> How Appcues processes personal data under GDPR and ePrivacy: SDK cookies and localStorage, event tracking, US hosting, consent and DPIA duties. > > Canonical: https://www.flowconsent.com/en/services/personalization/appcues Personalization # Appcues Unclassified · [Official website](https://www.appcues.com/) Appcues is a no code product adoption and user onboarding platform that displays in app modals, tooltips, checklists and slideouts to help users discover features, while tracking interactions for product analytics. [Block Appcues until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=personalization) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Personalization](https://www.flowconsent.com/en/services/personalization) - Consent Unclassified - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States (AWS us-east-1) with optional EU residency on request Overview ## What does Appcues do? Appcues is a product adoption platform widely used by SaaS companies to design in app guides, onboarding tours, surveys, and feature announcements without engineering effort. It is delivered as a JavaScript SDK that runs inside the host application, fires events to the Appcues backend, and renders custom UI based on segmentation rules. ## **What Appcues does** The Appcues SDK is loaded with a small script tag from fast.appcues.com. It identifies the logged in user via the identify call you implement (Appcues.identify(userId, properties)), tracks events, evaluates targeting rules client side, and displays flows like modals, tooltips, hotspots, checklists, surveys, and slideouts. Results are sent back to the Appcues backend for analytics and goal tracking. ## **Cookies and data collected** Appcues sets first party identifiers in localStorage (appcues:user\_id, appcues:session\_id, appcues:state) and an \_aciid cookie used for anonymous identification before the user logs in. Server side, Appcues receives the user ID and properties you pass in identify, every event you track, the user agent, the IP, the page URL, and the timestamp. ## **GDPR and ePrivacy implications** User IDs and event metadata are personal data. Appcues acts as a processor under your DPA. The SDK writes non strictly necessary storage and identifiers, so Article 5(3) ePrivacy requires prior consent for the tracking and analytics part. A narrow legitimate interest argument can be made for purely strictly necessary onboarding flows that block a feature until completed, but the safe default is consent. ## **Data transfers to the United States** Appcues is hosted on AWS in the United States. Transfers can rely on the EU-US Data Privacy Framework if Appcues remains certified, otherwise on Standard Contractual Clauses combined with a Transfer Impact Assessment. Enterprise customers can request EU residency, which routes traffic and storage through AWS EU regions. ## **How to deploy it compliantly** Sign the DPA, decide on EU residency if your audience justifies it, and disable Appcues until consent is captured. Minimise the user properties you pass: do not send special category data, restrict identifiers, and prefer hashed user IDs. Document the integration in your record of processing activities and explain Appcues in your privacy notice as a product adoption tool. Compliance ## Appcues and the GDPR Appcues is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for product analytics, legitimate interest possible only for strictly necessary onboarding flows - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU-US Data Privacy Framework, CCPA ### Impact assessment (DPIA) A DPIA is recommended when Appcues tracks logged in users at scale, especially when user properties include sensitive attributes (plan, role, behaviour patterns). Document the SDK identifiers, retention, the EU-US Data Privacy Framework or SCC mechanism, and any EU residency arrangement obtained from Appcues. ### Sample text for your banner > We use Appcues to guide you through new features and to measure how our product is used. Appcues sets identifiers in your browser and processes interactions on its servers in the United States. We only activate it after you accept the product experience category in our cookie banner. Cookies and trackers ## What Appcues sets and contacts - Tracking method JavaScript SDK with first party cookies and localStorage, event collection over HTTPS to Appcues backend - Server location United States (AWS us-east-1) with optional EU residency on request - Data transferred outside the EU Appcues is a US company hosted on AWS in the United States by default. Personal data, including user identifiers and event metadata, is transferred to the US. Transfers rely on the EU-US Data Privacy Framework (Appcues self-certified) or on Standard Contractual Clauses with a Transfer Impact Assessment. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------------- | ------------ | ------------------------ | -------------------------------------------------------------------------------------------------- | | \_aciid | http\_cookie | 1 year | Anonymous Appcues identifier used to track a visitor before they are logged in or identified. | | appcues:user\_id | localStorage | Persistent until cleared | Stores the user ID provided to Appcues.identify so the SDK can match the visitor to their profile. | | appcues:session\_id | localStorage | Session | Stores the current Appcues session identifier used to group events. | | appcues:state | localStorage | Persistent until cleared | Stores in progress flow state (which step the user is on, dismissed flows, etc.). | ### Third-party domains contacted (4) - `fast.appcues.com` - `api.appcues.net` - `events.appcues.com` - `statics.appcues.com` Questions ## Frequently asked questions about Appcues Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Appcues set? Appcues mostly stores identifiers in localStorage (appcues:user\_id, appcues:session\_id, appcues:state) and may set an \_aciid cookie for anonymous tracking before login. Storage entries can persist for years unless cleared. ### Does Appcues require GDPR consent? Yes for the analytics and personalisation parts. The SDK writes non strictly necessary identifiers, so prior consent is required under Article 5(3) ePrivacy. A narrow legitimate interest argument may cover purely strictly necessary onboarding flows. ### What is the legal basis for processing? Consent under Article 6(1)(a) GDPR for analytics and personalisation. Legitimate interest (Article 6(1)(f)) can be considered only for in app flows that are strictly necessary to deliver the product, with a documented balancing test. ### Are data transferred outside the EU? Yes. Appcues is hosted in the United States on AWS by default. Transfers can rely on the EU-US Data Privacy Framework or on SCCs with a TIA. Enterprise plans can include EU residency on request. ### Do I need a DPIA? A DPIA is recommended at scale or when user properties include sensitive attributes. Document the SDK identifiers, retention, US transfer mechanism, and the proportionality of using Appcues compared with self hosted alternatives. ### How do I implement Appcues compliantly? Sign the DPA, configure EU residency if available, gate the SDK behind consent, minimise user properties, never send special category data, and disclose Appcues in your privacy notice with retention and recipients. ### Are there alternatives to Appcues? Alternatives include Userflow, Userpilot, Chameleon, Pendo, Intro.js, Shepherd.js for open source tour flows, and Reactflow. Some of them offer EU hosting by default. ### How do I update my cookie policy for Appcues? Add an Appcues entry listing the localStorage keys and the \_aciid cookie, with their purpose and lifetime. Mention the US transfer mechanism and the role of Appcues as a processor. Link to the Appcues privacy policy. Same category ## More services: Personalization [See the whole category](https://www.flowconsent.com/en/services/personalization) ### [Attraqt](https://www.flowconsent.com/en/services/personalization/attraqt) [Attraqt is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Attraqt offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Attraqt empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/personalization/attraqt) [Analytics](https://www.flowconsent.com/en/services/personalization/attraqt) · ### [Oracle Maxymiser](https://www.flowconsent.com/en/services/personalization/oracle-maxymiser) [Oracle Maxymiser is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Oracle Maxymiser supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Oracle Maxymiser enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/oracle-maxymiser) [Analytics](https://www.flowconsent.com/en/services/personalization/oracle-maxymiser) · ### [LimeSpot](https://www.flowconsent.com/en/services/personalization/limespot) [LimeSpot is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. LimeSpot provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, LimeSpot helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/limespot) [Preferences](https://www.flowconsent.com/en/services/personalization/limespot) · ### [Klangoo](https://www.flowconsent.com/en/services/personalization/klangoo) [Klangoo is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Klangoo provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Klangoo helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/klangoo) [Marketing](https://www.flowconsent.com/en/services/personalization/klangoo) · ### [Google Optimize](https://www.flowconsent.com/en/services/personalization/google-optimize) [Google Optimize is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Google Optimize offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Google Optimize empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/personalization/google-optimize) [Analytics](https://www.flowconsent.com/en/services/personalization/google-optimize) · ### [Coveo](https://www.flowconsent.com/en/services/personalization/coveo) [Coveo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Coveo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Coveo enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/coveo) [Analytics](https://www.flowconsent.com/en/services/personalization/coveo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)