Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Chameleon is a product adoption platform that adds in product tours, tooltips, surveys, and onboarding to web applications. To decide what to show and to measure engagement it identifies users, records in product usage events, and stores which experiences a person has seen, along with the IP address and device information. On European products the analytics and survey features generally require consent, while essential onboarding may rely on another basis.
Chameleon is a product adoption platform used inside web applications to guide users with tours, tooltips, launchers, and surveys. Product teams use it to onboard new users, announce features, and collect feedback without shipping new code, which means it observes how people move through the product.
Chameleon identifies users, usually with an id passed from your application, and records usage events and which experiences a person has seen. It stores state in cookies and local storage and processes the IP address and device information. Because it runs inside authenticated products, this data is typically linked to a known individual.
The identifiers and usage events are personal data under the GDPR, and the cookies and storage fall under the ePrivacy Directive. Storage needed to remember that a tour was completed may be closer to strictly necessary, but behavioural analytics and surveys go beyond that, so you need a clear legal basis and to inform users.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Decide the basis per purpose. Essential onboarding inside a service the user has signed up for may rely on legitimate interest or contract, while analytics that profile behaviour and optional surveys should rely on consent. Configure Chameleon so non essential tracking waits for consent, and make withdrawal easy.
Chameleon is a United States company, so personal data may be processed there and transfers rely on the EU US Data Privacy Framework or on Standard Contractual Clauses. Limit the user attributes you send to Chameleon to reduce the personal data crossing borders.
Map each Chameleon purpose to a legal basis, gate non essential analytics behind consent, minimise the attributes you pass, and sign a data processing agreement. Document the processing, set retention limits, and describe Chameleon in your privacy notice and cookie policy.
Websites using Chameleon must obtain user consent under GDPR regulations.
DPIA considerations
Chameleon links usage events to identified users in your product, so assess what behavioural data is collected, whether it is used for analytics beyond onboarding, the retention, and the transfers to the United States. Clarify the legal basis for each purpose.
Sample consent text
We use Chameleon to guide you through our product and to gather feedback. Chameleon may set cookies and record how you use features. Non essential analytics run only after you accept the relevant cookies.
Third-party domains contacted
trychameleon.comfast.trychameleon.comedge.trychameleon.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| chmln.session | Functional | Session | Maintains the Chameleon session within the product during the visit. |
| chmln.profile | Analytics | 1 year | Stores the user profile identifier used to target and measure in product experiences. |
| chmln.seen | Functional | 1 year | Records which tours and tooltips a user has already seen to avoid repeating them. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
Chameleon sets a session value, a profile identifier, and storage that records which tours a user has seen. The value that remembers a completed tour can be close to necessary, while the profile and analytics storage is not and belongs in the analytics category.
For non essential analytics and surveys, yes. Essential onboarding within a service the user signed up for may rely on another basis, but behavioural tracking requires prior consent under the ePrivacy Directive and the GDPR.
It depends on purpose. Contract or legitimate interest can cover essential onboarding, while consent under Article 6(1)(a) of the GDPR is appropriate for behavioural analytics and optional surveys.
Yes. Chameleon is a United States company, so data may be processed there and transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Sending fewer user attributes reduces the data transferred.
A targeted assessment helps where usage tracking is extensive or combined with other analytics. Document the attributes sent, the events collected, the retention, and the transfers.
Assign a legal basis per purpose, gate non essential analytics behind consent, minimise the attributes you pass, and sign a data processing agreement. Describe Chameleon in your privacy notice and cookie policy.
Alternatives include Appcues, Pendo, Userpilot, and Intro.js for self hosted tours. Lighter, self hosted onboarding can reduce both tracking and transfers.
List the Chameleon storage entries with their purpose and duration, separate essential onboarding from analytics, name Chameleon as the recipient, and mention the United States transfer. Update it when your configuration changes.