SnapEngage
SnapEngage is an enterprise live chat and customer engagement platform used across healthcare, finance, and SaaS industries. It sets cookies and collects visitor data including IP addresses, browsing behaviour, and full conversation transcripts from the moment the widget loads. Because SnapEngage processes data on US infrastructure by default, its deployment on European websites requires prior consent under GDPR and the ePrivacy Directive, along with appropriate transfer safeguards.
What does SnapEngage do?
What is SnapEngage?
SnapEngage is an enterprise-grade live chat and customer engagement platform designed for industries with high compliance requirements, including healthcare, financial services, and SaaS. It offers live chat, chatbot automation, visitor monitoring, CRM integration, and a unified agent workspace. SnapEngage is notably one of the few live chat platforms to offer HIPAA-compliant configurations for healthcare use. When embedded on a website, the SnapEngage JavaScript snippet loads immediately and begins collecting visitor data, setting cookies, and tracking page behaviour before any chat is initiated.
What data and cookies does SnapEngage collect?
SnapEngage sets persistent visitor identification cookies and session cookies to track returning visitors and maintain conversation continuity. It collects IP addresses, browser and device type, pages visited before and during the chat, referrer URLs, geolocation derived from IP, and the full transcript of all chat conversations. When integrated with CRM systems such as Salesforce or HubSpot, visitor and conversation data is synchronised with contact records, significantly extending the personal data processing chain.
GDPR and ePrivacy implications
SnapEngage loads its snippet on page entry and collects visitor data before any interaction, triggering the ePrivacy Directive requirement for prior consent. Under GDPR, the collection of IP addresses, behavioural data, and conversation transcripts constitutes personal data processing requiring a lawful basis. In healthcare deployments, conversation content may constitute health data under Article 9 GDPR, requiring explicit consent and a higher standard of data protection safeguards.
Consent requirements
Consent must be obtained before the SnapEngage snippet loads. The consent notice must explain that SnapEngage is used for live chat, describe the data collected, and disclose the US data transfer. For healthcare or other sensitive use cases, the consent notice should specifically acknowledge the possibility that sensitive personal data may be shared in the chat and that appropriate safeguards are in place. The widget must be fully suppressed for users who decline and disabled immediately upon withdrawal.
Data transfers outside the EU
SnapEngage processes data on US infrastructure by default. EU data residency is available for enterprise customers. For organisations that cannot use EU residency, Standard Contractual Clauses are the applicable transfer mechanism under GDPR Article 46. Organisations in regulated sectors should prioritise the EU data residency option and verify that the full processing chain including CRM integrations keeps data within the EU. All transfers must be documented in the Records of Processing Activities.
Practical compliance steps
To deploy SnapEngage compliantly in the EU: block the snippet until consent is obtained; categorise SnapEngage under functional or customer support cookies; update your privacy policy to name SnapEngage as a processor and disclose the US transfer or EU residency configuration; sign a Data Processing Agreement with SnapEngage; if in healthcare, verify HIPAA and GDPR alignment and use SnapEngage's secure messaging configuration; review CRM integration data flows to ensure personal data is not transferred to US-based CRMs without appropriate safeguards; and document all processing activities in your RoPA.
SnapEngage and the GDPR
SnapEngage is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) for tracking and visitor identification cookies. Legitimate interest (Art. 6(1)(f)) may apply to strictly functional session continuity for conversations explicitly initiated by the user.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, UK GDPR, CCPA, HIPAA (healthcare configurations)
Impact assessment (DPIA)
A DPIA is recommended when SnapEngage is used in healthcare or other regulated sectors where conversations may contain sensitive personal data, or when visitor profiling is combined with CRM data. The US data transfer, persistent visitor tracking, and potential processing of special category data in chat transcripts all contribute to an elevated risk profile.
Sample text for your banner
We use SnapEngage to provide live chat support on this website. SnapEngage sets cookies and collects data including your IP address, browsing behaviour, and conversation content. This data may be transferred to and processed in the United States. Please accept to enable the live chat feature.
What SnapEngage sets and contacts
- Tracking method
- JavaScript snippet, first-party and third-party cookies, localStorage, server-side session and conversation logging
- Server location
- United States (primary). EU data residency available for enterprise customers via EU-hosted infrastructure.
