### Third-party domains contacted (4)

- `atlassian.com`
- `atlassian.net`
- `atl-paas.net`
- `statuspage.io`

Questions

## Frequently asked questions about Atlassian Confluence

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Which cookies does the Atlassian Confluence embed set?

The embed writes ATL session and JSESSIONID cookies for the Atlassian backend, atlassian.xsrf.token for cross site request forgery protection, and analytics cookies such as ajs\_anonymous\_id and ajs\_user\_id from the Atlassian product analytics stack. Authenticated viewers also receive cookies tied to their Atlassian account session.

### Is user consent required to load Confluence on a public site?

Yes. The cookies set by the embed are not strictly necessary for the visitor of the host site, so Article 5(3) of the ePrivacy Directive requires prior, freely given, informed consent before the iframe is loaded. Use a blocker that replaces the embed with a placeholder until consent is collected.

### What is the legal basis for processing Confluence data?

For non essential cookies and the analytics identifiers the legal basis is consent under Article 6(1)(a) GDPR combined with Article 5(3) ePrivacy. For authenticated Confluence users acting on behalf of the operator, the legal basis is performance of a contract or legitimate interest under Article 6(1)(b) or 6(1)(f) GDPR, with Atlassian acting as processor.

### Does data leave the European Economic Area?

It can. Atlassian Cloud Standard plans default to the United States. Premium and Enterprise plans allow EU, UK and Australia data residency. Even with EU residency, support, monitoring or sub processors may access data from the US or other regions. Atlassian relies on the EU US Data Privacy Framework and Standard Contractual Clauses.

### Is a Data Protection Impact Assessment required?

A DPIA is recommended when Confluence is used at scale, when it processes employee data with monitoring features, when the embedded content targets minors or covers sensitive topics, or when the workspace is hosted outside the EEA. Document the data flows, the residency, the access controls and the retention periods.

### How do I implement Confluence compliance correctly?

Sign the Atlassian Data Processing Addendum, choose EU data residency where possible, block the embed until consent is captured, configure the cookie scanner to detect ATL, JSESSIONID and atlassian.xsrf.token, restrict shared link permissions, and add Atlassian to the records of processing as a processor with the proper transfer safeguards.

### Are there alternatives to embedding Confluence?

Yes. You can export pages to static HTML or PDF and host them on your own domain, use a self hosted wiki such as BookStack or Outline, or publish documentation through a generator like Docusaurus. These options avoid third party cookies and US transfers at the cost of losing real time updates from Confluence.

### How do I update the cookie policy for Confluence?

List ATL, JSESSIONID, atlassian.xsrf.token and the Atlassian product analytics cookies with their purpose, duration and the third party that sets them. State that data may be transferred to Atlassian outside the EEA, mention the Data Privacy Framework and Standard Contractual Clauses, link to the Atlassian privacy policy, and offer a way to withdraw consent at any time.

Same category

## More services: CMS

[See the whole category](https://www.flowconsent.com/en/services/cms)

### [Oreed](https://www.flowconsent.com/en/services/cms/oreed)

[Oreed is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Oreed integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Oreed helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/oreed)

[CMS](https://www.flowconsent.com/en/services/cms/oreed)

·

### [Prismic](https://www.flowconsent.com/en/services/cms/prismic)

[Prismic is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Prismic supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Prismic ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/prismic)

[CMS](https://www.flowconsent.com/en/services/cms/prismic)

·

### [Kubio Builder](https://www.flowconsent.com/en/services/cms/kubio-builder)

[Kubio Builder is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Kubio Builder supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Kubio Builder enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/kubio-builder)

[CMS](https://www.flowconsent.com/en/services/cms/kubio-builder)

·

### [FlexCMP](https://www.flowconsent.com/en/services/cms/flexcmp)

[FlexCMP provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, FlexCMP supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, FlexCMP delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and search engine visibility.](https://www.flowconsent.com/en/services/cms/flexcmp)

[CMS](https://www.flowconsent.com/en/services/cms/flexcmp)

·

### [Jive](https://www.flowconsent.com/en/services/cms/jive)

[Jive is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Jive is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Jive offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/cms/jive)

[CMS](https://www.flowconsent.com/en/services/cms/jive)

·

### [Sarka-SPIP](https://www.flowconsent.com/en/services/cms/sarka-spip)

[Sarka-SPIP is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sarka-SPIP integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sarka-SPIP helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/sarka-spip)

[CMS](https://www.flowconsent.com/en/services/cms/sarka-spip)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)