Does Salesforce.com require cookie consent?

Conditionally. Pardot tracking and Marketing Cloud personalization scripts require marketing consent before loading. Live Agent chat cookies may qualify as functional when a visitor actively initiates a conversation. Essential CRM infrastructure and Web-to-Lead form submissions do not require separate pre-consent.

What cookies does Salesforce.com set?

Pardot sets visitor_id (first-party, 2 years) and pi_opt_in (2 years). Live Agent sets liveagent_sid and liveagent_vc session cookies. Interaction Studio sets first-party session and visitor cookies. Scripts contact pi.pardot.com, cdn.evgnet.com, webto.salesforce.com, and salesforceliveagent.com domains.

How does ConsentStack handle Salesforce.com?

ConsentStack evaluates Salesforce.com components separately by function. Marketing and analytics scripts such as Pardot tracking and Interaction Studio are blocked until consent is granted. ConsentStack may allow Live Agent session cookies under functional consent and does not block Web-to-Lead form submissions, which are user-initiated actions.

What tracker domains does Salesforce.com use?

ConsentStack has catalogued tracker domains for Salesforce.com including krxd.net, cquotient.com and site.com, among 68 in total. These are the network destinations Salesforce.com's scripts contact, which a consent platform blocks until a visitor agrees.

Salesforce.com - CRM Tracking & Consent Classification

Back to Vendor Library

Overview

Salesforce.com provides an enterprise CRM platform with a broad ecosystem of marketing and analytics tools including Marketing Cloud, Pardot (Account Engagement), Sales Cloud Web-to-Lead, Einstein Analytics, and Interaction Studio (Personalization). On-site scripts handle behavioral tracking, lead attribution, form capture, personalization delivery, and live chat. The specific consent implications depend heavily on which Salesforce products are deployed.

What This Script Does

Pardot / Account Engagement Tracking Pardot's tracking code loads from pi.pardot.com (or a custom domain on advanced plans) and fires on every page of sites connected to a Pardot instance. It:

Sets the visitor_id cookie (first-party or third-party depending on domain configuration, 2 years) to identify visitors across sessions
Sets pi_opt_in (first-party, 2 years) — consent flag for Pardot tracking
Records page views, form interactions, and file downloads against prospect records in the Pardot CRM
Triggers lead scoring rule updates in real time based on page visit activity
Fires marketing automation workflows when a known prospect visits key pages (e.g., pricing page, case study)
Contacts pi.pardot.com for event logging and pd.pardot.com for data synchronization

Salesforce Marketing Cloud (ExactTarget) Marketing Cloud deploys tracking pixels and behavioral analytics through the Marketing Cloud Personalization (Interaction Studio) product. Scripts load from cdn.evgnet.com or {client}.evergage.com (legacy) and collect:

Visitor identity resolution — matching anonymous web visitors to known CRM contacts via email hash or first-party cookie
Behavioral segment membership — pages visited, products viewed, content consumed
Real-time personalization decisions — which content blocks, banners, or recommendations to show
A/B test assignments for campaign experiments

Web-to-Lead Forms Standard Salesforce Web-to-Lead forms submit directly to webto.salesforce.com. These forms collect contact information (name, email, company, phone) and create Lead records in Salesforce CRM. No tracking cookies are set by the form submission itself, but the referrer and UTM parameters captured at submission time are recorded for attribution.

Einstein Analytics / Tableau CRM JavaScript embeds for Einstein Analytics dashboards load from {instance}.salesforce.com or analytics.salesforce.com. These are typically internal business intelligence tools embedded in authenticated portals rather than public web pages.

Salesforce Live Agent / Chat The Live Agent chat widget loads from {instance}.salesforceliveagent.com. It:

Sets session cookies to persist the chat conversation across page navigations
Collects visitor name and email when provided through the pre-chat form
Sends chat transcripts and visitor data to the Salesforce Service Cloud instance

Cookies set:

visitor_id{account} (first-party, 2 years) — Pardot visitor identifier
pi_opt_in (first-party, 2 years) — Pardot consent flag
Interaction Studio: first-party session and visitor cookies, duration varies by client configuration
Live Agent: liveagent_sid (session), liveagent_vc (session)

Domains contacted: pi.pardot.com, pd.pardot.com, cdn.evgnet.com, {client}.evergage.com, webto.salesforce.com, {instance}.salesforceliveagent.com

Consent & Compliance

GDPR/ePrivacy: Pardot's behavioral tracking and lead scoring constitute personal data processing for marketing automation purposes, requiring explicit opt-in consent under GDPR Article 7. The visitor_id cookie is non-essential and requires consent before placement under ePrivacy. Marketing Cloud Interaction Studio's visitor profiling and personalization require consent. Live Agent session cookies used to maintain an in-progress conversation requested by the user may qualify as functional. Web-to-Lead form submissions are based on the user's explicit action (consent by conduct).

