WebEngage

What WebEngage Is

WebEngage is a marketing automation and customer engagement platform used by online businesses to track visitors and run personalised campaigns across web, mobile apps, email, SMS, WhatsApp and push. It collects behavioural signals through a first party Web SDK and unifies them into a single customer profile. These profiles drive segmentation, automated journeys and triggered messaging. Marketing and retention teams use it to increase conversion, engagement and loyalty. Because it observes and predicts individual behaviour at scale, it processes large volumes of personal data. This places it firmly within the scope of European data protection and ePrivacy rules.

Cookies and Data Collected

The Web SDK assigns each visitor an anonymous unique identifier and sets first party cookies, supported by localStorage, to recognise returning visitors. This identifier links page views, clicks, searches, events and conversions into a persistent behavioural profile. The platform also ingests attributes you send, such as email, phone number, purchase history and custom events. For web push it registers a service worker and stores a subscriber identifier and permission state. Identifiers commonly persist for up to a year, while session values are shorter lived. Together these data points allow WebEngage to track returning visitors and personalise messaging across channels.

GDPR and ePrivacy Implications

Under the ePrivacy Directive, storing or reading cookies and similar identifiers that are not strictly necessary requires prior consent. The behavioural profiles WebEngage builds are personal data under the GDPR, and combining them across channels amounts to profiling. Where automated journeys produce significant effects, Article 22 on automated decision making may also apply. Controllers must therefore have a valid legal basis, provide transparent information and honour data subject rights. Supervisory authorities such as the CNIL have made clear that tracking for marketing cannot rely on legitimate interest alone. The Web SDK should never initialise before consent is captured.

Consent Requirements and CMP Integration

Valid consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give. In practice the Web SDK should be gated behind a consent management platform so that it loads only after the visitor accepts marketing or personalisation cookies. Web push requires its own clear opt in that is separate from the browser permission prompt. You should record proof of consent and ensure the platform stops tracking when consent is withdrawn. WebEngage provides controls to manage user consent and to handle access and deletion requests. Regularly test that no identifiers are written before acceptance.

International Data Transfers

WebEngage offers data centres in the United States, India and Saudi Arabia, with the United States as the default and no European Union location. For European customers this means personal data is typically stored and processed in the United States, a third country. Transfers to third countries require an appropriate safeguard under Chapter V of the GDPR, typically Standard Contractual Clauses and, where the importer is certified, the EU US Data Privacy Framework. Controllers should carry out a transfer impact assessment and apply supplementary measures such as encryption and strict access controls. Document the data centre in use and disclose it in your privacy notice. Review the data processing agreement and its list of sub processors carefully.

Practical Compliance Steps

Start by mapping every data point WebEngage collects and documenting the purpose and retention for each. Gate the Web SDK behind your consent management platform and verify with browser tools that nothing loads before consent. Conduct a data protection impact assessment given the scale of profiling involved. Sign the data processing agreement, review sub processors and confirm transfer safeguards for the United States. Update your privacy and cookie policies to name WebEngage, list its cookies and explain the personalisation and push features. Finally, establish a process to handle access, deletion and objection requests and to refresh consent when purposes change.