Does GetResponse require consent before its scripts load on a website?

Yes. GetResponse's tracking script sets a two-year gr_unique_id visitor identifier and builds behavioral profiles from the first page load. This constitutes marketing data collection requiring explicit prior opt-in under GDPR. All GetResponse scripts must be blocked until the visitor actively accepts marketing cookies.

What cookies does GetResponse set and what behavior does it track?

GetResponse sets gr_unique_id (two-year visitor identifier), gr_cid (one-year contact identifier), a session cookie, and form suppression cookies. The script records every page view, UTM parameters, scroll depth, and exit intent signals. For identified contacts, it links all browsing to their GetResponse contact profile.

How does ConsentStack handle GetResponse in a consent management setup?

ConsentStack classifies GetResponse as marketing and blocks both tracking and form scripts by default. Forms cannot submit data without the script, so the entire integration is gated behind marketing consent. ConsentStack activates all GetResponse scripts only after the visitor explicitly opts in, ensuring full GDPR compliance.

What tracker domains does GetResponse use?

ConsentStack has catalogued tracker domains for GetResponse including app.getresponse.com. These are the network destinations GetResponse's scripts contact, which a consent platform blocks until a visitor agrees.

GetResponse - Email Marketing Consent & Automation Data

Back to Vendor Library

Overview

GetResponse is a comprehensive email marketing and marketing automation platform founded in 1998 and headquartered in Gdansk, Poland. It is one of the longest-established email service providers and has grown to serve over 350,000 customers across 183 countries. GetResponse provides email campaign management, autoresponders, automated marketing workflows, conversion funnels, webinar hosting, live chat, and push notification capabilities. On websites, GetResponse appears through its embeddable signup form widgets and site tracking script that captures form conversions and visitor behaviour for marketing automation workflows.

What This Script Does

GetResponse scripts load from app.getresponse.com and ga.getresponse.com (the tracking domain). They render signup form widgets and activate the site tracking layer that monitors visitor behaviour for automation triggers.

Cookies and identifiers set:

gr_unique_id — Primary visitor identifier; first-party cookie set on the host domain; used to track anonymous visitors across sessions and, when a visitor submits a form, to link their browsing history to their GetResponse contact record; expiry 2 years.
gr_cid — Contact identifier set when a visitor is identified (form submission or email click-through); links the browser to the GetResponse contact record for personalised automation; expiry 1 year.
gr_session — Session cookie managing the current visit context for automation rule evaluation; expires at session end.
gr_form_<id> — Form display suppression cookie preventing repeated prompts to visitors who have already subscribed or dismissed a specific form; expiry 30 days.

Script filenames and CDN: webform.js loaded from app.getresponse.com/site/loader.js. Site tracking beacon loaded from ga.getresponse.com/script/track.js. Form submissions POST to app.getresponse.com/api/v3/contacts. Tracking events route to ga.getresponse.com/t/.

Per-session data collected:

Page views with full URL, title, and referrer for every page the visitor loads
UTM campaign parameters and traffic source attribution
Form submission events: email address, name, and any custom form fields
Scroll depth and time-on-page metrics used for automation timing rules
Exit intent signals (mouse movement toward browser chrome) for popup triggers
Email click-through attribution: visitors arriving via GetResponse campaign links are identified immediately on landing
E-commerce events (purchase, cart add/remove) when the e-commerce tracking module is enabled

Automation capabilities: The site tracking script evaluates GetResponse automation workflow conditions in real time on each page load — determining whether to trigger email sequences, update contact tags, fire retargeting pixels, or adjust lead scores based on behavioural patterns. These evaluations use the persistent gr_unique_id cookie to build a longitudinal visitor profile.

Consent & Compliance

GetResponse is classified under the marketing category. The site tracking script, persistent visitor identification, contact identification on form submission, and behavioural automation triggers all constitute marketing data processing under GDPR Article 6(1)(a). The gr_unique_id and gr_cid persistent cookies require explicit prior opt-in consent under the ePrivacy Directive. As a Polish company, GetResponse operates under EU jurisdiction and UODO (Polish data protection authority) oversight — making it subject to strict GDPR enforcement. Under CCPA/CPRA, linking browsing behaviour to contact records and using that data for targeted email marketing constitutes processing of personal information for commercial purposes that must be disclosed with opt-out rights. GetResponse maintains GDPR-compliant DPAs and stores EU customer data on EU-based infrastructure.

Should You Block This Without Consent?

Yes. GetResponse site tracking scripts set persistent cookies, build longitudinal visitor profiles, and trigger marketing automation from the first page load. Block all GetResponse tracking and form scripts until the user grants marketing consent. A static HTML form without the GetResponse script cannot submit data to the platform — the script is required for form functionality, so the entire integration should be gated behind consent.

Is GetResponse GDPR compliant?

GetResponse typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So GetResponse can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads GetResponse, not on GetResponse itself.

Visit website