Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Elastic APM is an application performance monitoring tool, and its Real User Monitoring agent runs in the browser to measure page load times, transactions, and front end errors. It collects technical data such as URLs, browser, and IP address, but it does not rely on tracking cookies, and you can self host it or use Elastic Cloud in an EU region. Performance monitoring can usually be based on legitimate interest, keeping privacy obligations low when hosted in the EU.
Elastic APM is part of the Elastic Stack and monitors application performance, including a Real User Monitoring agent that runs in the visitor browser. The RUM agent measures how quickly pages and resources load, traces transactions, and captures front end errors so teams can find performance problems. You can self host the Elastic APM server or use Elastic Cloud, including EU regions.
The RUM agent collects performance metrics, page and resource timings, the page URL, browser and device information, and the visitor IP address, plus error details when they occur. It uses a transaction or session identifier to correlate events, typically without setting tracking cookies. The data is technical and focused on performance rather than on profiling individuals.
Because Elastic APM RUM is cookieless and collects technical performance data, it often avoids the ePrivacy consent requirement and can rely on legitimate interest under the GDPR. IP addresses and URLs are still personal data, so minimisation and short retention are important. When self hosted or EU hosted, you remain in control of where the data is stored.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In its standard cookieless configuration, Elastic APM RUM can usually be used without a consent banner, on the basis of legitimate interest in maintaining performance. You should inform users in your privacy notice and avoid capturing personal data in custom labels or URLs. Reassess if you extend it to collect data that identifies users.
Where data is stored depends on your deployment. If you self host Elastic APM or choose an EU region in Elastic Cloud, the data can stay within the European Union and avoid a third country transfer. If you use a non EU region or US based managed services, apply Standard Contractual Clauses and a transfer impact assessment.
To use Elastic APM compliantly, self host or choose an EU region, keep the cookieless RUM configuration, and avoid putting personal data in URLs or custom labels. Set short retention for performance data, rely on legitimate interest with a balancing test, and mention Elastic APM in your privacy notice. Review the setup if you change what the agent captures.
Websites using Elastic APM must obtain user consent under GDPR regulations.
DPIA considerations
Elastic APM RUM collects technical performance data including IP addresses and URLs but does not use tracking cookies, which keeps its risk profile moderate to low. Key DPIA points: (1) processing of IP addresses and URLs that are personal data; (2) the deployment choice that determines whether data stays in the EU or triggers a transfer; (3) reliance on legitimate interest with a balancing test; (4) the risk of placing personal data in URLs or custom labels; (5) the need for short retention and a data processing agreement where a managed service is used. A DPIA is rarely required for a standard EU hosted, cookieless deployment.
Sample consent text
We use Elastic APM to monitor the performance of our website. Its monitoring agent measures page load times and errors and processes technical data such as URLs and your IP address. This data is stored in the European Union (or on our own infrastructure) and processed on the basis of our legitimate interest in a fast, reliable site. You can object to this processing as described in our privacy notice.
Third-party domains contacted
elastic.cocloud.elastic.coyour-apm-server.example.comElastic APM collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The Elastic APM Real User Monitoring agent is cookieless in its standard configuration and does not set tracking cookies. It correlates events using a transaction or session identifier rather than persistent cookies. Confirm your specific setup, since custom configurations can vary.
Usually not for the standard cookieless RUM, because it does not set non essential cookies and can rely on legitimate interest in performance. Inform users in your privacy notice, and reassess if you capture personal data in custom labels or URLs.
Performance monitoring is typically based on legitimate interest (Art. 6(1)(f)) in maintaining a fast and reliable service, supported by a balancing test. Because the RUM agent is cookieless, ePrivacy consent is generally not engaged for the standard setup.
Not necessarily. If you self host or choose an EU region in Elastic Cloud, the data can stay in the EU. If you use a non EU region or US managed services, that is a transfer requiring Standard Contractual Clauses and a transfer impact assessment.
A DPIA is rarely required for a standard EU hosted, cookieless deployment. Consider one if you store data outside the EU at scale or capture personal data in custom labels, focusing on IP addresses, URLs, and retention.
Self host or choose an EU region, keep the cookieless RUM configuration, and avoid putting personal data in URLs or labels. Set short retention, document a legitimate interest balancing test, and mention Elastic APM in your privacy notice.
Yes. Other self hostable or EU hosted performance monitoring tools, such as Grafana Faro with an EU backend or a self hosted OpenTelemetry stack, offer similar RUM without third country transfers. They keep performance data under your control.
Because the RUM agent is cookieless, focus your privacy notice on the performance data it processes, including IP addresses and URLs, and where it is stored. If your configuration sets any cookies, list them with purpose and duration, and review when the setup changes.