Does Lattice require consent on third-party websites?

Lattice operates as an HR SaaS application accessed by employees directly, not as a tracking script on public websites. Any third-party presence is limited to SSO authentication redirects, which are functionally necessary and do not require opt-in consent.

What does Lattice do when embedded on external sites?

Lattice scripts on external sites are limited to SSO authentication handoffs and session management cookies strictly necessary for portal access. No behavioral tracking, analytics, or advertising occurs.

How does ConsentStack handle Lattice?

ConsentStack categorizes Lattice as functional, meaning its authentication scripts are permitted without requiring explicit user consent. No marketing or analytics consent gate is applied, as Lattice performs no tracking on public-facing pages.

What tracker domains does Lattice use?

ConsentStack has catalogued tracker domains for Lattice including lattice.com. These are the network destinations Lattice's scripts contact, which a consent platform blocks until a visitor agrees.

Lattice - People Management Privacy Controls

Back to Vendor Library

Overview

Lattice is a people management platform that provides tools for performance reviews, goal setting (OKRs), employee engagement surveys, compensation management, and career development tracking. Like other HR platforms, Lattice operates primarily as a standalone SaaS application — employees access it through Lattice's own hosted interface rather than through scripts embedded on third-party websites.

Lattice's presence on external websites is minimal. When it does appear, it is typically in the form of links directing employees to the Lattice platform or lightweight authentication handoff scripts for single sign-on integration. Website operators encountering Lattice in their third-party script audits are likely seeing it in an internal portal or intranet context rather than on a public-facing website.

What This Script Does

Lattice's interaction with third-party websites is limited and functionally scoped:

SSO authentication redirects: Scripts may facilitate single sign-on flows, redirecting authenticated employees from an internal portal to the Lattice platform with identity tokens for seamless login.
Survey access links: Employee engagement survey invitations may include links or embedded buttons that direct users to Lattice-hosted survey pages. These are typically simple redirects rather than embedded scripts.
Notification widgets: In some enterprise configurations, lightweight scripts may display notification badges or prompts (e.g., "You have a pending review") within an internal portal, fetching status data from Lattice's API.
Minimal cookie footprint: Any cookies set on third-party domains are typically limited to session management for authentication flows and do not persist beyond the immediate interaction.

Lattice does not perform behavioral tracking, analytics data collection, or advertising functions on third-party websites. Its data collection occurs within its own hosted platform where employees interact with HR tools directly.

Consent & Compliance

Lattice's scripts on third-party websites serve a narrow functional purpose — facilitating employee access to HR tools. Under GDPR, the processing of employee data within Lattice's platform is governed by the employer-employee relationship and typically relies on legitimate interest or contractual necessity as the legal basis. The client-side scripts that handle authentication redirects are functionally necessary for the service.

Cookies set for SSO session management are likely to qualify as strictly necessary under the ePrivacy Directive, as they enable a service explicitly requested by the user (accessing their HR platform). No marketing, analytics, or cross-site tracking is involved.

Employee data processed within Lattice's platform (performance reviews, survey responses, compensation data) carries significant privacy sensitivity, but this processing occurs on Lattice's own infrastructure and is governed by the data processing agreement between the employer and Lattice rather than by the website's consent management setup.

Should You Block This Without Consent?

Lattice's scripts on third-party websites serve purely functional purposes — authentication handoffs and employee access to HR tools. There is no behavioral tracking, analytics, or marketing data collection. Blocking these scripts would prevent employees from accessing their people management tools, with no privacy benefit. The scripts set only functional session cookies necessary for authentication.

No.

Is Lattice GDPR compliant?

Lattice typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Lattice can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Lattice, not on Lattice itself.

Visit website