Dotdigital

What Dotdigital does and how it appears on a website

Dotdigital is a customer engagement platform headquartered in London, formerly known as dotmailer. Its core product is Engagement Cloud, a marketing automation suite covering email, SMS, push, mobile wallet, WhatsApp and chatbots, with a strong integration into the major e-commerce platforms (Shopify, Magento, BigCommerce, Microsoft Dynamics 365, Salesforce). The WebBehavior Tracker, also called Web Insight, is a small JavaScript snippet that captures page views, clicks, product interactions and form submissions, then ties them to a Dotdigital contact record.

Cookies and data collected by Dotdigital

The WebBehavior Tracker sets a first party cookie on the merchant domain such as _ddg5 (visitor identifier, 1 year), _ddg6 (session identifier), _ddg7 (campaign attribution) and _ddg8 (UTM bucket). When the contact opens an email tracked by Dotdigital, a small image pixel records the open. Click tracking is performed through a Dotdigital link redirector (links.example.dotdigital-pages.com or trackedlink.net). On the platform side, Dotdigital stores name, email, phone, postal address, custom attributes, segment membership and the recent activity timeline.

GDPR and ePrivacy implications

The WebBehavior Tracker is an analytics and personalisation tool, so Article 5(3) ePrivacy requires prior consent for the first party tracking cookies and Article 6 GDPR requires consent or another suitable basis for the profiling. For email marketing, PECR (UK) and Article 13 of the ePrivacy Directive allow a soft opt-in to existing customers under tight conditions, but explicit consent remains best practice across the EU. Dotdigital itself acts as processor.

International data transfers

Dotdigital is a UK company and processes data in UK or EU data centres depending on the customer pod. UK to EU transfers benefit from the European Commission adequacy decision of 28 June 2021. EU to UK transfers rely on the same adequacy decision and on Standard Contractual Clauses. Sub-processors include AWS, used in EU regions for the EU pod and in the UK for the UK pod.

Consent and legal basis

Consent (Article 6(1)(a) GDPR) is required for marketing email, SMS, push and the WebBehavior Tracker profile. Contractual necessity (Article 6(1)(b)) covers transactional emails such as order confirmation, shipping notification and password reset. Legitimate interest is acceptable for B2B prospecting in some EU countries when supported by a balancing test.

Practical compliance steps

Sign the Dotdigital DPA, choose the EU or UK pod that matches your audience, integrate the WebBehavior Tracker with your Consent Management Platform so the script only fires after the marketing consent group is granted, hash custom identifiers, configure double opt-in for sign up forms, document the segments built in Engagement Cloud, set automatic suppression for unsubscribed contacts and list Dotdigital as a processor in the privacy notice.