> How FAST ESP enterprise search handles query data and cookies, what consent GDPR and ePrivacy require, and practical steps for compliant site search. > > Canonical: https://www.flowconsent.com/en/services/other/fast-esp Other # FAST ESP Analytics · [Official website](https://microsoft.com/enterprisesearch) FAST ESP (Fast Search and Transfer Enterprise Search Platform) powers on site search experiences, indexing content and processing visitor search queries to return relevant results. To personalise results and measure search performance it can set functional and analytics cookies and log query behaviour. [Block FAST ESP until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 2 - Servers Operator controlled, commonly self hosted on premise or in EU or US cloud infrastructure Overview ## What does FAST ESP do? ## **What FAST ESP is** FAST ESP, the Fast Search and Transfer Enterprise Search Platform, is an enterprise search engine that indexes large volumes of structured and unstructured content and serves fast, relevant results for on site search. Originally developed by the Norwegian company Fast Search and Transfer and later acquired by Microsoft, it underpins site search, faceted navigation and query suggestions across corporate websites, intranets and digital storefronts. ## **Data and cookies involved** In a standard deployment the platform records the search terms visitors type, the results they click and basic session context used to tune relevance. It typically sets a functional session cookie to maintain search state and, where analytics are enabled, additional cookies that measure query volume, zero result searches and click through. Logged queries can occasionally contain personal data when visitors type names, email addresses or order numbers into the search box. ## **GDPR and ePrivacy implications** The strictly functional session cookie that keeps search working can usually rely on the ePrivacy exemption for cookies that are necessary to deliver a service the user requested. Analytics cookies and behavioural query logging used to optimise relevance go beyond what is strictly necessary and therefore require prior consent under the ePrivacy Directive, with the resulting processing governed by the GDPR. The site operator acts as controller and any hosting or support partner acts as a processor under a data processing agreement. ## **Consent requirements** Core search functionality can run on the lawful basis of legitimate interest or necessity, so the search box itself does not have to be blocked behind a banner. Analytics cookies and any storage of identifiable query history should only be activated after the visitor gives explicit, informed and freely given consent through a consent management platform, and they must be just as easy to refuse as to accept. ## **Data transfers and third countries** FAST ESP can be self hosted entirely within the European Economic Area, which avoids any international transfer. Where it is run on US based cloud infrastructure or supported by Microsoft engineering teams, search index and query data may reach the United States. Such transfers need an appropriate safeguard, typically Standard Contractual Clauses or reliance on a vendor certified under the EU US Data Privacy Framework, supported by a transfer impact assessment. ## **Practical compliance steps** Document the cookies and query logs in your privacy notice, gate analytics behind consent, and configure short retention periods for raw query logs. Where possible, anonymise or truncate logged queries, disable storage of identifiable searches, and keep hosting within the EEA. Sign a data processing agreement with any host or support provider and record transfer safeguards if data leaves the European Economic Area. Compliance ## FAST ESP and the GDPR FAST ESP is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent for analytics cookies under ePrivacy, legitimate interest for core on site search functionality - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A full DPIA is usually not mandatory for standard on site search, but a screening assessment is advisable. Consider the volume of query logs, the risk that visitors type personal data into the search box, retention of behavioural analytics, and any transfer to the United States when hosted on US infrastructure. ### Sample text for your banner > We use search analytics cookies to understand how visitors use our site search and to improve the relevance of results. These are only set with your consent. You can accept or decline analytics in our cookie settings at any time. Cookies and trackers ## What FAST ESP sets and contacts - Tracking method Server side search query logging with functional and analytics cookies for session and relevance personalisation - Server location Operator controlled, commonly self hosted on premise or in EU or US cloud infrastructure - Cookieless mode available Yes - Data transferred outside the EU When deployed on US based cloud infrastructure or supported by Microsoft engineering, search index and query data may be transferred to the United States, requiring Standard Contractual Clauses or EU US Data Privacy Framework certification. ### Cookies set (3) | Name | Type | Duration | Purpose | | -------------------- | ---------- | --------- | -------------------------------------------------------------------------------------------- | | fast\_esp\_session | functional | Session | Maintains search session state and pagination so results persist while the visitor browses. | | fast\_esp\_relevance | functional | 