JotForm

Overview

JotForm is a web-based form builder with over 20 million users worldwide, used to create contact forms, surveys, order forms, registration pages, and payment collection forms. It embeds forms on host websites as iframes or inline widgets, with all submission data stored and managed within JotForm's platform.

What This Script Does

JotForm's client-side presence consists of an embed snippet (a short JavaScript block or iframe tag) that loads the full form UI from JotForm's servers.

Script Files and CDN Domains

• form.jotform.com — Primary form rendering domain serving the form HTML, JavaScript, and CSS
• cdn.jotfor.ms — CDN domain (note alternate spelling) delivering form assets including images, JavaScript libraries, and widget files
• submit.jotform.com — Endpoint receiving form submission POST requests
• The embed snippet itself is typically a few lines of JavaScript or a direct <iframe> pointing to a unique form URL

Cookies Set

• JFBLT_* — Form session token cookies set on the jotform.com domain within the iframe context. Short-lived (session-scoped), used to prevent duplicate submissions and maintain form state between multi-step form pages.
• _ga, _gid — Google Analytics cookies may be set within JotForm's iframe if JotForm has its own GA configuration. Persists 2 years / 24 hours respectively.
• No persistent first-party tracking cookies are set on the host website's domain.

Data Collected Per Submission

• All user-entered form field values (name, email, phone, address, custom fields)
• File uploads (stored in JotForm's cloud storage)
• IP address and user-agent (captured server-side at submission)
• Submission timestamp and form session metadata

Integrations and Data Forwarding JotForm supports 100+ native integrations. On submission, data can be automatically forwarded to HubSpot, Salesforce, Mailchimp, Google Sheets, Slack, Zapier, and payment processors (Stripe, PayPal, Square). Each integration represents an additional downstream data processor.

Multi-Step and Conditional Logic Multi-page forms maintain state via the form session token across page navigations within the iframe. Conditional logic (showing/hiding fields) executes entirely client-side within the JotForm iframe.

Consent & Compliance

Consent category: Functional

• GDPR: JotForm acts as a data processor under GDPR. A Data Processing Agreement (DPA) is required — JotForm provides a standard DPA. Form submissions containing personal data require a lawful basis (typically contract performance or legitimate interest for contact forms, explicit consent for lead generation). The form itself does not require a consent banner, but the data collected through it must be disclosed in the site's privacy policy.
• ePrivacy: Cookies set within the JotForm iframe are scoped to jotform.com, not the host site domain. Under strict ePrivacy interpretation, third-party iframe cookies require consent. Functional session cookies for multi-step form state may qualify for exemption if strictly necessary for the form to operate.
• CCPA/CPRA: Form submissions are provided directly by the user and do not constitute a sale of personal information. However, data forwarded to third-party integrations (HubSpot, Salesforce, etc.) must be disclosed.
• EU-US Data Privacy Framework: JotForm is a US company. Data transfers rely on SCCs; verify current DPF participation status.

Should You Block This Without Consent?

No. JotForm serves a functional purpose initiated directly by the user. Contact forms, support request forms, and registration forms are user-initiated interactions that do not require prior consent to load. The cookies set are for form session management, not cross-site tracking. Ensure JotForm is listed as a data processor in your privacy policy and that a DPA is in place.