Flagsmith
Flagsmith is a UK-based open-source feature flag and remote configuration platform competing with LaunchDarkly, Unleash and GrowthBook. Engineering teams use it to roll out features progressively, run A/B tests, and target specific user segments. From a GDPR perspective, Flagsmith is one of the most privacy-friendly options: the platform can be self-hosted entirely on the customer's infrastructure, the SaaS offers EU region, and the UK has an EU adequacy decision so transfers do not require SCCs.
What does Flagsmith do?
What is Flagsmith
Flagsmith is an open-source feature flag and remote configuration platform built by a UK company. Engineering teams use it to launch features gradually, run A/B tests, segment users for targeted rollouts, and remotely configure application behaviour without redeploying code.
What data Flagsmith processes
At flag evaluation time, the SDK sends a user identifier (anonymous or authenticated) and a set of traits (key-value attributes such as country, plan, signup_date) to the Flagsmith server. The server returns the flag values applicable to that user. Flagsmith stores the evaluation log for audit. No browser cookies are set by default.
GDPR and ePrivacy implications
Because Flagsmith does not set cookies on visitors, Art. 5(3) ePrivacy does not apply. The privacy impact comes entirely from what traits the engineering team chooses to send. Avoid sending sensitive attributes (medical condition, religion, political opinion) unless the use case has a clear Art. 9 GDPR basis. The lawful basis for non-sensitive trait-based evaluation is legitimate interest.
Hosting options
Three deployment options: (1) Flagsmith SaaS hosted in the UK; (2) Flagsmith SaaS hosted in the EU (Frankfurt); (3) self-hosted on your infrastructure (Kubernetes/Docker). Self-hosting eliminates third-party data flows entirely and is the strongest compliance posture. UK SaaS benefits from the EU adequacy decision so transfers do not require SCCs.
Compliance considerations for engineering
Document which traits each flag uses. Avoid sensitive traits. Use anonymous identifiers where possible. Configure log retention to the minimum useful for debugging. Establish a process for handling DSR (right to erasure) by deleting user identities from Flagsmith.
Practical compliance checklist
1. Choose hosting (SaaS EU, SaaS UK or self-hosted). 2. Sign DPA (for SaaS) or skip (self-hosted). 3. Document Flagsmith in your Record of Processing Activities. 4. Audit traits and exclude sensitive ones. 5. Configure log retention. 6. Map flag evaluation into DSR workflow. 7. Disclose Flagsmith in privacy notice for SaaS.
Flagsmith and the GDPR
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR) for non-personalised flag evaluation; Consent (Art. 6(1)(a)) when flags are tied to behavioural identifiers used for product personalisation
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive (only if behavioural identifiers are used)
Impact assessment (DPIA)
Flagsmith processes user identifiers (anonymous or authenticated) and traits (segmentation attributes such as plan, country, beta_user) to evaluate feature flags. Key DPIA considerations: (1) the privacy impact depends entirely on what traits the engineering team sends; sensitive attributes (e.g. medical condition) require Art. 9 GDPR justification; (2) the self-hosted option eliminates third-party data flows; (3) for SaaS, the UK adequacy decision simplifies transfers; (4) flag evaluation logs may retain user identifiers and should be subject to retention policies. A streamlined DPIA is sufficient for typical use.
Sample text for your banner
We use Flagsmith to enable, disable or test features on our site. Flagsmith evaluates a user identifier (anonymous or your account ID) and basic traits (such as language or plan) on its infrastructure in the UK or EU. The UK has an EU adequacy decision so data is protected at the EU level. No tracking cookies are set on your browser.
What Flagsmith sets and contacts
- Tracking method
- Feature flag and remote configuration platform with JavaScript and server-side SDKs. Sends evaluation requests with user identifiers and trait attributes; can be self-hosted to avoid third-party data flows
- Server location
- Flagsmith Ltd., United Kingdom. SaaS infrastructure available in EU (Frankfurt) and US regions; full self-hosting option supported
- Cookieless mode available
- Yes
- Data transferred outside the EU
- For Flagsmith SaaS, evaluation requests with user identifier and traits are sent to Flagsmith infrastructure. Customers can choose the EU region. The UK has an EU adequacy decision so transfers to Flagsmith UK do not require SCCs. Self-hosted deployment keeps all data on the customer's servers.
Third-party domains contacted (4)
flagsmith.comapi.flagsmith.comedge.api.flagsmith.comapp.flagsmith.com
Frequently asked questions about Flagsmith
Can't find your question? Write to us, we answer fast.
Does Flagsmith set cookies?
No, by default Flagsmith does not set cookies on visitors. The SDK communicates server-to-server or via Ajax requests carrying a user identifier and traits.
Do I need user consent?
Not for flag evaluation itself. If a flag is tied to a behavioural identifier (e.g. cohort from analytics), ensure the underlying tracking has the right consent.
Legal basis?
Legitimate interest for non-sensitive trait-based evaluation. For sensitive traits, an Art. 9 GDPR basis is required.
Data transfers?
For SaaS UK, EU adequacy decision covers transfers without SCCs. For SaaS EU, no transfer outside the EU. For self-hosted, no third-party transfer.
DPIA?
Streamlined DPIA sufficient. Full DPIA if you send sensitive traits or operate as a critical NIS2 entity.
Compliant deployment?
Choose EU or UK SaaS or self-host, audit traits, anonymise identifiers where possible, document in Record of Processing Activities, configure log retention, integrate with DSR workflow.
Alternatives?
EU-friendly: GrowthBook (US, open source self-hostable), Unleash (Norway, open source), ConfigCat (Hungary). LaunchDarkly is the dominant US competitor.
Policy updates?
For SaaS, disclose Flagsmith Ltd. as processor and the UK/EU hosting region. For self-hosted, document Flagsmith as an internal technical measure.
SiteSpect
SiteSpect is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SiteSpect offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SiteSpect empowers organizations to optimize strategy and maximize return on investment.
Acquia Personalization
Acquia Personalization is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Acquia Personalization supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Acquia Personalization enables informed decisions that improve.
Coveo
Coveo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Coveo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Coveo enables informed decisions that improve experience and drive results.
Split
Split is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Split supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Split enables informed decisions that improve experience and drive results.
Visitor.js
Visitor.js is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Visitor.js enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Visitor.js empowers marketing teams to achieve measurable growth.
Adobe Target
Adobe Target is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Adobe Target offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Adobe Target empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.