30 days | Stores anonymous relevance and ranking preferences to tune search results for the visitor. | | fast\_esp\_analytics | analytics | 13 months | Measures query volume, zero result searches and click through to improve search performance. | ### Third-party domains contacted (2) - `fastsearch.com` - `microsoft.com` Questions ## Frequently asked questions about FAST ESP Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does FAST ESP set? In a standard deployment FAST ESP sets a functional session cookie that keeps your search state during a visit, and where analytics are enabled it can set additional cookies that measure query volume, zero result searches and click through. The functional cookie is necessary for search to work, while analytics cookies are optional. ### Is consent required to use FAST ESP? Consent is not required for the strictly necessary session cookie that makes the search box function, which can rely on necessity or legitimate interest. Consent is required before activating analytics cookies or storing identifiable query history, and it must be obtained through a consent banner with an equally easy refuse option. ### What is the legal basis for FAST ESP? Core on site search functionality typically relies on legitimate interest or contractual necessity. Analytics cookies and behavioural query logging rely on consent under the ePrivacy Directive, with the resulting personal data processing governed by the GDPR. ### Does FAST ESP transfer data to the US? It depends on hosting. When self hosted within the European Economic Area there is no international transfer. When run on US based cloud infrastructure or supported by Microsoft teams, index and query data can reach the United States, which requires Standard Contractual Clauses or an EU US Data Privacy Framework certified provider plus a transfer impact assessment. ### Do I need a DPIA for FAST ESP? A full DPIA is usually not mandatory for standard on site search, but a screening assessment is recommended. Consider the volume of query logs, the chance visitors type personal data into the search box, retention of behavioural analytics and any transfer to the United States. ### How do I implement FAST ESP compliantly? Document the cookies and query logs in your privacy notice, place analytics behind a consent banner, keep core search running on legitimate interest, and set short retention for raw logs. Anonymise or truncate logged queries where possible, host within the EEA, and sign a data processing agreement with any host or support partner. ### What are alternatives to FAST ESP? European hosted search platforms and self hosted open source engines such as Elasticsearch, OpenSearch, Solr or Meilisearch can be deployed entirely within the EEA to avoid international transfers. The right alternative depends on indexing scale, language needs and your appetite for self hosting versus a managed service. ### How do I update my cookie policy for FAST ESP? List the functional search cookie and any analytics cookies with their purpose and duration, explain that query data is logged to improve relevance, and state the lawful basis for each category. Disclose any US transfer and the safeguard used, and keep the policy in sync with your consent management platform. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [iCIMS](https://www.flowconsent.com/en/services/other/icims) [iCIMS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. iCIMS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, iCIMS helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/icims) [Preferences](https://www.flowconsent.com/en/services/other/icims) · ### [Bugzilla](https://www.flowconsent.com/en/services/other/bugzilla) [Bugzilla is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Bugzilla integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Bugzilla helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/bugzilla) [Preferences](https://www.flowconsent.com/en/services/other/bugzilla) · ### [SugarWOD](https://www.flowconsent.com/en/services/other/sugarwod) [SugarWOD is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SugarWOD supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SugarWOD ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/sugarwod) [Other](https://www.flowconsent.com/en/services/other/sugarwod) · ### [All in One Accessibility](https://www.flowconsent.com/en/services/other/all-in-one-accessibility) [All in One Accessibility is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. All in One Accessibility integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, All in One Accessibility helps organizations maintain robust websites that meet.](https://www.flowconsent.com/en/services/other/all-in-one-accessibility) [Other](https://www.flowconsent.com/en/services/other/all-in-one-accessibility) · ### [MapLoco](https://www.flowconsent.com/en/services/other/maploco) [MapLoco is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MapLoco supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MapLoco ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/maploco) [Preferences](https://www.flowconsent.com/en/services/other/maploco) · ### [Frontify](https://www.flowconsent.com/en/services/other/frontify) [Frontify is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Frontify integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Frontify helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/frontify) [Preferences](https://www.flowconsent.com/en/services/other/frontify) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)