> Datadog and the GDPR: RUM and session replay consent, log scrubbing, the EU region option and the processing agreement for European applications. > > Canonical: https://www.flowconsent.com/en/services/other/datadog Other # Datadog Analytics · [Official website](https://datadoghq.com) Datadog is a cloud-based observability platform providing infrastructure monitoring, APM (Application Performance Monitoring), log management, security monitoring, and Real User Monitoring (RUM). For GDPR, the key distinctions are: server-side monitoring (infrastructure metrics, APM traces) can rely on legitimate interest, while RUM and session replay capture browser-side user behaviour requiring more careful assessment. An EU region (Frankfurt) is available for organisations with EU data residency requirements. [Block Datadog until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Analytics - Prior consent Not required - Documented cookies 1 - Third-party domains 3 - Servers United States with EU region option (Frankfurt) Overview ## What does Datadog do? ## **What is Datadog?** Datadog is a cloud-based observability and security platform providing infrastructure monitoring (server metrics, container health), Application Performance Monitoring (APM, distributed tracing), log management, Real User Monitoring (RUM), security monitoring (CSPM, SIEM), synthetic testing, and dashboarding. It is widely used by engineering teams to understand the performance and reliability of applications and infrastructure. Datadog collects a wide variety of telemetry data, some of which may contain personal data. ## **Server-side monitoring: legitimate interest** Infrastructure metrics, APM traces, and server-side logs are generally operations data with low personal data content. Legitimate interest supports this monitoring as an operational necessity. However, logs often contain IP addresses and user identifiers. Configure log scrubbing to remove or hash PII from log entries. Set minimum log retention periods consistent with operational needs. ## **RUM and Session Replay: higher GDPR risk** Datadog RUM captures browser-side user behaviour: page URLs visited, user interactions, JavaScript errors, performance metrics, and (with session replay) a visual recording of user sessions. RUM constitutes processing of end-user personal data. Session replay specifically records individual user sessions and requires consent under CNIL and ePrivacy guidelines. Configure RUM with strict masking and obtain consent before enabling session replay. ## **EU region** Datadog's EU region (AWS eu-central-1, Frankfurt) stores all telemetry data within the EU. Select the EU region when creating your Datadog account if EU data residency is required. US-region accounts require SCCs for EU personal data in logs and traces. ## **Practical compliance steps** Sign the Datadog DPA. Select EU region if required. Configure log scrubbing to remove PII. Set minimum retention for all data types. For RUM: enable strict privacy mode, mask all input fields, and consent-gate session replay. Disclose Datadog as a monitoring processor in your privacy policy distinguishing operational monitoring from end-user monitoring. Compliance ## Datadog and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f)) for infrastructure monitoring, APM, and log management as operational necessity. Real User Monitoring (RUM) captures browser-side data including URLs visited, user agent, and optionally user identifiers, requiring careful data minimisation and potentially consent for session replay features. - Risk level medium - Applicable regulations GDPR, SCCs for US deployments. Datadog EU region available. Session replay features require consent. ### Impact assessment (DPIA) A DPIA is recommended for Datadog deployments using RUM session replay and log management where personal data may appear in logs. The combination of user behaviour monitoring, log analysis, and APM tracing across large user bases warrants documented risk assessment. ### Sample text for your banner > This application uses Datadog for performance monitoring and error tracking. Datadog may collect technical information about your browser and interactions to help us maintain application performance. This is conducted under legitimate interest for operational purposes. Cookies and trackers ## What Datadog sets and contacts - Tracking method Infrastructure monitoring, APM, log management, RUM (Real User Monitoring), security monitoring, synthetics, dashboards - Server location United States with EU region option (Frankfurt) - Data transferred outside the EU Datadog is a US-based observability platform. An EU region (Frankfurt/AWS eu-central-1) is available for customers requiring EU data residency. Standard deployments process all telemetry data on US infrastructure requiring SCCs. Datadog provides a GDPR-compliant DPA. ### Cookies set (1) | Name | Type | Duration | Purpose | | ------- | ------- | -------- | ------------------------------------------------------------------------------------------------------- | | \_dd\_s | session | Session | Datadog RUM session cookie grouping browser events and performance metrics within a single user session | ### Third-party domains contacted (3) - `datadoghq.com` - `datadoghq.eu` - `browser-intake-datadoghq.com` Questions ## Frequently asked questions about Datadog Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What legal basis applies to Datadog monitoring? Legitimate interest (Art. 6(1)(f)) for infrastructure monitoring, APM, and log management as operational necessities. For RUM and session replay involving end-user data, careful assessment is needed: session replay specifically requires consent. ### Does Datadog offer an EU region? Yes. Datadog's EU region (AWS eu-central-1, Frankfurt) is available for all paying customers. Select the EU site (datadoghq.eu) when creating your Datadog account. This stores all telemetry data within the EU and eliminates SCCs for primary data flows. ### Does Datadog RUM require consent? Datadog RUM (basic page views and errors) may rely on legitimate interest as operational performance monitoring. Datadog RUM session replay specifically records individual user sessions and requires consent. Configure session replay to be consent-gated or disabled by default. ### How do I scrub PII from Datadog logs? Use Datadog's log scrubbing configuration (Log Management, Configuration, Log Pipeline) to add scrubbing rules for common PII patterns: emails, credit cards, phone numbers, IP addresses. Test rules before enabling in production. Also configure APM trace scrubbing to remove PII from distributed traces. ### What cookies does Datadog RUM set? Datadog RUM sets \_dd\_s (session tracking cookie) for grouping browser events into sessions. This requires consent under the ePrivacy Directive when used for RUM monitoring of end users. Infrastructure monitoring (no browser cookies) does not set end-user cookies. ### Do I need a DPA with Datadog? Yes. Sign the Datadog Data Processing Addendum available from Datadog's security and compliance page. For EU-region accounts, verify the DPA covers your specific region configuration. ### How should I configure Datadog retention for GDPR compliance? Set minimum retention periods for all data types in Datadog. Infrastructure metrics: 15 months (Datadog default). Log management: configure index retention to the minimum needed (1-3 days for debug logs, longer for audit logs). APM traces: 15 days default. RUM session replays: configure for minimum needed. ### Is Datadog suitable for organisations with strict EU data residency requirements? Yes, when configured with the EU region (datadoghq.eu). The EU region stores all telemetry data within the EU and eliminates SCCs. Datadog holds ISO27001 and SOC2 Type II certifications and provides a comprehensive DPA. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [SQLite](https://www.flowconsent.com/en/services/other/sqlite) [SQLite is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SQLite integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SQLite helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/sqlite) [Other](https://www.flowconsent.com/en/services/other/sqlite) · ### [PostgreSQL](https://www.flowconsent.com/en/services/other/postgresql) [PostgreSQL is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. PostgreSQL supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, PostgreSQL ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/postgresql) [Other](https://www.flowconsent.com/en/services/other/postgresql) · ### [POINT](https://www.flowconsent.com/en/services/other/point) [POINT is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. POINT integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, POINT helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/point) [Preferences](https://www.flowconsent.com/en/services/other/point) · ### [MariaDB](https://www.flowconsent.com/en/services/other/mariadb) [MariaDB is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MariaDB integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MariaDB helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/mariadb) [Other](https://www.flowconsent.com/en/services/other/mariadb) · ### [Comeet](https://www.flowconsent.com/en/services/other/comeet) [Comeet is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Comeet integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Comeet helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/comeet) [Preferences](https://www.flowconsent.com/en/services/other/comeet) · ### [Mapme](https://www.flowconsent.com/en/services/other/mapme) [Mapme is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mapme supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mapme ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/mapme) [Preferences](https://www.flowconsent.com/en/services/other/mapme) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)