FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Autopilot (now Ortto)

Marketing

Autopilot was the original name of the visual marketing automation platform now branded Ortto. Headquartered in Sydney, Australia, Ortto combines a customer data platform, email, SMS, push, in app messaging, journey orchestration and analytics. The Autopilot / Ortto Capture script (CDN at ortto.app) sets a first party identifier on the operator domain, links the visitor to a Ortto contact record and tracks page views, form submissions and custom events. European customers can choose the Frankfurt region to keep personal data in the EU.

Block Autopilot (now Ortto) until consentScan my site
Overview

What does Autopilot (now Ortto) do?

What Autopilot does and how it appears on a website

Autopilot HQ Inc., founded in Sydney in 2012, rebranded to Ortto Pty Ltd in 2022. The platform pioneered the visual canvas for marketing automation, with drag and drop journeys, audience segments and a single customer database. The modern Ortto stack adds a customer data platform, email, SMS, push, in app messaging, live chat, web feedback widgets and analytics dashboards. Many merchants still call the product Autopilot in their legal documents because of the long history of integrations under that name.

Cookies and data collected by Autopilot / Ortto

Ortto Capture sets a first party cookie on the operator domain. The historical Autopilot snippet used ajs_user_id and ajs_anonymous_id (12 months) as visitor identifiers. The modern Ortto Capture uses _aaid (anonymous ID) and _arid (resolved contact ID). Email tracking is performed through an open pixel and a click redirector under the ortto.email or autopilothq.com domain. The platform stores name, email, phone, postal address, custom attributes, segment membership, events, and the behavioural timeline.

GDPR and ePrivacy implications

Ortto Capture is a profiling tool, so Article 5(3) ePrivacy requires prior consent for the cookies and Article 6 GDPR requires consent for the behavioural personalisation. Marketing email follows national ePrivacy implementations and PECR style soft opt-in where applicable. Ortto Pty Ltd acts as processor for the customer data uploaded to the platform and as controller for its own product analytics.

International data transfers

Ortto is headquartered in Sydney, Australia, a country that does not benefit from a full GDPR adequacy decision. EU customers can choose the Frankfurt AWS region to keep customer data inside the European Union. Sub-processor access from Australia for product engineering and support is covered by the European Commission Standard Contractual Clauses included in the Ortto DPA. A transfer impact assessment is recommended.

Consent and legal basis

Consent (Article 6(1)(a) GDPR) is required for marketing email, SMS, push, in app messaging and the Ortto Capture profile. Contractual necessity (Article 6(1)(b)) covers transactional emails (order confirmation, password reset). Legitimate interest can support narrow operational uses such as fraud detection and platform security.

Practical compliance steps

Sign the Ortto Data Processing Addendum, pin the workspace to the Frankfurt region, integrate Ortto Capture with the Consent Management Platform, enable double opt-in for sign up forms, document the journeys and predictive scores in your records of processing, configure data retention, ensure unsubscribe links are visible in every marketing message, and update the privacy notice with the legacy Autopilot name and the current Ortto identity.

Compliance

Autopilot (now Ortto) and the GDPR

Autopilot (now Ortto) is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Contractual necessity under Article 6(1)(b) GDPR for transactional emails. Consent under Article 6(1)(a) for marketing email, SMS, push, in app messaging and the Autopilot / Ortto Capture tracking script that builds behavioural profiles. Legitimate interest under Article 6(1)(f) only for narrow operational uses.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, German TTDSG / TDDDG, French CNIL guidelines on email marketing, Australian Privacy Act 1988, Standard Contractual Clauses for EU to Australia transfers

Impact assessment (DPIA)

A DPIA is recommended when Autopilot / Ortto handles large customer databases, when Ortto Capture runs on many pages, or when journeys combine email engagement, SMS, push and behavioural data. The DPIA should cover the region choice, the Australia controller relationship, sub-processors (AWS), retention, the Standard Contractual Clauses signed with Ortto and the response to data subject requests.

