Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Dotdigital is a UK headquartered customer engagement platform focused on email, SMS, push, mobile wallet, conversational commerce and behavioural marketing automation. It is widely used by Shopify Plus, Magento, BigCommerce, Microsoft Dynamics and Salesforce Commerce merchants in Europe. The Dotdigital WebBehavior Tracker (Web Insight) script sets a first party identifier on the merchant domain, links the visitor to the contact record in Engagement Cloud and powers programs such as abandoned cart, browse abandonment and post purchase journeys.
Dotdigital is a customer engagement platform headquartered in London, formerly known as dotmailer. Its core product is Engagement Cloud, a marketing automation suite covering email, SMS, push, mobile wallet, WhatsApp and chatbots, with a strong integration into the major e-commerce platforms (Shopify, Magento, BigCommerce, Microsoft Dynamics 365, Salesforce). The WebBehavior Tracker, also called Web Insight, is a small JavaScript snippet that captures page views, clicks, product interactions and form submissions, then ties them to a Dotdigital contact record.
The WebBehavior Tracker sets a first party cookie on the merchant domain such as _ddg5 (visitor identifier, 1 year), _ddg6 (session identifier), _ddg7 (campaign attribution) and _ddg8 (UTM bucket). When the contact opens an email tracked by Dotdigital, a small image pixel records the open. Click tracking is performed through a Dotdigital link redirector (links.example.dotdigital-pages.com or trackedlink.net). On the platform side, Dotdigital stores name, email, phone, postal address, custom attributes, segment membership and the recent activity timeline.
The WebBehavior Tracker is an analytics and personalisation tool, so Article 5(3) ePrivacy requires prior consent for the first party tracking cookies and Article 6 GDPR requires consent or another suitable basis for the profiling. For email marketing, PECR (UK) and Article 13 of the ePrivacy Directive allow a soft opt-in to existing customers under tight conditions, but explicit consent remains best practice across the EU. Dotdigital itself acts as processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Dotdigital is a UK company and processes data in UK or EU data centres depending on the customer pod. UK to EU transfers benefit from the European Commission adequacy decision of 28 June 2021. EU to UK transfers rely on the same adequacy decision and on Standard Contractual Clauses. Sub-processors include AWS, used in EU regions for the EU pod and in the UK for the UK pod.
Consent (Article 6(1)(a) GDPR) is required for marketing email, SMS, push and the WebBehavior Tracker profile. Contractual necessity (Article 6(1)(b)) covers transactional emails such as order confirmation, shipping notification and password reset. Legitimate interest is acceptable for B2B prospecting in some EU countries when supported by a balancing test.
Sign the Dotdigital DPA, choose the EU or UK pod that matches your audience, integrate the WebBehavior Tracker with your Consent Management Platform so the script only fires after the marketing consent group is granted, hash custom identifiers, configure double opt-in for sign up forms, document the segments built in Engagement Cloud, set automatic suppression for unsubscribed contacts and list Dotdigital as a processor in the privacy notice.
Websites using Dotdigital must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Dotdigital handles large scale customer contact data, when the WebBehavior Tracker is deployed across high traffic e-commerce sites, or when programs combine email engagement, browsing behaviour and predicted segments. The DPIA should cover the chosen region (UK, EU), the Engagement Cloud retention, sub-processors (AWS), the joint controllership with the merchant and the response to data subject requests.
Sample consent text
Our website uses the Dotdigital WebBehavior Tracker to remember what you browsed, link your visit to your customer record if you are signed in to our newsletter, and trigger personalised emails such as abandoned cart reminders. The Tracker sets a first party identifier on this site and sends event data to Dotdigital servers in the European Union. By clicking Accept, you allow this marketing personalisation. You can also Reject and only strictly necessary site functions will run.
Third-party domains contacted
dotdigital.comdotmailer.comdotdigital-pages.comtrackedlink.netr1-t.trackedlink.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ddg5 | HTTP cookie | 1 year | Dotdigital WebBehavior Tracker first party visitor identifier used to build the contact profile. |
| _ddg6 | HTTP cookie | Session | Dotdigital session identifier used to scope events to the current visit. |
| _ddg7 | HTTP cookie | 30 days | Stores marketing campaign attribution for cross channel reporting. |
| _ddg8 | HTTP cookie | 30 days | UTM bucket tracker for the WebBehavior Tracker. |
Dotdigital places tracking cookies for advertising — comply with GDPR using FlowConsent.
The Dotdigital WebBehavior Tracker sets first party cookies on the merchant domain: _ddg5 (visitor identifier, 1 year), _ddg6 (session), _ddg7 (campaign attribution, 30 days) and _ddg8 (UTM bucket). Email opens are tracked through a pixel and clicks through the trackedlink.net redirector.
Yes for marketing email, SMS, push and the WebBehavior Tracker. Transactional emails (order confirmation, password reset) rely on contractual necessity. Marketing communications must be triggered by an opt-in collected through a CMP or sign up form.
Article 6(1)(a) GDPR (consent) for marketing. Article 6(1)(b) for transactional emails. Soft opt-in under PECR (UK) and similar national rules can apply to existing customers under tight conditions.
By default no. EU customers can pin the workspace to the Amsterdam region, UK customers to London. Sub-processors stay in the same region. Both regions have adequacy with the EU.
Recommended when Dotdigital handles large contact databases, when the WebBehavior Tracker runs on high traffic e-commerce sites or when behavioural automation combines email engagement with browsing data. Document region, retention and sub-processors.
Sign the Dotdigital DPA, pick the EU or UK pod, integrate the WebBehavior Tracker with the CMP, enable double opt-in, configure suppression on unsubscribe, and document the segments and automation programs in your records of processing.
Other email and engagement platforms include Klaviyo, Salesforce Marketing Cloud, Adobe Campaign, Mailchimp, Brevo (Sendinblue), Splio and ActiveCampaign. EU based alternatives include Brevo (France) and CleverReach (Germany).
List Dotdigital Group plc as a processor, describe the _ddg cookies and the email tracking pixel, mention the chosen pod (EU or UK), reference the EU-UK adequacy decision and link to the Dotdigital privacy policy and DPA.