Does the Jira Service Management portal widget require visitor consent?

No. The JSM widget enables user-initiated support ticket submissions. Session and CSRF cookies are strictly necessary for the secure submission flow and are exempt from consent. The ajs_anonymous_id analytics cookie used by Atlassian internally is a nuance, but the primary widget function does not require a consent gate.

What does the Jira Service Management widget load and collect?

The widget bootstraps from jsd-widget.atlassian.com and loads inside an iframe pointing to your organization's atlassian.net portal. It sets a CSRF token, tenant session cookie, and ajs_anonymous_id (persistent Atlassian analytics ID). Form responses including name, email, issue details, and attachments are submitted to your Jira project queue.

How does ConsentStack classify Jira Service Management?

ConsentStack classifies JSM as functional and allows the widget to load without a consent gate. It appears in your ConsentStack vendor inventory so visitors can see it in your privacy notice. If your organization also uses other Atlassian tools with marketing tracking, those are evaluated separately as distinct vendors.

Jira Service Management - Support Widget Privacy

Back to Vendor Library

Overview

Jira Service Management (JSM), formerly Jira Service Desk, is Atlassian's IT service management (ITSM) and customer support platform. Organizations embed JSM portal widgets on their websites, internal help pages, and employee intranets to allow end users to submit tickets, search knowledge base articles, and track request status without navigating to the full Atlassian portal. The widget provides a self-contained support interface tightly integrated with the organization's Jira project workflows.

What This Script Does

Portal Widget Loading

Loads the JSM portal embed from <organization>.atlassian.net/servicedesk/... endpoints
Widget JavaScript is served from Atlassian's CDN at jsd-widget.atlassian.com (the Jira Service Desk widget script)
Script file: https://jsd-widget.atlassian.com/assets/... bootstraps the widget iframe

Core Functionality

Renders a support intake interface: request type selection, form field inputs, file attachment upload
Provides in-widget knowledge base search against articles published in the connected JSM project
Displays the user's open and resolved requests when authenticated
Submits ticket data directly to the organization's *.atlassian.net project queue

Cookies and Sessions

atlassian.xsrf.token — CSRF protection token, first-party (on atlassian.net), session
tenant.session.token — authenticated Atlassian account session, first-party within the iframe context, session/persistent depending on "Stay signed in" setting
ajs_user_id — Atlassian analytics identifier for logged-in users, persistent
ajs_anonymous_id — anonymous visitor identifier for Atlassian's product analytics (Amplitude), persistent, ~1 year; tracks widget interactions for Atlassian's own product improvement purposes
Form state may be preserved in sessionStorage within the widget iframe

Data Collected

Form field inputs submitted by the user (name, email, issue description, custom fields)
File attachments uploaded as part of the ticket
Session identifiers for request status tracking
Widget interaction events (opens, searches, form abandonment) sent to Atlassian's analytics pipeline

CDN and API Domains

jsd-widget.atlassian.com — widget bootstrap script
<org>.atlassian.net — ticket submission and data storage
analytics.atlassian.com — Atlassian product analytics

Consent & Compliance

Consent category: Functional

JSM portal widgets are functional support tools. Under GDPR Article 6(1)(b), processing user data to fulfill a support request is covered by contractual necessity or pre-contractual measures. Under the ePrivacy Directive, session and CSRF cookies necessary for secure ticket submission are strictly necessary and exempt from consent. The ajs_anonymous_id cookie used for Atlassian's own product analytics is more nuanced — it is set for Atlassian's benefit rather than the user's immediate need, and a strict interpretation could require consent for it. Atlassian is headquartered in Australia (with US operations) and participates in the EU-US Data Privacy Framework. Under CCPA, support ticket data is collected in a direct service interaction and does not constitute a sale of personal information.

Should You Block This Without Consent?

No. JSM widgets enable user-initiated support interactions. Their primary cookies serve session management and CSRF protection for the ticket submission flow. Blocking the widget would prevent users from accessing support functionality entirely.

Is Jira Service Management GDPR compliant?

Jira Service Management typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Jira Service Management can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Jira Service Management, not on Jira Service Management itself.

Visit website