Sample text for your banner

Our website uses Autopilot (now Ortto) to send marketing emails and trigger personalised journeys. Ortto Capture sets a first party cookie on this domain and sends event data to Ortto servers in the European Union (Frankfurt region). Ortto Pty Ltd is based in Australia, so some support access may originate from outside the EU under Standard Contractual Clauses. By clicking Accept, you allow this personalisation.
Cookies and trackers

What Autopilot (now Ortto) sets and contacts

Tracking method
Visual marketing automation platform (rebranded to Ortto in 2022). Combines email, SMS, push, in app messaging and a Customer Data Platform. The Autopilot / Ortto Capture script sets a first party identifier on the operator domain and streams events to the Ortto backend.
Server location
Operated by Ortto Pty Ltd (Sydney, Australia, formerly Autopilot HQ Inc.). Data centres in the United States, Australia and the European Union (Frankfurt, AWS eu-central-1). EU customers can pin their workspace to the Frankfurt region.
Data transferred outside the EU
Operated by Ortto Pty Ltd (Sydney, Australia). Australia has not received a full GDPR adequacy decision; transfers from the EU rely on the Ortto Data Processing Addendum incorporating the European Commission Standard Contractual Clauses, plus the optional EU data residency (Frankfurt AWS eu-central-1). The product was branded Autopilot until 2022.

Cookies set (4)

NameTypeDurationPurpose
ajs_user_idHTTP cookie1 yearLegacy Autopilot user identifier still set when the historical snippet is in use.
ajs_anonymous_idHTTP cookie1 yearLegacy Autopilot anonymous visitor identifier.
_aaidHTTP cookie1 yearModern Ortto Capture anonymous identifier used to build the contact profile.
_aridHTTP cookie1 yearModern Ortto Capture resolved contact identifier set after a known contact is matched.

Third-party domains contacted (5)

  • ortto.app
  • ortto.email
  • autopilothq.com
  • ap-onboarding.com
  • capture-eu.ortto.app
Questions

Frequently asked questions about Autopilot (now Ortto)

Can't find your question? Write to us, we answer fast.

What cookies does Autopilot / Ortto set?

The historical Autopilot snippet sets ajs_user_id and ajs_anonymous_id (1 year). Modern Ortto Capture sets _aaid (anonymous ID, 1 year) and _arid (resolved contact ID, 1 year). Email tracking is done through pixels and the ortto.email or autopilothq.com click redirectors.

Do I need consent for Autopilot?

Yes for marketing email, SMS, push, in app messaging and the Ortto Capture profile. Transactional emails rely on contractual necessity. Marketing requires opt-in collected through a CMP or sign up form.

What is the legal basis?

Consent (Article 6(1)(a) GDPR) for marketing and Capture profiling. Contractual necessity (Article 6(1)(b)) for transactional emails. Legitimate interest (Article 6(1)(f)) only for narrow operational uses.

Does Autopilot transfer data to the US or Australia?

Ortto is headquartered in Sydney, Australia. EU customers can pin the workspace to the Frankfurt AWS region, keeping customer data inside the EU. Engineering and support access from Australia is covered by Standard Contractual Clauses included in the Ortto DPA.

Do I need a DPIA?

Recommended when Autopilot / Ortto manages large customer databases, when Ortto Capture is deployed on many pages or when journeys cross channels. Document region, retention, sub-processors and Australia transfer mechanism.

How do I implement Autopilot compliantly?

Sign the Ortto DPA, pin to Frankfurt, integrate Capture with the CMP, enable double opt-in, document journeys and predictive scores, configure retention, keep unsubscribe links visible and update the privacy notice with both Autopilot and Ortto names.

Are there alternatives to Autopilot / Ortto?

Other marketing automation platforms include ActiveCampaign, HubSpot, Klaviyo, Customer.io, Brevo (Sendinblue), Mailchimp and Dotdigital. EU alternatives include Brevo (France) and CleverReach (Germany).

How do I update my cookie policy for Autopilot?

List Ortto Pty Ltd (former Autopilot HQ Inc.) as processor, describe the ajs and _aaid / _arid cookies, mention the Frankfurt region and the Standard Contractual Clauses for any Australia access, and link to the Ortto DPA and privacy policy.

Same category

More services: Marketing

See the whole category

Brevo

Brevo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Brevo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Brevo helps organizations maintain robust websites that meet user expectations and technical requirements.

Marketing

Satori

Satori is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Satori enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Satori empowers marketing teams to achieve measurable growth.

Marketing

CINC

CINC is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CINC enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CINC empowers marketing teams to achieve measurable growth.

Marketing

Knak

Knak is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Knak enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Knak empowers marketing teams to achieve measurable growth.

Analytics

Reviefy

Reviefy is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Reviefy supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Reviefy ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Veloce

Veloce is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Veloce enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Veloce empowers marketing teams to achieve measurable growth.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site