- Data transferred outside the EU
- SnapEngage is a US-headquartered company. By default, conversation and visitor data is processed on US infrastructure. EU data residency is available for enterprise customers. Transfers rely on Standard Contractual Clauses under GDPR Article 46.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __snapsession | session | Session | Session identifier used to maintain the active SnapEngage chat conversation state |
| __snapvisitor | persistent | 1 year | Persistent visitor identifier used to recognise returning chat users across visits |
| __snaplanguage | persistent | 1 year | Stores the visitor language preference for the chat widget interface |
Third-party domains contacted (3)
snapengage.comstorage.googleapis.comwww.snapengage.com
Frequently asked questions about SnapEngage
Can't find your question? Write to us, we answer fast.
What cookies does SnapEngage set?
SnapEngage sets persistent visitor identification cookies to recognise returning chat users and link sessions across visits, as well as session-level cookies to maintain active conversation state. It also uses localStorage for widget preferences. These cookies are set on page entry before any user interaction, making prior consent under the ePrivacy Directive mandatory.
Does SnapEngage require user consent under GDPR?
Yes. SnapEngage loads its snippet on page entry and begins collecting visitor data and setting cookies before any interaction. Consent must be obtained via a CMP before the script initialises. The consent notice must disclose SnapEngage as a live chat processor and mention the US data transfer unless EU residency is configured.
What is the legal basis for using SnapEngage?
Consent under Article 6(1)(a) GDPR is the appropriate legal basis for SnapEngage's tracking and visitor identification cookies. For healthcare deployments where conversation content may include health data, explicit consent under Article 9(2)(a) is required for the processing of special category data. Legitimate interest under Article 6(1)(f) may apply for strictly functional session continuity after a conversation is initiated.
Does SnapEngage transfer data outside the EU?
By default, yes. SnapEngage processes data on US infrastructure. EU data residency is available for enterprise customers. For organisations on standard plans, Standard Contractual Clauses apply as the transfer mechanism under GDPR Article 46. All US transfers must be documented in the Records of Processing Activities with the applicable safeguard identified.
Do I need a DPIA for SnapEngage?
A DPIA is recommended when SnapEngage is used in healthcare or other sensitive sectors, when conversation data is linked with CRM data to create detailed user profiles, or when large volumes of European visitors are tracked and profiled. The US data transfer, persistent visitor tracking, and potential processing of special category health data all contribute to a risk profile that warrants formal impact assessment.
How do I implement SnapEngage in a GDPR-compliant way?
Block the SnapEngage snippet until consent is obtained via your CMP. For healthcare, use SnapEngage's secure messaging and HIPAA-aligned configuration. Update your privacy policy to name SnapEngage as a processor and disclose the US transfer. Sign a DPA with SnapEngage. Review CRM integrations to ensure personal data transferred to third-party CRMs stays within appropriate jurisdictions. Document all processing in your RoPA.
Are there alternatives to SnapEngage for regulated industries?
For healthcare in the EU, consider Userlike or HelpCrunch with EU data residency. For full data sovereignty, self-hosted Rocket.Chat or Chatwoot deployed on EU infrastructure eliminates third-country transfer concerns. For organisations requiring HIPAA compliance without GDPR complexity, US-only deployments with geographically restricted visitor scope may be appropriate.
How do I update my cookie policy to include SnapEngage?
Add entries for the SnapEngage visitor identification cookie and session cookie in your cookie policy, listing their names, categories (functional), durations, and purposes. Note any CRM integration cookies separately. Reference SnapEngage as a third-party processor and link to their privacy policy. Disclose the US data transfer and the applicable SCC safeguard, or note EU residency if configured.
REI Chat
REI Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. REI Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, REI Chat helps convert visitors into customers.
Groove
Groove is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Groove integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Groove helps organizations maintain robust websites that meet user expectations and technical requirements.
LimeChat
LimeChat is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. LimeChat integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, LimeChat makes advanced AI accessible to all teams.
Spruce
Spruce is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Spruce provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Spruce helps deliver the right message to the right audience at the right time.
Onlim
Onlim is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Onlim integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Onlim helps organizations maintain robust websites that meet user expectations and technical requirements.
DearDoc
DearDoc is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. DearDoc supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, DearDoc ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.