Is consent required for Attio on my website?

Conditional. Attio tracks known B2B contacts for CRM purposes, which is functional. However, attio_visitor_id — a 1-year persistent cookie set before contact identification — technically requires ePrivacy consent. A best-practice implementation defers the Attio script until functional consent is granted.

What data does Attio collect?

Attio sets attio_visitor_id (1-year persistent anonymous identifier) and attio_session (session cookie). It records page URLs, referrer, user-agent, and IP address on each visit. When identify() is called with a contact's email, all subsequent page visits are linked to that CRM contact record in Attio.

How does ConsentStack manage Attio consent?

ConsentStack classifies Attio as functional. The tracking script and identify() call are deferred until the visitor grants functional consent. This ensures the persistent attio_visitor_id cookie is not set before opt-in, keeping the implementation compliant with ePrivacy while preserving CRM contact tracking for known visitors.

What tracker domains does Attio use?

ConsentStack has catalogued tracker domains for Attio including attio.com. These are the network destinations Attio's scripts contact, which a consent platform blocks until a visitor agrees.

Attio (app.attio.com) - CRM Data Collection & Privacy Compliance

Back to Vendor Library

Overview

Attio is a modern CRM platform designed for relationship-driven B2B teams. It emphasizes automatic data enrichment, real-time contact and company records synced from communication channels, and highly flexible workspace customization. Unlike legacy CRM tools, Attio is built around a structured data model that allows teams to define custom objects, attributes, and relationship graphs. Its website tracking script connects web behavior to CRM contact records.

What This Script Does

Attio Website Tracking Script

When enabled, Attio's tracking snippet loads a JavaScript library from Attio's CDN and begins monitoring page visits for identified contacts. The script is primarily used to track when known contacts (typically identified via email from form submissions or CRM integrations) return to the website and visit specific pages.

Contact Identification

The tracking script can be initialized with an identify() call passing a contact's email address. Once identified, all subsequent page visits in that browser session are linked to the CRM contact record. This enables Attio users to see a contact's web activity timeline directly within the CRM.

Cookies Set

attio_visitor_id — First-party persistent cookie. Stores an anonymous visitor identifier before identification occurs. Duration: 1 year.
attio_session — First-party session cookie. Stores the current session ID for grouping page visit events. Duration: session.

Domains Contacted

app.attio.com — Hosts the tracking library and receives all event beacons via its REST API.
cdn.attio.com — CDN serving the tracking JavaScript library.

Data Collected Per Interaction

Page URL and page title for every page visit
Browser referrer URL at session start
User-agent string and browser language
IP address at connection time
Contact email address when identify() is called
Custom event names and properties when track() is called programmatically

Consent & Compliance

GDPR / ePrivacy: Attio's website tracking script sets a persistent first-party cookie and transmits page visit data linked to individual email addresses to Attio's US-based infrastructure. This constitutes personal data processing for CRM profiling purposes. Under GDPR Article 6, this requires a lawful basis. For identified contacts, this can be justified under legitimate interest for B2B relationship management, but the persistent cookie set before identification requires ePrivacy consent. The contact identification call should only fire after the user has provided their email and was informed of this tracking.

CCPA / CPRA: Attio collects personal information (email linked to browsing history) on behalf of the merchant operating as a service provider. When used purely for the merchant's CRM, this does not constitute a sale. The merchant must disclose Attio as a service provider in their privacy policy.

EU-US Data Privacy Framework: Attio is a US-based company. EU organizations using Attio should confirm Standard Contractual Clauses are in place via Attio's DPA.

Consent Category: Functional (CRM contact tracking). No advertising or third-party data sharing.

Should You Block This Without Consent?

No. Attio's tracking script is used for internal CRM purposes — connecting a known B2B contact's web visits to their CRM record. It does not perform advertising profiling or share data with third parties. The persistent visitor cookie, however, is set before identification and requires ePrivacy consent under a strict reading. A best-practice implementation defers the attio.js load or the identify call until the user has accepted functional cookies, or relies entirely on server-side event tracking where available.

Is Attio GDPR compliant?

Attio typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Attio can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Attio, not on Attio itself.

Visit website