Braze

Overview

Braze is a customer engagement and marketing automation platform used by mobile-first companies to orchestrate cross-channel messaging across push notifications, email, SMS, in-app messages, and in-browser messaging. Its web SDK instruments user behavior on websites to power segmentation, personalization, and automated campaign delivery.

What This Script Does

SDK Initialization and Identity The Braze Web SDK loads from js.appboycdn.com (Braze's CDN) or from a first-party domain configured by the operator. On initialization, the SDK:

• Assigns an anonymous device identifier stored in localStorage (ab.device_id) to identify the browser before a user logs in
• Contacts sdk.iad-01.braze.com (or regional endpoint) to register the device and sync the user profile
• Receives configuration and feature flags from Braze's servers

Event Tracking and Behavioral Data Collection The SDK instruments user behavior and sends events to Braze's servers for segmentation and campaign triggering:

• Page view events: URL, referrer, timestamp
• Custom events: any events the developer fires using braze.logCustomEvent() — e.g., "product_viewed", "checkout_started", "video_played"
• Purchase events: product ID, price, currency, quantity — logged via braze.logPurchase()
• User attribute updates: name, email, phone, gender, date of birth, custom attributes — set via braze.getUser().setEmail() etc.
• Session start and session end events with session duration

In-App Messaging and Content Cards When an in-app message or Content Card campaign is triggered:

• Braze's servers push message content (text, image URL, CTA URL) to the SDK
• The SDK renders the message in the browser (modal, slideup, or fullscreen overlay)
• Impression and click events are sent back to Braze for campaign analytics

Push Notification Management The web SDK can request browser push notification permission and register a service worker for Web Push:

• The service worker registers with the browser's push notification service (FCM for Chrome, APNS web push for Safari)
• A push subscription token is stored in Braze's user profile
• Push notification opt-in/out events are logged as user attributes
• Contacts sdk.iad-01.braze.com to transmit push subscription tokens

Connected Content and Personalization Braze can trigger real-time API calls to the operator's backend at message send time to personalize content, but this is a server-side feature with no direct client-side privacy impact.

Cookies and Storage:

• ab.storage.deviceId.{app_id} (localStorage, persistent) — unique device identifier
• ab.storage.userId.{app_id} (localStorage, persistent) — authenticated user ID once logged in
• ab.storage.sessionId.{app_id} (localStorage, 30 minutes) — session identifier
• ab.storage.messagingSessionStart.{app_id} (sessionStorage, session) — messaging session start
• ab.optOut (localStorage, persistent) — opt-out flag for users who have opted out of Braze tracking

Domains contacted: js.appboycdn.com, sdk.iad-01.braze.com (US cluster), sdk.fra-01.braze.eu (EU cluster), push.api.iad-01.braze.com

Data collected per session: Device ID, session ID, page URL, referrer, custom events with properties, purchase events with revenue data, user attributes (when set by the developer), push subscription status, in-app message impressions and clicks.

Consent & Compliance

GDPR/ePrivacy: Braze performs behavioral profiling for marketing automation — collecting user events, building audience segments, and triggering targeted messaging campaigns. This requires explicit opt-in consent under GDPR Article 7. The persistent device and user identifiers stored in localStorage constitute the setting of non-essential tracking storage under ePrivacy, requiring consent. Push notification permission is a separate consent signal collected via the browser's native permission prompt, but GDPR consent for data processing must be obtained separately before the SDK fires events. Braze offers an EU data residency option (sdk.fra-01.braze.eu) for operators requiring data to remain within the EU.

CCPA/CPRA: Braze's behavioral data collection for marketing segmentation and campaign targeting constitutes personal information. Braze processes data as a service provider under CCPA. Sites must disclose Braze in their privacy policy and honor opt-out requests.

EU-US Data Transfers: Braze Inc. participates in the EU-US Data Privacy Framework (DPF) and offers Standard Contractual Clauses. The EU cluster (fra-01.braze.eu) provides an alternative for operators requiring in-EU processing.

IAB TCF: Braze is a registered IAB TCF vendor (Vendor ID 32). Purposes declared include 1 (store/access information), 3 (create personalized ad profile), 4 (select personalized ads), and 8 (measure content performance).

Consent category: Marketing (behavioral profiling and campaign automation) and Analytics (event tracking and engagement measurement).

Should You Block This Without Consent?

Yes. The Braze Web SDK tracks user behavior for marketing automation and campaign targeting from the moment it initializes. Block the SDK entirely until marketing consent is granted. Once consent is obtained, initialize the SDK and call braze.changeUser() to associate the authenticated user identity. Push notification opt-in should be requested after marketing consent is established, as a separate permission flow.