Datadog

Overview

Datadog is an observability and monitoring platform used by engineering and operations teams to monitor cloud infrastructure, application performance, and logs. Its Browser SDK adds Real User Monitoring (RUM) and session replay capabilities to frontend applications, enabling teams to diagnose production issues with full user session context.

What This Script Does

The Datadog Browser SDK is loaded as a JavaScript snippet or npm module and instruments the frontend application to capture performance telemetry and error data.

Script Files and Domains

• browser-sdk/datadog-rum.js or datadog-rum-slim.js — Loaded from www.datadoghq-browser-agent.com or bundled into the application. Typically ~50–100KB minified.
• API endpoint: browser-intake.datadoghq.com (US) or browser-intake.datadoghq.eu (EU) — Receives all telemetry payloads via fetch or XMLHttpRequest.

Cookies and Storage

• _dd_s — First-party session cookie set on the host website's domain. Contains a session ID, creation time, and expiry timestamp. Default expiry: 15 minutes of inactivity, maximum 4 hours. Used to group RUM events into a single user session.
• _dd_l — Deprecated in newer SDK versions; legacy session linkage cookie.
• No third-party cookies. All cookies are set as first-party on the host domain.

Data Collected Per Page Load

• Page URL, referrer, and navigation timing (Time to First Byte, DOM Content Loaded, Load Event)
• Resource loading waterfall: URLs, response codes, transfer sizes, and timing for all XHR/fetch calls, images, scripts, and stylesheets
• Long task timings (tasks blocking the main thread >50ms)
• Core Web Vitals: Largest Contentful Paint (LCP), First Input Delay (FID), Cumulative Layout Shift (CLS)

Data Collected Per Interaction

• JavaScript errors: error message, stack trace, file, line/column number
• User actions: clicks (element text, class, position), navigation events
• XHR/Fetch calls: URL, method, status code, duration (response body is NOT captured)
• Browser metadata: user agent, viewport dimensions, connection type
• User ID (if configured via setUser() API — this is optional and set by the site operator)

Session Replay (if enabled) When Session Replay is activated, the SDK captures DOM mutations as snapshots using a MutationObserver. Input masking is applied by default to password fields and can be configured for other sensitive elements. Replay data is transmitted separately from RUM events to session-replay.browser-intake.datadoghq.com.

Consent & Compliance

Consent category: Essential

• GDPR/ePrivacy: Datadog RUM collects technical telemetry (performance metrics, errors, resource loading) for operational purposes. This falls under legitimate interest for maintaining service quality and diagnosing production incidents. The _dd_s session cookie is a first-party cookie used for operational monitoring. Under ePrivacy, session cookies used for technical monitoring may qualify for the strictly necessary exemption, though DPA guidance varies. Session Replay requires separate consent as it captures detailed user interactions.
• CCPA/CPRA: Datadog processes telemetry data as a service provider. No sale or sharing of personal information occurs. IP addresses are processed for routing but not retained for analytics in default configurations.
• EU-US transfers: Datadog offers an EU region (datadoghq.eu) with data residency in Frankfurt, enabling GDPR-compliant processing without cross-border transfer concerns. Datadog participates in the EU-US Data Privacy Framework.

Should You Block This Without Consent?

No. Datadog RUM is operational monitoring infrastructure used by engineering teams to detect and diagnose production issues. It does not track users for marketing purposes. Blocking it would impair your team's ability to monitor site reliability. However, if Session Replay is enabled, that feature should be gated behind analytics consent due to its detailed interaction recording.