Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Fanplayr is a US based real time personalization service that segments visitors live, shows targeted offers and nudges, and builds behavioural profiles for ecommerce. It sets tracking cookies and transfers personal data to the United States, which makes it a high risk third party that requires consent before it loads. Operators should document the legal basis, the transfer safeguards, and the profiling involved.
Fanplayr is a US based personalization service from Silicon Valley that provides real time behavioural data and targeting for ecommerce sites. It segments visitors as they browse, shows targeted offers and nudges, and builds behavioural profiles that drive on site personalization. It operates through its own domains, including fanplayr.com, cdn.fanplayr.com and tag.fanplayr.com, and for the operator it is a high impact third party because it actively profiles individual visitors rather than just measuring aggregate traffic.
Fanplayr loads a JavaScript tag that observes visitor behaviour in real time, such as pages viewed, products browsed, and actions taken, and assigns the visitor to live segments. Based on those segments it can trigger targeted offers, messages, and nudges intended to influence the visitor journey. To do this it sets tracking cookies and sends behavioural data to its systems in the United States, where the profiling and decision logic run.
Fanplayr typically sets tracking cookies and processes behavioural data such as browsing activity, cart and product interactions, device and session signals, and segment membership. This information is used to build and update a behavioural profile that powers personalization. Operators should review the exact cookies and data fields in their own deployment, since these can vary by configuration and integration.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because Fanplayr sets non essential cookies and profiles individuals, it falls within the GDPR and the ePrivacy Directive. Under ePrivacy the tracking cookies may only be set after consent, and under the GDPR the behavioural profiling needs a valid legal basis, transparency, and respect for data subject rights. Given the real time profiling and the transfers to the US, the risk profile is high and the accountability duties are significant.
Consent must be collected through a consent management platform before the Fanplayr tag runs, and the tracking and personalization should be blocked until the visitor accepts marketing cookies. Data is transferred to the United States, so operators should rely on standard contractual clauses or another valid transfer mechanism and reflect this in their privacy notice. The profiling and the US transfer should be disclosed clearly so visitors can make an informed choice.
To deploy Fanplayr compliantly, block the tag by default and load it only after marketing consent, then stop it and clear its cookies when consent is withdrawn. Complete a DPIA given the profiling and transfers, document the legal basis, and put data processing and transfer terms in place. List Fanplayr and its domains in your cookie policy, apply data minimization and retention limits, and honour data subject rights including objection to profiling.
Websites using Fanplayr must obtain user consent under GDPR regulations.
DPIA considerations
Because Fanplayr carries out real time behavioural profiling and personalization combined with transfers to the US, a DPIA is advisable. Assess the scale and intrusiveness of the profiling, the categories of behavioural data, and the third country transfer risk, and document mitigations such as consent gating, data minimization, and standard contractual clauses.
Sample consent text
We use Fanplayr to personalize offers and content based on your behaviour on our site. This sets tracking cookies, builds a behavioural profile, and transfers data to the United States. With your consent, Fanplayr personalization will be activated.
Third-party domains contacted
fanplayr.comfanplayr.comcdn.fanplayr.comcdn.fanplayr.comtag.fanplayr.comtag.fanplayr.comapi.fanplayr.comevents.fanplayr.comstatic.fanplayr.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| fp_uid | persistent | 1 year | Identifies a returning visitor so the behavioural profile and segments persist across sessions. |
| fp_uid | Targeting | 1 year | Stores a Fanplayr visitor identifier used to recognize returning users and link behavioral sessions |
| fp_segment | persistent | 6 months | Stores the live segment the visitor belongs to for targeted offers and nudges. |
| fp_session | Functional | Session | Maintains the current session state for behavioral tracking and message delivery |
| fp_segment | Targeting | 90 days | Records the behavioral segments assigned to the visitor to decide which offers to show |
| fp_session | session | Session | Tracks the current session behaviour to drive real time personalization. |
| fp_experiment | persistent | 90 days | Records which offer or experiment variant the visitor has seen for measurement. |
| fp_seen | Functional | 30 days | Tracks which campaigns or messages have already been displayed to avoid repetition |
| fp_consent | Functional | 1 year | Remembers the consent choice for personalization so the tag respects the visitor preference |
| fp_ab | Analytics | 90 days | Assigns the visitor to an experiment variant for measuring personalization performance |
Fanplayr uses cookies for user preferences — inform visitors with a consent banner.
Fanplayr typically sets tracking cookies that identify a returning visitor, store the segment they belong to, and support real time personalization. They are non essential marketing cookies and can persist for months. Confirm the exact cookies in your own deployment, since they can vary by configuration.
Yes, consent is required before Fanplayr loads because it sets non essential tracking cookies and profiles visitors. The tag should be blocked until the visitor accepts marketing cookies. Running it without consent would breach the ePrivacy cookie rules.
The legal basis is consent under Article 6(1)(a) GDPR for the tracking cookies and the behavioural profiling. Given the intrusive nature of real time profiling, legitimate interest is generally not appropriate. Record the consent based basis in your records of processing.
Yes, Fanplayr is US based and transfers personal data to the United States, where the profiling and personalization logic run. You should put standard contractual clauses or another valid transfer mechanism in place. Disclose the US transfer clearly in your privacy notice.
A DPIA is advisable because Fanplayr involves systematic real time behavioural profiling combined with transfers to the US. Assess the scale and intrusiveness of the profiling, the behavioural data categories, and the transfer risk. Document mitigations such as consent gating and data minimization.
Block the Fanplayr tag by default and load it only after marketing consent, then stop it and clear cookies on withdrawal. Complete a DPIA, document the legal basis and transfer safeguards, and honour data subject rights including objection to profiling. List Fanplayr and its domains in your cookie policy.
Other personalization and on site targeting tools exist, including EU hosted options that can reduce transfer risk. Most behavioural personalization still relies on tracking cookies and profiling, so the consent duties are comparable. Evaluate alternatives on data location, profiling depth, and contractual terms.
Add Fanplayr as a named third party, describe its tracking cookies and the behavioural profiling, and state that data is transferred to the US. Reference its domains such as fanplayr.com and tag.fanplayr.com and link to its policy. Review the entry whenever the cookies or processing change.