Does ActiveCampaign require cookie consent?

Yes. ActiveCampaign's site tracking script sets persistent first-party cookies tied to individual email identities and sends browsing history to a US-based CRM. This is marketing profiling requiring explicit opt-in consent under GDPR/ePrivacy before trackcmp.js loads.

What cookies does ActiveCampaign set?

ActiveCampaign sets ac_enable_tracking (opt-in status, 1 year), account-prefixed contact_id and hash cookies for visitor identification (1 year each), and trackcmp_email (session, captures form email). All are first-party cookies on your domain.

How does ConsentStack handle ActiveCampaign?

ConsentStack detects ActiveCampaign's trackcmp.js from trackcmp.net and classifies it as marketing. The script is blocked by default until the visitor grants marketing consent, preventing contact identification and CRM profiling before opt-in.

What tracker domains does ActiveCampaign use?

ConsentStack has catalogued tracker domains for ActiveCampaign including trackcmp.net. These are the network destinations ActiveCampaign's scripts contact, which a consent platform blocks until a visitor agrees.

ActiveCampaign (trackcmp.net) - CRM Tracking Cookies & Consent Info

Back to Vendor Library

Overview

ActiveCampaign is a CRM and marketing automation platform popular with small and mid-size businesses. It combines email marketing, sales automation, and customer experience tools into a single platform. Website owners embed ActiveCampaign's site tracking script to connect real-time web behavior to individual CRM contact records, enabling personalized follow-up sequences and lead scoring.

What This Script Does

Site Tracking Script

The primary script is loaded as an inline snippet that asynchronously fetches trackcmp.js from trackcmp.net. This script fingerprints each browser session and links it to a known CRM contact when an email link is clicked or a form is submitted.

Cookies Set

ac_enable_tracking — First-party persistent cookie. Stores the user's opt-in status for site tracking. Duration: 1 year.
%ACCOUNT_ID%_contact_id — First-party persistent cookie. Stores an encrypted contact identifier for recognized visitors. Duration: 1 year.
%ACCOUNT_ID%_hash — First-party persistent cookie. HMAC hash used to verify the contact identifier has not been tampered with. Duration: 1 year.
trackcmp_email — First-party session cookie. Temporarily stores the email address captured from a form submission before it is sent to the ActiveCampaign API. Duration: session.

Domains Contacted

trackcmp.net — Hosts the trackcmp.js tracking library and receives all event beacons.
*.api-us1.com — ActiveCampaign's primary REST API endpoint for contact updates and event recording.

Data Collected Per Interaction

Full URL and page title of every page visited
Referrer URL on initial session entry
Browser user-agent string and screen resolution
IP address (used for geolocation enrichment in the CRM)
Form field values when an ActiveCampaign-hosted form is submitted (name, email, phone)
Custom event names and properties when vgo('event', ...) is called
Session start and end timestamps
Contact score updates triggered by reaching specific pages

Automation Triggers

When a recognized contact visits a page tagged in an ActiveCampaign automation, the visit event is sent in real time to the ac_track endpoint. This fires email sends, updates deal stages, and reassigns lead ownership without any further user action.

Consent & Compliance

GDPR / ePrivacy: The site tracking script places persistent cookies and sends personal data (email, page history, IP) to ActiveCampaign's US-based infrastructure. Under GDPR Article 6, this requires a lawful basis. Because the purpose is marketing profiling rather than service delivery, legitimate interest is difficult to justify — explicit opt-in consent is the appropriate basis. Under the ePrivacy Directive, consent is required before setting the tracking cookies.

CCPA / CPRA: ActiveCampaign collects personal information (email linked to browsing history) that constitutes a sale or sharing of data under CPRA if disclosed to third parties for cross-context behavioral advertising. Site operators must provide a "Do Not Sell or Share" mechanism for California residents.

EU-US Data Privacy Framework: ActiveCampaign participates in the EU-US Data Privacy Framework (DPF), providing a transfer mechanism for EU personal data processed on US servers.

Consent Category: Marketing / Analytics. IAB TCF purposes: Purpose 1 (Store and/or access information on a device), Purpose 3 (Create a personalised ads profile), Purpose 4 (Select personalised ads), Purpose 7 (Measure ad performance).

Should You Block This Without Consent?

Yes. ActiveCampaign's site tracking script sets persistent first-party cookies linked to individual email identities and transmits browsing history to a third-party CRM. This is marketing profiling and requires prior consent under both GDPR/ePrivacy and CCPA/CPRA. Do not load trackcmp.js until the user has actively accepted marketing cookies.

Is ActiveCampaign GDPR compliant?

ActiveCampaign typically loads marketing and analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So ActiveCampaign can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads ActiveCampaign, not on ActiveCampaign itself.

Visit website