Medallia

Overview

Medallia is an enterprise customer experience (CX) and feedback management platform used by large organizations to capture, analyze, and act on customer sentiment across digital and physical touchpoints. Its Digital Experience product combines two capabilities on web properties: a behavioral session analytics engine that captures interaction data to identify friction and drop-off points, and a triggered feedback mechanism (digital intercepts or micro-surveys) that solicits real-time ratings and comments from visitors.

What This Script Does

The Medallia Digital Experience script is typically embedded as an async tag in the page head or footer, loaded from Medallia-hosted domains (cdn.medallia.com, nebula.medallia.com, or customer-specific subdomains like [customer].medallia.com).

Cookies Set by Medallia:

• MDigitalID — persistent visitor identifier, first-party or third-party depending on deployment, typically 365 days; assigns a UUID to each browser for cross-session behavioral analytics and survey deduplication; this is the primary tracking identifier
• MDigitalSession — session-scoped companion cookie; groups page events within a single visit for session analytics
• MDigitalSurveyShown_[formid] — persistent cookie, 30–180 days; records that the current browser has been shown or completed a specific survey intercept; prevents re-displaying the same intercept excessively
• MDigitalSampling — sampling decision cookie, session-scoped; records whether this session has been selected for session recording or survey triggering based on configured sampling rates

Session Analytics Data Collected:

• Page views: URL, page title, time on page, entry/exit pages
• Click events: element type, position, text content of clicked elements
• Scroll depth per page section
• Rage clicks (repeated rapid clicks indicating frustration)
• Form interactions: field focus/blur, validation errors encountered, submission success/failure
• JavaScript errors occurring on the page
• Performance metrics: page load time, time-to-interactive

Feedback/Intercept Data Collected:

• Triggered survey responses: numerical ratings (NPS, CSAT, CES), star ratings, and open-text comments
• Survey metadata: which intercept was shown, when it appeared, whether the visitor dismissed or completed it
• Optional identity fields if the survey includes an email or name question

Network Requests:

• Behavioral events batched and sent via POST to nebula.medallia.com/a/[account]/ endpoints at regular intervals and on page unload
• Survey delivery requests to [account].medallia.com/wpm/ for intercept configuration
• Survey response submissions POSTed to Medallia's feedback ingestion API

Medallia, Inc. is a US company (acquired by Thoma Bravo, 2021). GDPR DPA available. EU data residency option available for enterprise contracts. Medallia participates in the EU-US Data Privacy Framework.

Consent & Compliance

Medallia spans analytics and functional categories. The session analytics component — persistent visitor identification, click/scroll tracking, form interaction monitoring — constitutes behavioral analytics requiring explicit consent under GDPR Article 6(1)(a) and Article 5(3) ePrivacy Directive. The survey/feedback component is functionally closer to a user-initiated interaction after the intercept is triggered, but the survey triggering logic and deduplication cookies still require consent because they depend on the persistent MDigitalID. Under CCPA/CPRA, the behavioral session data constitutes personal information and its collection and use for CX analytics must be disclosed.

Should You Block This Without Consent?

Yes. The Medallia session analytics component uses a persistent 365-day visitor identifier and tracks detailed behavioral patterns across sessions. Since the session analytics and survey scripts are typically bundled in a single tag, block the entire Medallia script until analytics consent is granted.