Constant Contact
Constant Contact is an email marketing platform for small businesses, with newsletters, automation, sign-up forms, event management and social ads. On a website, its sign-up forms and tracking code load scripts from Constant Contact, which may set cookies to show forms, attribute sign-ups and track visits for marketing, so consent is generally required.
What does Constant Contact do?
Constant Contact, founded in 1995, is one of the oldest commercial email marketing platforms in the United States, now owned by Clearlake Capital. It targets small and medium businesses with an easy onboarding, hundreds of templates and a marketplace of integrations. Its data processing happens entirely in the United States.
What Constant Contact does
Constant Contact provides email campaign creation, marketing automation (welcome series, abandoned cart, birthday campaigns), signup forms, popups, landing pages, social media posting, event registration and SMS marketing. The Lead Gen and CRM tier adds a basic CRM, lead scoring and an embedded Site Visits tracker for cross channel attribution.
Data and cookies set
Each email contains a 1x1 open tracking pixel from imgssl.constantcontact.com and click redirects through r20.rs6.net. The Constant Contact signup form sets cookies (CCsessionContact, ctct_*) on the embedding website. The optional Site Visits tracker sets persistent cookies for visitor identification and behavioural attribution. The platform collects subscriber email, name, IP, user agent, opens, clicks, device and approximate geolocation.
GDPR and ePrivacy implications
Email marketing requires consent under Art. 6(1)(a) GDPR and Art. 13 ePrivacy Directive for prospects, and may rely on the soft opt in (legitimate interest) for existing customers in similar product contexts. The tracking pixel and click redirects amount to behavioural tracking and require consent in most EU jurisdictions. The signup form and Site Visits tracker require ePrivacy consent because they set non essential cookies.
Data transfers to the United States
All subscriber and tracking data is stored in the US. Constant Contact is self certified under the EU US Data Privacy Framework. If the DPF is challenged again, transfers must rely on Standard Contractual Clauses combined with supplementary technical and contractual measures and a documented Transfer Impact Assessment. There is no EU data residency option today.
Practical compliance steps
Use a clear opt in checkbox at sign up with a granular description of purposes (newsletter, offers, profiling). Record the proof of consent (timestamp, IP, form version). Block the signup form and Site Visits tracker behind a CMP category. Disable open and click tracking for users who only consent to functional emails. Sign the Constant Contact DPA and document the US transfer mechanism in your records of processing.
Constant Contact and the GDPR
Constant Contact is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) for newsletter subscription, click and open tracking, and for the third party cookies set by the embedded signup form or Site Visits tracker. Legitimate interest may apply to transactional emails sent to existing customers.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, CAN SPAM Act (US), CASL (Canada), CCPA/CPRA, EU US Data Privacy Framework, French Data Protection Act
What Constant Contact sets and contacts
- Tracking method
- Email marketing platform. Open tracking via 1x1 tracking pixel embedded in HTML emails, click tracking via redirect URLs through r20.rs6.net, signup forms and popups embedded via JavaScript snippet on customer websites. Optional Constant Contact Site Visits tracker for cross channel attribution.
- Server location
- Constant Contact, Inc., headquartered in Waltham, Massachusetts, United States. Email and subscriber data are stored on AWS infrastructure in the United States (us east). No European data residency option is currently available.
- Data transferred outside the EU
- All subscriber data, email opens, clicks and IP addresses are stored on Constant Contact servers in the United States. Transfers from the EU rely on the EU US Data Privacy Framework (Constant Contact is self certified) or on Standard Contractual Clauses with supplementary measures.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| CCsessionContact | first_party | Session | Identifies the current visitor on the embedded Constant Contact signup form. |
| ctct_* | first_party | 1 year | Stores signup form state and language preferences for the visitor. |
| cct_visitor | first_party | 1 year | Site Visits tracker visitor identifier used for cross channel attribution between emails and website. |
| r20rs6 | third_party | 6 months | Tracking cookie associated with the r20.rs6.net click redirect used in Constant Contact emails. |
Third-party domains contacted (5)
constantcontact.comr20.rs6.netimgssl.constantcontact.comvisitor.constantcontact.comstatic.ctctcdn.com
Frequently asked questions about Constant Contact
Can't find your question? Write to us, we answer fast.
