> How Anura analyses website traffic to detect bots and ad fraud, when legitimate interest applies and what US data transfers involve under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/security/anura Security # Anura Marketing · [Official website](https://www.anura.io) Anura is a US-based ad fraud detection and traffic quality platform that analyses website visitor traffic in real time to identify bots, scrapers, and invalid traffic sources. It uses JavaScript tags and IP analysis to assess traffic quality. While fraud detection may rely on legitimate interest under GDPR, the ePrivacy Directive still requires consent for any cookies or device-level tracking. Data is processed in the US via Standard Contractual Clauses. [Block Anura until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Marketing - Prior consent Required - Documented cookies 1 - Third-party domains 3 - Servers United States (Anura infrastructure) Overview ## What does Anura do? ## **What is Anura?** Anura is an ad fraud detection and traffic quality platform that analyses website visitor traffic in real time to distinguish genuine human visitors from bots, scrapers, click farms, and other invalid traffic sources. It is used by advertisers, publishers, and affiliate marketers to protect advertising spend and ensure that campaigns reach real audiences. Anura's JavaScript tag runs on every page load and performs real-time analysis of device and behavioural signals to generate a traffic quality score. ## **What data does Anura collect?** Anura collects IP addresses, browser type and version, operating system, device characteristics, screen resolution, JavaScript execution environment properties, network routing data, and behavioural signals such as mouse movement patterns and click timing. This data is analysed against Anura's fraud database to produce a real-time traffic quality score for each visitor session. ## **GDPR and legitimate interest for fraud detection** Similar to Sift, Anura's fraud detection can rely on legitimate interest under GDPR Recital 47 for the processing itself. However, the ePrivacy Directive requires consent for any cookies or device storage access. A documented balancing test must demonstrate that the fraud prevention interest overrides individual privacy interests. The balancing test is generally favourable given that invalid traffic detection benefits the individual user (by protecting them from ad fraud ecosystems) as well as the operator. ## **Consent requirements** For any cookies Anura sets, ePrivacy consent is required. For the device fingerprinting and IP analysis that does not rely on cookies, legitimate interest with a documented balancing test may suffice. Users must be informed of Anura's fraud detection processing in the privacy policy with a right to object, even if consent is not required for the non-cookie processing. ## **Data transfers outside the EU** Anura is a US company. Standard Contractual Clauses apply. Sign a DPA with Anura and document the US transfer in your RoPA. ## **Practical compliance steps** Obtain ePrivacy consent before loading the Anura tag if it sets cookies. Document your legitimate interest balancing test for IP and device analysis. Disclose Anura in your privacy policy with the right to object. Sign a DPA with Anura. Document the US transfer in your RoPA. Compliance ## Anura and the GDPR Anura is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) may apply for fraud detection and traffic quality analysis with a documented balancing test. Consent (Art. 6(1)(a)) is required for any non-essential cookies or device tracking under the ePrivacy Directive. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, CCPA ### Impact assessment (DPIA) A DPIA is advisable when Anura processes large volumes of European visitor data for automated traffic quality scoring that may result in individual users being flagged or blocked. The automated nature of fraud classification and its potential effect on users warrants formal assessment. ### Sample text for your banner > We use Anura to protect our website from fraudulent traffic and bots. Anura analyses visitor behaviour and device information to assess traffic quality. This processing is based on our legitimate interest in maintaining website integrity. Data may be transferred to the United States. You may object to this processing by contacting us. Cookies and trackers ## What Anura sets and contacts - Tracking method JavaScript tag, server-side traffic quality analysis, IP and device fingerprinting, real-time ad fraud detection - Server location United States (Anura infrastructure) - Data transferred outside the EU Anura is a US-based ad fraud detection company. All traffic analysis data is processed on US infrastructure. Transfers rely on Standard Contractual Clauses under GDPR Article 46. ### Cookies set (1) | Name | Type | Duration | Purpose | | -------- | ------- | -------- | ------------------------------------------------------------------------------------------- | | anura\_s | session | Session | Session identifier used for invalid traffic scoring when JavaScript tag integration is used | ### Third-party domains contacted (3) - `anura.io` - `script.anura.io` - `api.anura.io` Questions ## Frequently asked questions about Anura Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What data does Anura collect? Anura collects IP addresses, browser and device characteristics, request headers, referrer URLs, and behavioural signals to generate invalid traffic fraud scores. It may also set client-side cookies depending on the integration method. The primary data points are technical traffic signals rather than identifiable personal data, giving Anura