> Mautic marketing automation: how the mtc tracking pixel works, the cookies it sets, why GDPR and ePrivacy require prior consent and how to deploy it in Europe. > > Canonical: https://www.flowconsent.com/en/services/marketing/mautic Marketing # Mautic Marketing · [Official website](https://www.mautic.org/) Mautic is the leading open source marketing automation platform, used to track website visits, score leads, run email campaigns and trigger nurture flows. Its tracking pixel (mtc.js) writes the mtc\_id and mtc\_sid cookies and links anonymous browsing to identifiable contacts when forms are submitted, which makes it a marketing tracker requiring prior consent under the GDPR and ePrivacy Directive. [Block Mautic until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers Self hosted by the controller (often EU). Cloud editions (Acquia Campaign Studio, Mautic Cloud) may use US or EU regions depending on the chosen plan. Overview ## What does Mautic do? ## **What is Mautic?** Mautic is an open source marketing automation platform originally launched in 2014 and now stewarded by the Mautic Community and Acquia. It covers contact databases, email campaigns, landing pages, dynamic content, lead scoring and behavioural segmentation. Many European mid market and B2B companies self host Mautic on their own EU servers, while others use the Acquia Campaign Studio or Mautic Cloud SaaS editions. ## **Cookies and identifiers** The Mautic tracking script writes mtc\_id (a stable visitor identifier) and mtc\_sid (a session identifier) on the publisher domain. When a known contact opens an email or submits a form, Mautic links the cookie identifier with the contact record, turning the previously anonymous browsing history into identifiable behavioural data. ## **GDPR and ePrivacy implications** The mtc cookies are not strictly necessary, so Article 5(3) ePrivacy requires prior consent before they are written. The downstream profiling and lead scoring fall under the GDPR and need a clear legal basis. For prospects, consent is generally the only safe option; for existing customers, legitimate interests may apply for soft opt in email scenarios under national ePrivacy implementations. ## **Consent management** Block mautic.js / mtc.js in your tag manager until the visitor accepts the marketing category. Mautic ships a Do Not Track plugin that can disable cookie writing for users who refuse consent. The contact preference centre should also be wired to the consent state, so withdrawing consent disables tracking and email campaigns end to end. ## **Hosting and data transfers** Self hosting Mautic in the EU on your own infrastructure removes any third country transfer concern. If you choose Acquia Campaign Studio or another US hosted SaaS edition, the controller must rely on the EU U.S. Data Privacy Framework or Standard Contractual Clauses and disclose the transfer in the privacy policy. ## **Implementing Mautic compliantly** Gate the tracking script behind your CMP, document the legal basis for each segment in the records of processing, set retention periods on contacts and cookie lifetimes, and offer a clear unsubscribe link in every email. For transactional emails, separate the legal basis (contract performance) from marketing consent in the Mautic configuration. Compliance ## Mautic and the GDPR Mautic is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive: the Mautic tracking pixel writes the mtc\_id and mtc\_sid cookies and builds a marketing profile of identifiable contacts. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU U.S. Data Privacy Framework (cloud editions only) ### Impact assessment (DPIA) A DPIA is recommended when Mautic is used for behavioural lead scoring on a large database, when sensitive segments are built or when a US hosted cloud edition is chosen. Self hosted EU instances with limited tracking lower the risk significantly. ### Sample text for your banner > We use Mautic to track your visit, send marketing emails and personalise our communications. With your consent, we will store the mtc\_id and mtc\_sid cookies on your device and link your browsing to your contact record. You can refuse or withdraw your consent at any time from the cookie settings. Cookies and trackers ## What Mautic sets and contacts - Tracking method JavaScript tracking pixel (mtc.js / mautic.js) and tracking image that send page views and form submissions to a self hosted Mautic instance, plus IP and user agent processing in the Mautic backend for contact resolution and lead scoring. - Server location Self hosted by the controller (often EU). Cloud editions (Acquia Campaign Studio, Mautic Cloud) may use US or EU regions depending on the chosen plan. ### Cookies set (2) | Name | Type | Duration | Purpose | | -------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | mtc\_id | first\_party | 1 year | Stable visitor identifier set by the Mautic tracking script to recognise the visitor across sessions and link browsing to a contact record. | | mtc\_sid | first\_party | session | Session identifier set by Mautic to attribute page views to the current visit. | ### Third-party domains contacted (3) - `mautic.org` - `self-hosted Mautic instance (controller domain)` - `mautic.acquiacloud.com` Questions ## Frequently asked questions about Mautic Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Mautic set? The Mautic tracking script writes mtc\_id (a stable visitor identifier) and mtc\_sid (a session identifier) on the publisher domain. When a contact is known, additional cookies may be set to link sessions across devices. ### Does Mautic require consent? Yes. The mtc cookies are not strictly necessary, so prior consent is required under Article 5(3) of the ePrivacy Directive. The profiling and lead scoring also require a clear legal basis under the GDPR. ### What is the legal basis for Mautic? For prospects, consent is the only safe basis. For existing customers, legitimate interests can support soft opt in email under national ePrivacy implementations, but website tracking still needs consent. ### Are data transferred to the United States? Not when Mautic is self hosted in the EU. If you use Acquia Campaign Studio or another US hosted SaaS edition, transfers occur and must rely on the EU U.S. Data Privacy Framework or Standard Contractual Clauses. ### Do I need a DPIA for Mautic? A DPIA is recommended when Mautic is used for behavioural lead scoring on a large database, when sensitive segments are built or when the SaaS edition is hosted outside the EU. ### How do I deploy Mautic compliantly? Block mtc.js until consent, enable the Do Not Track plugin, set retention periods on contacts and cookies, document each segment's legal basis and provide a clear unsubscribe in every email. ### Are there alternatives to Mautic? Privacy friendly alternatives include EU hosted SaaS marketing automation (Plezi, Sendinblue, ActiveCampaign EU) or first party CDPs combined with a transactional ESP. ### How do I update my cookie policy for Mautic? Add a section that names Mautic, lists the cookies (mtc\_id, mtc\_sid) with purpose and duration, mentions the hosting location and clarifies the transfers if the SaaS edition is used. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [CTAwidget](https://www.flowconsent.com/en/services/marketing/ctawidget) [CTAwidget is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CTAwidget supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CTAwidget ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/ctawidget) [Marketing](https://www.flowconsent.com/en/services/marketing/ctawidget) · ### [Myli](https://www.flowconsent.com/en/services/marketing/myli) [Myli is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Myli supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Myli ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/myli) [Preferences](https://www.flowconsent.com/en/services/marketing/myli) · ### [Power CRM](https://www.flowconsent.com/en/services/marketing/power-crm) [Power CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Power CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Power CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/power-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/power-crm) · ### [TrustYou](https://www.flowconsent.com/en/services/marketing/trustyou) [TrustYou is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. TrustYou integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, TrustYou helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/trustyou) [Marketing](https://www.flowconsent.com/en/services/marketing/trustyou) · ### [Clientacquisition](https://www.flowconsent.com/en/services/marketing/clientacquisition) [Clientacquisition is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Clientacquisition supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Clientacquisition ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/clientacquisition) [Marketing](https://www.flowconsent.com/en/services/marketing/clientacquisition) · ### [MessageMedia](https://www.flowconsent.com/en/services/marketing/messagemedia) [MessageMedia is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MessageMedia supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MessageMedia ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/messagemedia) [Marketing](https://www.flowconsent.com/en/services/marketing/messagemedia) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)