Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Sprig is a US based product experience platform that runs in product micro surveys, feedback prompts, and session replays to help teams understand user behaviour. It collects survey responses, interaction events, device and browser data, IP addresses, and can record sessions, using a JavaScript SDK and cookies. Because it is operated from the United States and sets non essential cookies, it requires prior consent under the GDPR and the ePrivacy Directive and transfers data to a third country.
Sprig is a product experience and research platform operated by Sprig (formerly UserLeap) in the United States. Product teams embed its SDK to trigger targeted in product surveys, collect feedback, and optionally record session replays, then use built in analysis to find patterns. Once installed, Sprig loads in the visitor or user browser and can set cookies and identifiers.
Sprig collects survey answers, feedback text, interaction events, and metadata such as device, browser, locale, and IP address. When session replay is enabled it can capture detailed interaction and screen data, which may include personal information shown on screen. It assigns identifiers so responses and sessions can be linked to a user across visits.
Sprig sets non essential cookies and can record user sessions, so the ePrivacy Directive requires prior consent and the GDPR requires a lawful basis and transparency. Session replay is particularly sensitive because it can capture data entered into forms, so input masking and field exclusion should be configured. A data processing agreement with Sprig is required as it acts as your processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Obtain prior, opt in consent before the Sprig SDK initialises on a live site or product, and keep consent specific and easy to withdraw. If you enable session replay, make the recording clear to users and mask sensitive fields by default. Block Sprig behind your consent mechanism so it loads only after acceptance.
Sprig is based in the United States and processes data there, so its use involves a third country transfer under Chapter V of the GDPR. Transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. Document what categories of data leave the EU.
To stay compliant, gate Sprig behind consent, sign a data processing agreement, and complete a transfer impact assessment. Enable input masking for session replay, minimise the data collected, set retention limits, and avoid capturing special category data. List Sprig in your cookie policy and privacy notice and review its subprocessors regularly.
Websites using Sprig must obtain user consent under GDPR regulations.
DPIA considerations
Sprig combines in product surveys with optional session replay, which can capture detailed and potentially sensitive data, raising its risk profile. Key DPIA points: (1) transfer of personal data to Sprig in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) session replay that may record form inputs and on screen personal data unless masking is configured; (3) persistent identifiers linking responses and sessions to a user over time; (4) risk of collecting special category data in open ended responses; (5) the need for a data processing agreement, input masking, and retention limits. A DPIA is recommended where replay or large scale surveying is used.
Sample consent text
We use Sprig to run short in product surveys and, where enabled, session replays to improve our product. With your consent, Sprig sets cookies and collects your responses, interaction events, and technical data such as device and IP address. This data is processed by Sprig in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings.
Third-party domains contacted
sprig.comapi.sprig.comcdn.sprig.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sprig.aid | Analytics | 1 year | Anonymous identifier used to attribute survey responses and interaction events to a visitor. |
| sprig.uid | Analytics | 1 year | Identifier used to recognise a known user across sessions for targeting and analysis. |
| sprig.session | Functional | Session | Maintains the current survey session state while the prompt is displayed. |
Sprig uses cookies for user preferences — inform visitors with a consent banner.
Sprig sets functional cookies to run a survey session and analytics identifiers that link responses and sessions to a user across visits. These analytics cookies are not strictly necessary and require consent. If session replay is enabled, additional processing of interaction data occurs.
Yes. Sprig sets non essential cookies and can record sessions, so you must obtain prior, opt in consent before its SDK initialises. Make session replay and its purpose clear, and load Sprig only after the visitor accepts.
In product surveys, analytics cookies, and session replay rely on consent (Art. 6(1)(a)) and the ePrivacy Directive. Detailed behavioural recording on a live product should not rely on legitimate interest alone.
Yes. Sprig is based in the United States and processes data there, so its use is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment.
A DPIA is recommended, especially if you enable session replay or survey at scale. Assess the US transfer, the risk that replays capture form inputs or sensitive data, the identifiers used, and your retention periods.
Block Sprig behind your consent banner, sign a data processing agreement, complete a transfer impact assessment, and enable input masking for session replay. Minimise data, set retention limits, and document Sprig in your cookie policy and privacy notice.
Yes. EU based or self hosted survey tools, or feedback collected without session replay, reduce cookies and third country transfers. Tools such as LimeSurvey (self hosted) or EU hosted feedback platforms are more data minimal options.
Add a Sprig entry listing its functional and analytics cookies, their purposes and durations, whether session replay is used, and the fact that data is processed in the United States. Link to Sprig''s privacy notice and review the entry when its cookies or subprocessors change.