FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Instana

Analytics

IBM Instana is an observability and application performance monitoring platform. Its core tracing is server side, but the optional End User Monitoring (EUM) feature injects a JavaScript beacon that captures page performance, user agent, IP address and session data. When EUM is enabled it should be treated like real user monitoring, with consent and transfer obligations in the EU.

Block Instana until consentScan my site
Overview

What does Instana do?

What IBM Instana is

IBM Instana is an observability and application performance monitoring platform that automatically traces requests, maps service dependencies and detects issues across applications and infrastructure. Most monitoring is server side through agents, but Instana also offers End User Monitoring, which observes the real browser experience of website visitors.

Data and cookies collected

Server side tracing collects technical telemetry and does not touch the visitor browser. The End User Monitoring beacon is different, it injects JavaScript that captures page load timing, errors, the user agent, the visitor IP address and a session identifier, and it may store that identifier in local storage or a cookie. This browser data can identify individuals and is personal data under the GDPR.

GDPR and ePrivacy implications

If only server side tracing is used, you can usually rely on legitimate interest for operational monitoring. Once End User Monitoring is enabled and stores an identifier on the device or processes IP and session data tied to individuals, the ePrivacy Directive requires prior consent for that storage, and the processing must have a valid GDPR basis and be disclosed.

Consent requirements

Where End User Monitoring is active, load the beacon only after the visitor consents to performance or analytics tracking, and block it behind your consent manager until then. If you run server side tracing only, no browser consent is needed because nothing is stored on the visitor device, though you still document the processing.

Data transfers to the United States

Instana is an IBM product offered as SaaS in several regions. When End User Monitoring data including IP addresses is sent to a backend outside the EEA, such as the United States, you need a transfer mechanism such as the Data Privacy Framework or Standard Contractual Clauses. Selecting an EU backend can keep server side and EUM data within the EEA.

Practical compliance steps

Decide whether you need End User Monitoring, gate it behind consent if you do, consider IP truncation and shorter retention, sign a data processing agreement with IBM, choose an EU backend where possible, list any EUM identifiers in your cookie policy and document the lawful basis for server side tracing.

Compliance

Instana and the GDPR

Instana is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR where End User Monitoring stores identifiers or processes browser data tied to individuals; legitimate interest under Article 6(1)(f) for server side tracing
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

Server side tracing alone is low risk and a DPIA is rarely required. When End User Monitoring is enabled, assess the risk of systematic collection of IP addresses, user agents and session identifiers across many visitors and document the processing, since combined monitoring can raise the risk profile.

Sample text for your banner

We use IBM Instana End User Monitoring to measure page performance. This processes your IP address and session data and may transfer it to IBM outside the EU. Do you accept performance monitoring?
Cookies and trackers

What Instana sets and contacts

Tracking method
Server side observability and tracing agents, plus optional End User Monitoring (EUM) JavaScript beacon that captures browser performance and may use local storage or cookies
Server location
IBM Instana global infrastructure, SaaS backends available in EU and United States regions
Cookieless mode available
Yes
Data transferred outside the EU
When End User Monitoring is enabled, page performance, user agent, IP and session data may be processed on IBM infrastructure outside the EEA, including the United States, relying on Standard Contractual Clauses or the Data Privacy Framework. Server side tracing can be kept in an EU backend.

Cookies set (2)

NameTypeDurationPurpose
instana session identifierPerformance / EUMSessionIdentifies a browser session for End User Monitoring correlation, often stored in local storage
instana user identifierPerformance / EUMPersistentRecognises a returning end user across visits when End User Monitoring is enabled

Third-party domains contacted (3)

  • instana.io
  • eum.instana.io
  • ibm.com
Questions

Frequently asked questions about Instana

Can't find your question? Write to us, we answer fast.

What cookies does Instana set?

Server side tracing sets nothing in the browser. When End User Monitoring is enabled, Instana may store a session or user identifier in a cookie or in local storage to correlate browser performance beacons.

Do I need consent to use Instana?

It depends on the mode. Pure server side tracing needs no browser consent. If End User Monitoring stores an identifier on the device or processes browser data tied to individuals, prior consent is required under the ePrivacy Directive.

What is the legal basis for Instana?

Server side tracing can rely on legitimate interest under Article 6(1)(f) GDPR. End User Monitoring that stores identifiers and processes IP and session data needs consent under Article 6(1)(a).

Does Instana transfer data to the United States?

It can. Instana is an IBM SaaS product offered in several regions. If you use a US backend, or if EUM data including IP addresses is sent there, you need a transfer mechanism such as the Data Privacy Framework or Standard Contractual Clauses.

Do I need a DPIA for Instana?

Server side tracing rarely needs a DPIA. With End User Monitoring enabled, assess the risk of systematic collection of IP, user agent and session data across many visitors and carry out a DPIA if the risk is high.

How do I implement Instana compliantly?

Decide if you need End User Monitoring, gate it behind consent if you do, consider IP truncation, sign a data processing agreement with IBM, choose an EU backend where possible and disclose any EUM identifiers and the server side basis.

What are the alternatives to Instana?

Alternatives include other observability tools, server side only tracing stacks, or EU hosted monitoring platforms. Running tracing without End User Monitoring avoids storing identifiers on the visitor device.

How should I update my cookie policy for Instana?

If End User Monitoring is enabled, list the Instana identifiers with their purpose and duration, name IBM as a recipient, explain possible US transfers and describe how visitors withdraw consent. Server side only setups need no cookie entry.

Same category

More services: Other

See the whole category

Hexia

Hexia is a development framework and toolkit providing developers with a structured foundation for building modern web applications. It offers reusable components, standardized architecture patterns, and comprehensive documentation. Hexia accelerates development through code generation, testing utilities, and build optimization. With an active community and extensive ecosystem, Hexia enables teams to build scalable, maintainable applications following industry best practices.

Analytics

Mapline

Mapline is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Mapline integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Mapline helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Recite Me

Recite Me is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Recite Me integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Recite Me helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

Brandfolder

Brandfolder is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Brandfolder supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Brandfolder ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Sedna System

Sedna System is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Sedna System supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Sedna System ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Other

Usabilla

Usabilla is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Usabilla integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Usabilla enhances satisfaction by ensuring tailored browsing experiences for every visitor.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site