PandaDoc

Overview

PandaDoc streamlines the document workflow from creation through signing, offering templates, content libraries, and real-time collaboration features. The platform competes with DocuSign and Adobe Sign but differentiates through its proposal and quote-building capabilities, which are particularly popular with sales teams. When embedded on a website, PandaDoc enables recipients to review, comment on, and electronically sign documents without leaving the page.

What This Script Does

PandaDoc's client-side scripts embed interactive document viewers and signing interfaces on web pages. The scripts are loaded from public-api.pandadoc.com and related CDN domains.

Document Viewer

The embedded viewer renders the full document within an iframe, allowing recipients to scroll through pages, zoom, and review content. The viewer supports various document formats including proposals, contracts, quotes, and forms.

Electronic Signature Flow

When a document requires signatures, the script presents signature fields at the appropriate locations. Recipients can draw, type, or upload their signature. The signing process includes:

• Identity verification steps (email confirmation, SMS codes if configured)
• Field validation ensuring all required fields are completed
• Timestamp and IP address logging for audit trail purposes

Tracking and Analytics

PandaDoc tracks document engagement metrics:

• Document open events (when and from what device)
• Time spent on each page or section
• Completion status (viewed, partially completed, fully signed)

Cookies Set

• pd_session — session cookie maintaining the viewer/signing session state
• pd_visitor — identifies the document recipient across sessions if they return to complete signing later

The scripts communicate with PandaDoc's API servers. Data collected is limited to document interaction events and signer identity verification information. PandaDoc does not perform cross-site tracking or set advertising cookies.

Consent & Compliance

PandaDoc is classified as functional. Its scripts provide document viewing and electronic signature capabilities that serve a clear functional purpose requested by the user (reviewing or signing a document). The document engagement tracking (open events, time per page) provides operational value to the document sender but is not strictly necessary for the signing function itself.

Under GDPR, the session cookie for maintaining signing state is likely exempt as strictly necessary when the user is actively engaging with a document. The visitor tracking cookie and engagement analytics require a legitimate interest assessment or consent, depending on implementation context.

Under the ePrivacy Directive, cookies essential to the document signing service the user has requested are exempt. Analytics-oriented cookies tracking viewing behavior may require consent depending on how prominently the signing flow is integrated.

Under CCPA/CPRA, PandaDoc processes data as a service provider to the document sender. The data collected (viewing events, signatures) serves the business purpose of document management and is not sold or shared for advertising.

Should You Block This Without Consent?

No. PandaDoc scripts serve a functional purpose — enabling document review and electronic signatures. Blocking them would prevent recipients from viewing or signing documents. The engagement tracking is ancillary to the core signing functionality and does not constitute marketing activity.