Meilisearch

What Meilisearch Is

Meilisearch is an open source search engine that delivers fast, typo tolerant search for websites and applications. It is developed by a company headquartered in Paris, France, and the core engine is released under an open source license so you can run it yourself. You can self host it on your own servers in any region, or use the managed Meilisearch Cloud and pick a server location that suits your data residency needs. Because the engine runs server side and exposes a search API, the search itself does not require any tracking cookies in the visitor browser. This design makes Meilisearch a strong choice for organisations that want powerful search while keeping a small privacy footprint. It is widely used as a self hosted, privacy friendly alternative to fully hosted search products.

Cookies and Data Collected

By default the Meilisearch engine sets no third party tracking cookies on your visitors. A front end search widget may store a small value in localStorage or use a session token to remember recent queries or display preferences, which is first party and not used for advertising. The engine processes the search queries that users type and the documents you index, which can contain personal data depending on what you choose to make searchable. The open source build includes optional anonymous telemetry that reports aggregated usage metrics to the maintainers, and this can be disabled with a single environment variable. Meilisearch Cloud may collect operational logs needed to run the managed service. You remain in control of what is indexed and how long search logs are retained.

GDPR and ePrivacy Implications

Under the ePrivacy Directive, consent is required for storing or reading information on a device unless it is strictly necessary for a service the user requested. Because Meilisearch sets no advertising cookies and any local storage it uses serves the search the visitor asked for, a default deployment usually falls under the strictly necessary or legitimate interest path. The personal data you index and the search queries you log are processed under the GDPR, with you acting as the data controller. If you self host, Meilisearch is simply software you operate, so there is no external processor for the search function. If you use Meilisearch Cloud, the company acts as a processor and you should put a data processing agreement in place. Keeping the configuration cookieless greatly simplifies your ePrivacy position.

Consent Requirements and CMP Integration

For a standard cookieless search deployment you generally do not need a consent banner gate in front of the search box, since the processing is strictly necessary or based on legitimate interest. You should still describe the search functionality in your privacy notice and explain any local storage used by the search widget. If you layer optional analytics, heatmaps, or marketing tags around the search experience, those require prior opt in consent and should be wired into your consent management platform. A clean approach is to keep search outside the consent gate and only block the truly optional extras until the visitor agrees. Always disable the engine telemetry if you do not want any usage data leaving your environment. Document your reasoning so you can demonstrate accountability to a regulator.

International Data Transfers

When you self host Meilisearch on servers located in the European Union, personal data stays within the region you control and there is no transfer to a third country. Meilisearch Cloud lets you select a region, so you can keep data inside the EU if that is your requirement. The company behind Meilisearch is based in France, which is inside the EU, reducing exposure to third country transfer concerns. If you enable anonymous telemetry, only aggregated and non identifying metrics are sent, and you can turn this off entirely. For organisations with strict data residency obligations, the self hosted EU model offers the cleanest path with no onward international transfer. Always confirm the hosting region of any cloud option before going live.

Practical Compliance Steps

Start by choosing where to run Meilisearch and, for EU users, prefer self hosting or an EU region so data residency is clear. Disable anonymous telemetry if you do not want any usage metrics leaving your environment. Review what you index and avoid placing unnecessary personal or special category data into searchable documents. Set a sensible retention policy for search logs and restrict access to the admin API keys. Update your privacy notice to mention the search engine, the legitimate interest or strictly necessary basis, and any first party local storage used by the widget. If you use Meilisearch Cloud, sign a data processing agreement and record the region. Finally, keep your cookie and privacy documentation in sync with the actual configuration whenever you change it.