> How Chameleon in product onboarding uses cookies, tracks usage, and transfers data to the US, plus how to deploy it under the GDPR and ePrivacy. > > Canonical: https://www.flowconsent.com/en/services/personalization/chameleon Personalization # Chameleon Analytics · [Official website](https://www.trychameleon.com) Chameleon is a product adoption platform that adds in product tours, tooltips, surveys, and onboarding to web applications. To decide what to show and to measure engagement it identifies users, records in product usage events, and stores which experiences a person has seen, along with the IP address and device information. On European products the analytics and survey features generally require consent, while essential onboarding may rely on another basis. [Block Chameleon until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=personalization) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Personalization](https://www.flowconsent.com/en/services/personalization) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States Overview ## What does Chameleon do? ## What Chameleon is Chameleon is a product adoption platform used inside web applications to guide users with tours, tooltips, launchers, and surveys. Product teams use it to onboard new users, announce features, and collect feedback without shipping new code, which means it observes how people move through the product. ## What data and cookies it collects Chameleon identifies users, usually with an id passed from your application, and records usage events and which experiences a person has seen. It stores state in cookies and local storage and processes the IP address and device information. Because it runs inside authenticated products, this data is typically linked to a known individual. ## GDPR and ePrivacy implications The identifiers and usage events are personal data under the GDPR, and the cookies and storage fall under the ePrivacy Directive. Storage needed to remember that a tour was completed may be closer to strictly necessary, but behavioural analytics and surveys go beyond that, so you need a clear legal basis and to inform users. ## Consent requirements Decide the basis per purpose. Essential onboarding inside a service the user has signed up for may rely on legitimate interest or contract, while analytics that profile behaviour and optional surveys should rely on consent. Configure Chameleon so non essential tracking waits for consent, and make withdrawal easy. ## Data transfers outside the EU Chameleon is a United States company, so personal data may be processed there and transfers rely on the EU US Data Privacy Framework or on Standard Contractual Clauses. Limit the user attributes you send to Chameleon to reduce the personal data crossing borders. ## Practical compliance steps Map each Chameleon purpose to a legal basis, gate non essential analytics behind consent, minimise the attributes you pass, and sign a data processing agreement. Document the processing, set retention limits, and describe Chameleon in your privacy notice and cookie policy. Compliance ## Chameleon and the GDPR Chameleon is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent or legitimate interest depending on purpose (Art. 6(1)(a) or (f) GDPR) - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) Chameleon links usage events to identified users in your product, so assess what behavioural data is collected, whether it is used for analytics beyond onboarding, the retention, and the transfers to the United States. Clarify the legal basis for each purpose. ### Sample text for your banner > We use Chameleon to guide you through our product and to gather feedback. Chameleon may set cookies and record how you use features. Non essential analytics run only after you accept the relevant cookies. Cookies and trackers ## What Chameleon sets and contacts - Tracking method JavaScript snippet, cookies and local storage, in product usage events - Server location United States - Data transferred outside the EU Data is processed by Chameleon in the United States. Transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------- | ---------- | -------- | ------------------------------------------------------------------------------------- | | chmln.session | Functional | Session | Maintains the Chameleon session within the product during the visit. | | chmln.profile | Analytics | 1 year | Stores the user profile identifier used to target and measure in product experiences. | | chmln.seen | Functional | 1 year | Records which tours and tooltips a user has already seen to avoid repeating them. | ### Third-party domains contacted (3) - `trychameleon.com` - `fast.trychameleon.com` - `edge.trychameleon.com` Questions ## Frequently asked questions about Chameleon Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Chameleon set? Chameleon sets a session value, a profile identifier, and storage that records which tours a user has seen. The value that remembers a completed tour can be close to necessary, while the profile and analytics storage is not and belongs in the analytics category. ### Do I need consent for Chameleon? For non essential analytics and surveys, yes. Essential onboarding within a service the user signed up for may rely on another basis, but behavioural tracking requires prior consent under the ePrivacy Directive and the GDPR. ### What is the legal basis for Chameleon? It depends on purpose. Contract or legitimate interest can cover essential onboarding, while consent under Article 6(1)(a) of the GDPR is appropriate for behavioural analytics and optional surveys. ### Does Chameleon transfer data to the United States? Yes. Chameleon is a United States company, so data may be processed there and transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses. Sending fewer user attributes reduces the data transferred. ### Is a DPIA needed for Chameleon? A targeted assessment helps where usage tracking is extensive or combined with other analytics. Document the attributes sent, the events collected, the retention, and the transfers. ### How do I deploy Chameleon compliantly? Assign a legal basis per purpose, gate non essential analytics behind consent, minimise the attributes you pass, and sign a data processing agreement. Describe Chameleon in your privacy notice and cookie policy. ### Are there alternatives to Chameleon? Alternatives include Appcues, Pendo, Userpilot, and Intro.js for self hosted tours. Lighter, self hosted onboarding can reduce both tracking and transfers. ### How do I update my cookie policy for Chameleon? List the Chameleon storage entries with their purpose and duration, separate essential onboarding from analytics, name Chameleon as the recipient, and mention the United States transfer. Update it when your configuration changes. Same category ## More services: Personalization [See the whole category](https://www.flowconsent.com/en/services/personalization) ### [Split](https://www.flowconsent.com/en/services/personalization/split) [Split is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Split supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Split enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/split) [Analytics](https://www.flowconsent.com/en/services/personalization/split) · ### [Twik](https://www.flowconsent.com/en/services/personalization/twik) [Twik is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Twik enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Twik empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/twik) [Preferences](https://www.flowconsent.com/en/services/personalization/twik) · ### [Pickzen](https://www.flowconsent.com/en/services/personalization/pickzen) [Pickzen is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Pickzen supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Pickzen enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/pickzen) [Analytics](https://www.flowconsent.com/en/services/personalization/pickzen) · ### [VWO](https://www.flowconsent.com/en/services/personalization/vwo) [VWO is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. VWO supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, VWO enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/vwo) [Analytics](https://www.flowconsent.com/en/services/personalization/vwo) · ### [Vertster](https://www.flowconsent.com/en/services/personalization/vertster) [Vertster is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Vertster enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Vertster empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/vertster) [Analytics](https://www.flowconsent.com/en/services/personalization/vertster) · ### [Recolize](https://www.flowconsent.com/en/services/personalization/recolize) [Recolize is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Recolize enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Recolize empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/personalization/recolize) [Preferences](https://www.flowconsent.com/en/services/personalization/recolize) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)