a relatively low privacy risk profile. ### Does Anura require consent under GDPR? It depends on the implementation. If Anura is integrated server-side without setting cookies, consent is not required as legitimate interest covers the fraud detection processing. If the JavaScript tag sets client-side cookies, ePrivacy consent is required before the script loads for those cookies. Anura should always be disclosed in your privacy policy regardless of implementation method. ### What is the legal basis for using Anura? Legitimate interest under Article 6(1)(f) GDPR is the appropriate basis for IVT and fraud detection processing. GDPR Recital 47 specifically acknowledges fraud prevention as a legitimate interest. A documented balancing test is required, demonstrating that the interest in protecting advertising quality and detecting bot traffic outweighs the privacy impact on individual users being scored. ### Does Anura transfer data outside the EU? Yes. Anura is a US company and processes traffic analysis data on US infrastructure. Standard Contractual Clauses apply as the transfer mechanism. The data transferred is primarily technical signals (IP, device characteristics) rather than rich personal profiles, which reduces the privacy risk of the transfer relative to other US-based processors. ### Do I need a DPIA for Anura? Generally not for standard IVT detection. A DPIA becomes advisable if Anura's fraud scores are used to make automated decisions that significantly affect individual users, such as blocking access to a service or content based on a bot score, which would trigger Article 22 GDPR considerations. ### How do I implement Anura in a GDPR-compliant way? Document your legitimate interest balancing test. If using the JavaScript tag, obtain ePrivacy consent before loading the script. For server-side integration without cookies, no consent banner is needed for Anura specifically. Update your privacy policy to disclose Anura as a traffic quality processor and describe the legitimate interest basis. Sign a DPA with Anura. Document the US transfer in your RoPA. ### Are there EU-hosted alternatives to Anura for IVT detection? Pixalate offers EU data residency options for invalid traffic detection. DoubleVerify and Integral Ad Science both have EU data processing configurations. For advertisers using Google, Google's built-in IVT filtering operates through Google's EU infrastructure options. Self-hosted IP reputation databases combined with custom bot detection rules can also be deployed on EU infrastructure for full data sovereignty. ### How do I disclose Anura in my privacy policy? Add a section on traffic quality and fraud prevention. State that Anura is used to detect and filter invalid traffic and ad fraud, describe the technical signals collected (IP, device characteristics), identify legitimate interest as the legal basis, reference the documented balancing test, disclose the US transfer and SCC safeguard, and provide the right to object to this legitimate interest processing. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [DDoS-Guard](https://www.flowconsent.com/en/services/security/ddos-guard) [DDoS-Guard is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. DDoS-Guard offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, DDoS-Guard strengthens your overall security posture.](https://www.flowconsent.com/en/services/security/ddos-guard) [Essential](https://www.flowconsent.com/en/services/security/ddos-guard) · ### [ThreatMetrix](https://www.flowconsent.com/en/services/security/threatmetrix) [ThreatMetrix is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ThreatMetrix supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ThreatMetrix ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/threatmetrix) [Essential](https://www.flowconsent.com/en/services/security/threatmetrix) · ### [AWS Certificate Manager](https://www.flowconsent.com/en/services/security/aws-certificate-manager) [AWS Certificate Manager is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AWS Certificate Manager supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AWS Certificate Manager ensures your website delivers a smooth, uninterrupted experience to every visitor and.](https://www.flowconsent.com/en/services/security/aws-certificate-manager) [Security](https://www.flowconsent.com/en/services/security/aws-certificate-manager) · ### [Pulse Secure](https://www.flowconsent.com/en/services/security/pulse-secure) [Pulse Secure is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Pulse Secure integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Pulse Secure helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/pulse-secure) [Security](https://www.flowconsent.com/en/services/security/pulse-secure) · ### [Combahton FlowShield](https://www.flowconsent.com/en/services/security/combahton-flowshield) [Combahton FlowShield is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Combahton FlowShield supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Combahton FlowShield ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/combahton-flowshield) [Essential](https://www.flowconsent.com/en/services/security/combahton-flowshield) · ### [Fortinet FortiGate](https://www.flowconsent.com/en/services/security/fortinet-fortigate) [Fortinet FortiGate is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. Fortinet FortiGate offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, Fortinet FortiGate strengthens your overall security posture.](https://www.flowconsent.com/en/services/security/fortinet-fortigate) [Essential](https://www.flowconsent.com/en/services/security/fortinet-fortigate) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)