> How the CopyPoison content protection script relates to the GDPR and ePrivacy: it sets no cookies, tracks no users and runs in the visitor's browser. > > Canonical: https://www.flowconsent.com/en/services/security/copypoison Security # CopyPoison Essential · [Official website](https://copypoison.com/) Content protection and anti scraping tool that poisons copied text in the browser. It sets no cookies and tracks nothing; the only privacy point is the IP exposure if the script is loaded from the vendor domain rather than self hosted. [Block CopyPoison until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 0 - Third-party domains 1 - Servers Self hosted with the site assets, or loaded from the vendor domain (copypoison.com). Exact hosting and any CDN edge location depend on how the script is delivered. Overview ## What does CopyPoison do? CopyPoison is a content protection and anti scraping tool aimed at discouraging the wholesale copying of website text. According to the available information, it works in the browser: when a visitor copies a longer passage, the script substitutes many letters with visually identical lookalike characters from other alphabets, so the pasted text looks the same to a human but is hard to reuse or index by machines. ## **What CopyPoison does** The tool is described as activating only on a copy event and poisoning only passages above a length threshold, leaving short snippets and code untouched. It runs as client side JavaScript and is offered for direct embedding or as a content management plugin. As a protective feature it processes the page text, not the visitor. ## **Cookies and tracking** From the available information, CopyPoison sets no cookies and stores no identifiers; the poisoning logic does not need to recognise individual visitors. As a cookieless functional feature it does not by itself create a consent banner obligation under the ePrivacy Directive. As always, confirm the exact behaviour of the version you deploy. ## **The delivery question** If the CopyPoison script is loaded from the vendor domain rather than self hosted, that request exposes the visitor IP and user agent to the vendor, in the same way any third party asset does. The vendor server location is not always published. Self hosting the script keeps the request first party and removes this exposure. ## **Legal basis and risk** Protecting your own content is a clear legitimate interest, and because the feature is cookieless and processes no visitor identifiers, the risk is low. If you load the script from the vendor, document that legitimate interest to cover the IP disclosure, or simply self host to keep things straightforward. ## **Recommendation** Self host the CopyPoison script from your own domain so no visitor IP reaches a third party, and verify in your own testing that the deployed version sets no cookies. Be aware that aggressive text poisoning can affect accessibility tools and legitimate copying, so balance protection against usability. Compliance ## CopyPoison and the GDPR - Legal basis Legitimate Interest - Risk level low - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) Based on the available information, CopyPoison runs entirely in the browser, sets no cookies and processes no identifiers, so a DPIA is not normally triggered. The only data point worth noting is that, if the script is loaded from the vendor domain rather than self hosted, the request discloses the visitor IP and user agent to the vendor. Because vendor hosting details for this kind of small tool are not always published, the prudent approach is to self host the script and document that no personal data is processed by the feature itself. ### Sample text for your banner > This site uses a content protection feature that modifies text you copy from longer passages. It runs in your browser, sets no cookies and does not identify or track you. Where the underlying script is loaded from the provider, that provider may see your IP address as part of the standard request. Cookies and trackers ## What CopyPoison sets and contacts - Tracking method No tracking and no cookies by design. CopyPoison is a client side script that activates on a copy event and replaces longer copied passages with visually identical lookalike characters from other alphabets, so copied text is hard to reuse or index. It identifies no users and stores no identifiers. If the script is loaded from the vendor domain rather than self hosted, that request exposes the visitor IP and user agent to the vendor. - Server location Self hosted with the site assets, or loaded from the vendor domain (copypoison.com). Exact hosting and any CDN edge location depend on how the script is delivered. - Cookieless mode available Yes - Data transferred outside the EU CopyPoison transfers no data itself; the poisoning runs entirely in the browser. If the script file is loaded from the vendor domain instead of being self hosted, that request reveals the visitor IP and user agent to the vendor, whose server location is not always disclosed and may sit outside the EEA. Self hosting the script removes this exposure. ### Third-party domains contacted (1) - `copypoison.com` Questions ## Frequently asked questions about CopyPoison Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does CopyPoison set cookies? Based on the available information, no. CopyPoison runs in the browser to modify copied text and does not need cookies or stored identifiers to do so. Always confirm the behaviour of the exact version you deploy. ### Is consent required to use CopyPoison? No prior consent is needed for the protection feature itself, since it is cookieless and processes no visitor identifiers. It does not on its own trigger an ePrivacy consent banner requirement. ### What is the legal basis for CopyPoison? Legitimate interest in protecting your own content against scraping and unauthorised reuse. If you load the script from the vendor domain, document that legitimate interest to cover the visitor IP disclosed by the request. ### Does CopyPoison transfer data outside the EEA? The feature itself transfers nothing; it runs in the browser. If the script is loaded from the vendor domain rather than self hosted, the visitor IP and user agent reach the vendor, whose server location is not always published and could be outside the EEA. Self hosting removes this. ### Is a DPIA needed for CopyPoison? No. A cookieless, client side content protection feature that processes no visitor identifiers does not meet the threshold for a DPIA. At most, note the script delivery source in your records. ### How do I use CopyPoison compliantly? Self host the script from your own domain so no visitor IP reaches a third party, test that the deployed version sets no cookies, and tune the poisoning so it does not break accessibility tools or legitimate short quotations. ### What are the alternatives to CopyPoison? Other content protection approaches include disabling right click or text selection via CSS and JavaScript, server side rate limiting and bot detection, and adding visible attribution or watermarks. None of these need cookies when self hosted. ### How should I update my privacy policy for CopyPoison? If self hosted and cookieless, you can simply note that a content protection feature is used and that it sets no cookies and does not track visitors. If you load the script from the vendor, mention that the vendor may receive your IP address. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [ip-api](https://www.flowconsent.com/en/services/security/ip-api) [ip-api is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. ip-api supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, ip-api helps create unified digital ecosystems that drive efficiency.](https://www.flowconsent.com/en/services/security/ip-api) [Essential](https://www.flowconsent.com/en/services/security/ip-api) · ### [Entrust](https://www.flowconsent.com/en/services/security/entrust) [Entrust is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Entrust supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Entrust ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/entrust) [Security](https://www.flowconsent.com/en/services/security/entrust) · ### [Akismet](https://www.flowconsent.com/en/services/security/akismet) [Akismet is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Akismet supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Akismet enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/akismet) [Essential](https://www.flowconsent.com/en/services/security/akismet) · ### [Very Good Security](https://www.flowconsent.com/en/services/security/very-good-security) [Very Good Security is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. Very Good Security offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, Very Good Security strengthens your overall security posture.](https://www.flowconsent.com/en/services/security/very-good-security) [Essential](https://www.flowconsent.com/en/services/security/very-good-security) · ### [Venly](https://www.flowconsent.com/en/services/security/venly) [Venly is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Venly is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Venly offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/security/venly) [Essential](https://www.flowconsent.com/en/services/security/venly) · ### [Anubis](https://www.flowconsent.com/en/services/security/anubis) [Anubis is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Anubis supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Anubis ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/anubis) [Essential](https://www.flowconsent.com/en/services/security/anubis) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)