Which cookies does Constant Contact set?
On the signup form, Constant Contact sets first party cookies including CCsessionContact (session), ctct_* (signup state) and a few internal flags. The optional Site Visits tracker sets cct_visitor (one year) and additional behavioural cookies. All require prior consent in the EEA.
Is consent required to use Constant Contact?
Yes for the signup form, Site Visits tracker and the email tracking pixel and click redirects. Consent is also required at subscription time for the marketing emails themselves (Art. 13 ePrivacy and Art. 6(1)(a) GDPR for prospects).
What is the legal basis for processing?
Consent (Art. 6(1)(a) GDPR) for prospects. Legitimate interest (Art. 6(1)(f)) or soft opt in for existing customers in similar product contexts. Open and click tracking generally require consent due to its behavioural nature.
Is data transferred to the United States?
Yes, all data is stored in the US. Constant Contact is self certified under the EU US Data Privacy Framework. Without the DPF, transfers rely on Standard Contractual Clauses with supplementary measures and a Transfer Impact Assessment.
Do I need a DPIA for Constant Contact?
A DPIA is recommended for large scale mailing lists, behavioural scoring or profiling. Document the lawful basis for the list, the proof of consent, the open/click tracking, the US transfer and the unsubscribe flow.
How do I implement Constant Contact correctly?
Implement a clear opt in checkbox at sign up with granular purposes. Record consent (timestamp, IP, version). Block the signup form and Site Visits behind a CMP category. Disable open and click tracking on transactional emails. Sign the DPA. Document Constant Contact as a US sub processor.
Which alternatives to Constant Contact should I consider?
EU based: Brevo (France), Mailjet (France), GetResponse (Poland), Klick Tipp (Germany), Cleverreach (Germany), ActiveTrail (Israel). Self hosted: Mailtrain, Listmonk, Sendy (US license, EU hosting possible).
How do I update the cookie policy when Constant Contact changes?
Subscribe to the Constant Contact trust centre and DPA updates. When sub processors, certifications or tracking pixels change, update your cookie table, privacy notice and records of processing, and bump the consent banner version.
%22%3E%0A%3Cpath%20d%3D%22M0%2012.3114L11.676%2017.6038L14.0222%2015.2714L8.04774%2012.557L26.5712%205.46403L19.451%2023.9056L16.7502%2017.9858L14.3905%2020.3319L14.5132%2020.6047L19.6829%2031.9397L32%200.0625L0%2012.3114Z%22%20fill%3D%22%239585F4%22%2F%3E%0A%3C%2Fg%3E%0A%3Cdefs%3E%0A%3CclipPath%20id%3D%22clip0_3468_698%22%3E%0A%3Crect%20width%3D%2232%22%20height%3D%2231.875%22%20fill%3D%22white%22%20transform%3D%22translate(0%200.0625)%22%2F%3E%0A%3C%2FclipPath%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Mailjet
Mailjet is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Mailjet provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Mailjet helps deliver the right message to the right audience at the right time.
Sierra Interactive
Sierra Interactive is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Sierra Interactive enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Sierra Interactive empowers marketing teams to achieve measurable growth.
ThimPress Course Review
ThimPress Course Review is a customer review and reputation management platform that helps businesses collect, manage, and showcase authentic customer feedback. It automates review request workflows, aggregates ratings from multiple sources, and displays social proof. ThimPress Course Review supports rich snippet integration for enhanced search engine visibility, helping build trust, improve local SEO, and increase conversion rates through verified customer testimonials.
Proof Factor
Proof Factor is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Proof Factor provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Proof Factor helps deliver the right message to the right audience at the right time.
Bing Webmaster
Bing Webmaster is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Bing Webmaster is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Bing Webmaster offers reliable solutions that scale with organizational needs and evolving web standards.
Revinate
Revinate is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Revinate enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Revinate empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.