Is consent required for Atatus on my website?

Yes, under GDPR. Atatus collects real user monitoring data including page load timings, JavaScript errors, and user session metrics associated with individual browser sessions. This analytics processing of personal data such as IP addresses and device identifiers requires consent before the monitoring agent loads.

What does Atatus track on my website?

Atatus loads a monitoring agent from cdn.atatus.com that captures JavaScript exceptions with stack traces via window.onerror. It measures page load timing via the Navigation Timing API, tracks AJAX request durations, and records browser, OS, and viewport dimensions. Session identifiers link error events to individual user sessions.

How does ConsentStack detect Atatus?

ConsentStack identifies Atatus through its cdn.atatus.com script domain and classifies it as an analytics vendor. Without consent, ConsentStack prevents the Atatus monitoring agent from loading, blocking error tracking and RUM data collection. When analytics consent is granted, the agent initializes and begins performance monitoring normally.

What tracker domains does Atatus use?

ConsentStack has catalogued tracker domains for Atatus including atatus.com. These are the network destinations Atatus's scripts contact, which a consent platform blocks until a visitor agrees.

Atatus - Performance Monitoring Privacy

Back to Vendor Library

Overview

Atatus is an application performance monitoring (APM) and real user monitoring (RUM) platform aimed at engineering and DevOps teams. It provides frontend error tracking, page load performance metrics, and user session insight to help developers identify and resolve production issues. Atatus competes with Sentry, Datadog RUM, and New Relic Browser in the frontend observability space. Its scripts run on the websites of companies that have integrated Atatus for production monitoring purposes.

What This Script Does

Atatus loads a lightweight monitoring agent from its CDN, typically via a script tag pointing to cdn.atatus.com.

Error tracking:

Attaches global error handlers (window.onerror, unhandledrejection) to capture uncaught JavaScript exceptions
Records the error message, stack trace, file name, and line number
Captures the browser, OS, and viewport dimensions at the time of the error

Real user monitoring:

Measures page load timing using the Navigation Timing API — including DNS resolution, TCP connection, TTFB, DOM interactive, and fully loaded timestamps
Tracks AJAX and fetch request durations and error rates via XMLHttpRequest and Fetch API instrumentation
Records Core Web Vitals (LCP, FID/INP, CLS) where browser APIs are available

Session tracking:

Assigns a session identifier to correlate multiple events within a user's visit
May capture page URL sequences to reconstruct user paths through the application
Session identifiers are typically stored in sessionStorage and do not persist beyond the browser tab

Data transmission:

All collected metrics and error payloads are sent to api.atatus.com endpoints. Payloads include page URL, session ID, browser metadata, and the specific performance or error data.

Consent & Compliance

GDPR and ePrivacy Directive: Atatus collects technical performance data tied to individual browser sessions. While IP address (processed server-side on receipt) and session identifiers constitute personal data under GDPR, the processing purpose is legitimate operational interest — identifying software defects and performance regressions. Under GDPR, legitimate interests (Article 6(1)(f)) may provide a lawful basis for RUM and error monitoring data collection. The ePrivacy Directive's cookie requirements may apply if Atatus uses persistent storage rather than sessionStorage for its identifiers, but most RUM implementations use non-persistent session tracking.

CCPA/CPRA: Error and performance data shared with Atatus constitutes disclosure of personal information to a service provider. This is permissible under CCPA with a Data Processing Agreement. The data is not used for advertising purposes and would not constitute a "sale."

Consent category: analytics — Atatus collects behavioral and technical data about user sessions for the site operator's internal engineering purposes.

Should You Block This Without Consent?

Yes.

Although Atatus serves an operational rather than advertising purpose, it collects session-level behavioral data (page paths, interaction timing, error context) and transmits it to a third-party server. Under a strict interpretation of GDPR and the ePrivacy Directive, analytics tools that collect personal data require consent unless a legitimate interest assessment supports the processing. Site operators who rely on Atatus for production error monitoring should conduct an LIA and consider whether functional exemptions apply, but as a default, blocking Atatus without consent is the conservative and compliant approach.

Is Atatus GDPR compliant?

Atatus typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Atatus can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Atatus, not on Atatus itself.

Visit website