Does a Calendly booking widget require visitor consent to load?

Conditionally. If Calendly loads only when a visitor actively initiates the scheduling flow, session cookies are strictly necessary and no consent is required. If embedded on every page load with persistent analytics cookies firing automatically, functional consent should be obtained before the script loads.

What data does the Calendly script collect from visitors?

Calendly collects the visitor's name, email, selected time slot, timezone, and any custom form responses. It also captures UTM parameters from the referring URL and browser metadata including IP address and user agent, all transmitted to Calendly's US servers. A session cookie maintains booking wizard state.

How does ConsentStack handle Calendly embeds?

ConsentStack classifies Calendly as functional. When embedded as a click-triggered widget, ConsentStack allows it to load without a consent gate. If Calendly is configured to load on every page, ConsentStack can hold the script until functional consent is confirmed, then release it automatically.

What tracker domains does Calendly use?

ConsentStack has catalogued tracker domains for Calendly including assets.calendly.com and calendly.com. These are the network destinations Calendly's scripts contact, which a consent platform blocks until a visitor agrees.

Calendly - Scheduling Widget Privacy & Consent Info

Back to Vendor Library

Overview

Calendly is a scheduling automation platform that eliminates back-and-forth emails when arranging meetings. Businesses and individuals embed Calendly widgets on their websites, enabling visitors to book calls and appointments directly by selecting an available time slot. The platform syncs with calendar providers (Google Calendar, Outlook, Apple Calendar, Office 365) and integrates with CRMs, video conferencing tools, and marketing automation platforms.

What This Script Does

Calendly is loaded either as an inline embed or a pop-up widget via JavaScript from assets.calendly.com. The script performs the following operations:

Session and Booking Flow

Renders an interactive calendar interface showing available time slots in real time by fetching availability from Calendly's API
Collects visitor inputs: full name, email address, and any custom questions defined by the host
Submits booking data to calendly.com API endpoints to create the appointment
Syncs the new event to the host's connected calendar and triggers confirmation emails to both parties

Cookies and Identifiers

__calendly_session — session cookie, first-party context within the embed iframe, expires at session end; maintains booking wizard state
_ga, _gid — if Calendly uses Google Analytics internally, these may be set within the widget iframe; third-party, 2 years / 24 hours
UTM parameter capture: Calendly reads UTM parameters from the referring page URL and stores them alongside booking records for source attribution
Referrer data is sent to Calendly servers as part of the booking payload

Script Files and CDN

Primary loader: https://assets.calendly.com/assets/external/widget.js
API calls: https://calendly.com/api/booking/...
Font and asset delivery: Calendly CDN subdomains

Data Transmitted

Visitor IP address (to Calendly servers in the US)
Browser user agent and referrer URL
Meeting type selected, scheduled time, and timezone
Form field responses submitted by the visitor

Consent & Compliance

Consent category: Functional

Calendly processes data necessary to fulfill a meeting booking explicitly initiated by the visitor. Under GDPR Article 6(1)(b), processing name and email to complete a booking request is covered by the performance of a pre-contractual measure. Under the ePrivacy Directive, session cookies that maintain the booking wizard state are strictly necessary for the user-initiated service and exempt from consent. However, Calendly's servers are located in the United States — data transfers require an appropriate transfer mechanism (EU-US Data Privacy Framework, SCCs). Calendly is certified under the EU-US DPF. Under CCPA, the booking data is collected in a direct commercial interaction and does not constitute a sale of personal information.

Should You Block This Without Consent?

Conditional. If Calendly loads only when a visitor actively initiates the scheduling flow (click-triggered), and sets no persistent tracking cookies beyond session management, it can load without consent as a functional service. If embedded on every page load with analytics cookies or conversion tracking for the host's marketing stack, block until functional or analytics consent is granted.

Is Calendly GDPR compliant?

Calendly typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Calendly can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Calendly, not on Calendly itself.

Visit website