Do I need consent to use Qualtrics on my website?

Yes. The Qualtrics Site Intercept script continuously monitors visitor behavior and sets cookies to track intercept display state, even when no survey is shown. This constitutes non-essential tracking under the ePrivacy Directive, requiring analytics consent before the script loads. Block the intercept script until consent is granted.

What cookies does Qualtrics set?

Qualtrics sets QSI_* cookies (various expiries, one per configured intercept) to track whether a visitor has seen specific surveys. It also sets Q_CMP to record visitor consent state. The intercept script loads from siteintercept.qualtrics.com and monitors page URLs, time on page, and scroll depth to evaluate trigger conditions.

How does ConsentStack manage Qualtrics consent?

ConsentStack classifies Qualtrics as analytics and blocks the Site Intercept script until analytics consent is granted. It is detected via siteintercept.qualtrics.com script loads. Once consent is given, ConsentStack unblocks the intercept script, allowing behavioral triggers and survey widgets to fire normally on eligible pages.

What tracker domains does Qualtrics use?

ConsentStack has catalogued tracker domains for Qualtrics including survey.qualtrics.com. These are the network destinations Qualtrics's scripts contact, which a consent platform blocks until a visitor agrees.

Qualtrics - Survey Widget Privacy Controls

Back to Vendor Library

Overview

Qualtrics is an enterprise experience management (XM) platform owned by Silver Lake and the Canada Pension Plan Investment Board (formerly a SAP subsidiary). It enables organizations to collect structured feedback through surveys, Net Promoter Score (NPS) measurements, and on-site intercepts. The platform's web-facing components deploy survey widgets and behavioral triggers on websites to capture customer, employee, and user experience data at key interaction points.

What This Script Does

Qualtrics deploys an intercept script and survey engine on websites to trigger feedback collection at configured moments.

Scripts loaded: The Qualtrics Site Intercept script loads from siteintercept.qualtrics.com (or a custom-branded domain). This script monitors visitor behavior against configured trigger conditions and launches survey widgets when conditions are met.
Intercept triggers: The script evaluates visitor behavior in real time — page URL patterns, time on page, scroll depth, click events, exit intent — to determine when to display a survey invitation. This monitoring occurs continuously while the script is loaded.
Survey delivery: When triggered, the survey widget renders as an embedded panel, popup, or slide-in within the page, loading the survey instrument from Qualtrics' servers.
Cookies set:
- QSI_* cookies — First-party cookies (various expiries). Track whether a visitor has been shown a specific intercept, preventing repeated prompts. Each configured intercept generates its own QSI_ cookie.
- Q_CMP — First-party cookie. Records the visitor's cookie consent state for Qualtrics.
- Session and visitor identifiers link survey responses to the browsing session.
Data collected: Survey response data, page URL and referrer at the time of intercept, visitor session identifiers, browser and device information, and any behavioral data that triggered the survey display
Embedded data: Qualtrics intercepts can pass contextual data from the webpage (product IDs, user account status, page categories) into the survey response as embedded data fields.

Consent & Compliance

Qualtrics falls under the analytics consent category.

Under GDPR and ePrivacy, the Qualtrics Site Intercept script requires consent because it sets cookies (QSI_*) to track visitor behavior and intercept display state, and it continuously monitors browsing behavior to evaluate trigger conditions. This constitutes storage of non-essential information on the user's device under the ePrivacy Directive. Survey responses collected through intercepts contain personal data that requires a GDPR-compliant legal basis. Qualtrics provides granular cookie consent configuration and supports integration with third-party consent management platforms.

Under CCPA/CPRA, survey responses, behavioral trigger data, and visitor identifiers constitute personal information. Organizations must disclose the data collection in their privacy policies. If survey data is combined with other datasets for profiling, this may require additional CCPA disclosures.

Qualtrics offers data residency options in the EU, US, and other regions.

Should You Block This Without Consent?

Yes. The Qualtrics intercept script continuously monitors visitor behavior and sets cookies to track intercept display state, even when no survey is shown. Block the intercept script until analytics consent is granted. If surveys are delivered through direct links (rather than on-page intercepts), those do not require the intercept script and can function independently of website consent.

Is Qualtrics GDPR compliant?

Qualtrics typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Qualtrics can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Qualtrics, not on Qualtrics itself.

Visit website