Flagsmith - Feature Flag Privacy Management

Overview

Flagsmith offers both cloud-hosted and self-hosted feature flag management, making it suitable for teams requiring data sovereignty. The platform supports user segmentation, multivariate flags, and remote configuration changes that take effect without application redeployments. Its open-source nature allows full inspection of client-side SDK behavior and data transmission patterns.

What This Script Does

Flagsmith's JavaScript SDK loads from cdn.flagsmith.com or a self-hosted endpoint. On initialization, the SDK makes an API request to the Flagsmith server with an environment key and optional user identity to retrieve feature flag states and remote configuration values applicable to the current session.

The SDK stores flag state in localStorage under keys prefixed with BULLET_TRAIN_DB or flagsmith_db for caching between page loads. This reduces API calls and provides fallback values when the network is unavailable. No persistent cookies are set by default.

When user identity is provided (typically a hashed user ID or anonymous identifier), the SDK transmits this to Flagsmith's API alongside flag evaluation requests. This enables percentage-based rollouts and user-segment targeting. Analytics events—such as flag evaluation counts—may be sent to Flagsmith's servers if the analytics feature is enabled.

Network requests go to api.flagsmith.com (cloud) or the configured self-hosted endpoint. Requests include the environment key, user identity (if set), and trait data used for segmentation rules.

Consent & Compliance

Flagsmith operates as a functional tool under GDPR and ePrivacy classifications. Feature flags control application behavior and are integral to the user experience being delivered. The localStorage caching serves a technical purpose (performance optimization) rather than tracking.

Under the ePrivacy Directive, storage used for delivering a service explicitly requested by the user is exempt from consent requirements. Feature flag state caching meets this exemption criterion. However, if Flagsmith's analytics feature is enabled to track flag evaluation metrics, this analytics layer introduces a secondary purpose that may require separate assessment.

GDPR considerations center on the user identity data transmitted to Flagsmith's servers. If pseudonymous identifiers are used, the processing falls under legitimate interest for service delivery. Self-hosted deployments eliminate third-party data transfer concerns entirely.

Should You Block This Without Consent?

No.

Flagsmith's core feature flag functionality is integral to delivering the intended user experience. Blocking it would break feature gating, A/B test assignments, and dynamic configuration. The SDK uses localStorage for caching rather than tracking cookies, and standard deployments qualify for the ePrivacy strictly-necessary exemption.

Visit website

Consent Categories

Functional

Also Known As

flagsmithfeature flagsfeature togglesflagsmith open sourceremote configfeature flag serviceflagsmith SDK

Industries

Programming and Developer SoftwareComputers Electronics and Technology

Tracked Domains (1)

flagsmith.comFunctional

Frequently Asked Questions

Does Flagsmith require cookie consent?

Conditional. Flagsmith is classified as functional — it controls application behavior through feature flags rather than tracking users. The ePrivacy Directive exempts storage used to deliver a service explicitly requested by the user, so consent is generally not required for core feature flag delivery.

What does Flagsmith store in the browser?

Flagsmith caches feature flag states in localStorage to reduce latency on subsequent page loads. It may store a device or session identifier to ensure consistent flag assignment. No advertising or behavioral tracking cookies are set. Data stays within the application's own domain context.

How does ConsentStack categorize Flagsmith?

ConsentStack classifies Flagsmith as functional. Its scripts are not blocked by default since feature flag delivery is integral to application functionality. If the visitor denies functional consent, ConsentStack can block the Flagsmith script, which may degrade the application experience.