CCPA/CPRA: Pardot behavioral tracking and Marketing Cloud personalization data collection constitute personal information collection. Salesforce acts as a service provider under CCPA when processing data under a data processing agreement. Sites must disclose Pardot and Marketing Cloud tracking in their privacy policy.

EU-US Data Transfers: Salesforce Inc. participates in the EU-US Data Privacy Framework (DPF) and offers Standard Contractual Clauses and Binding Corporate Rules.

IAB TCF: Pardot and Marketing Cloud marketing tools map to IAB TCF Purposes 1, 2, 3, 4, and 5.

Consent category: Marketing (Pardot, Marketing Cloud tracking), Analytics (behavioral analytics), Functional (Live Agent chat, Web-to-Lead forms).

Should You Block This Without Consent?

Conditional. Pardot tracking codes and Marketing Cloud personalization scripts must be blocked until marketing consent is granted. Einstein Analytics embeds in authenticated portals generally do not require public-facing consent. Live Agent chat widgets serving visitor support needs may load under a functional consent basis, provided the chat session data is not fed into marketing automation workflows. Web-to-Lead form submissions are user-initiated and do not require pre-consent.

Is Salesforce.com GDPR compliant?

Salesforce.com typically loads marketing, analytics and functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Salesforce.com can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Salesforce.com, not on Salesforce.com itself.

Visit website

Products (6)

Salesforce CRM Analytics

Salesforce CRM Analytics is a business intelligence and data visualization platform embedded within the Salesforce ecosystem. Scripts on customer-facing pages collect behavioral events and funnel data into Salesforce for reporting and AI-driven insights. No independent tracking cookies are set beyond the core Salesforce platform session.

Salesforce Data Cloud

Salesforce Data Cloud is Salesforce's customer data platform for unifying first-party data across touchpoints. Website scripts capture real-time behavioral signals and identity events, contributing to unified customer profiles used for personalization, segmentation, and cross-channel marketing automation workflows.

Salesforce Experience Cloud

Salesforce Experience Cloud is a digital experience platform for building branded portals, communities, and customer-facing websites. When detected, it indicates the site runs on Salesforce's application framework. Platform scripts handle user authentication, content rendering, and CRM data integration. Sets session cookies for authenticated user state management.

Salesforce Interaction Studio

Salesforce Interaction Studio (now Marketing Cloud Personalization) is a real-time personalization engine. Scripts monitor visitor behavior across page sessions — tracking clicks, page sequences, and product views — to serve dynamically personalized content and product recommendations based on individual behavioral profiles.

Salesforce Marketing Cloud

Salesforce Marketing Cloud is an enterprise marketing automation platform that tracks website visitors for campaign attribution and personalization. Scripts capture page views, click events, and form submissions to build customer profiles and trigger automated marketing journeys. Sets cookies for cross-session visitor identification and email campaign attribution.

Salesforce Service Cloud

Salesforce Service Cloud is a customer service and support platform that integrates with websites through embedded chat widgets and case management forms. Scripts load live agent chat interfaces, knowledge base lookups, and support ticket submission flows. Sets session cookies to maintain customer identity and conversation context across support interactions.

Consent Categories

Marketing Analytics Functional

Also Known As

Salesforce Marketing CloudPardotSalesforce trackingEinstein AnalyticsSalesforce beacon

Industries

Computers Electronics and TechnologyProgramming and Developer Software

Tracked Domains (68)

Salesforce.com's trackers are occasionally seen, seen on under 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

krxd.netMarketing

krxd.net is a marketing domain operated by Salesforce.com, used to serve ads, build audiences, and measure ad conversions. Seen on under 1% of scanned sites.

cquotient.comAnalytics

cquotient.com is an analytics domain operated by Salesforce.com, used to measure visits, sessions, and on-site behavior. Seen on under 1% of scanned sites.

site.comEssential

site.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

igodigital.comMarketing

igodigital.com is a marketing domain operated by Salesforce.com, used to serve ads, build audiences, and measure ad conversions. Seen on under 1% of scanned sites.

pardot.comMarketing

pardot.com is a marketing domain operated by Salesforce.com, used to serve ads, build audiences, and measure ad conversions. Seen on under 1% of scanned sites.

salesforceliveagent.comFunctional

salesforceliveagent.com is a functional domain operated by Salesforce.com, used to run site features like chat, video, embeds, and preferences. Seen on under 1% of scanned sites.

force.comEssential

force.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

saasler-impact.herokuapp.comEssential

saasler-impact.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

calc-backend-prod.herokuapp.comEssential

calc-backend-prod.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

essential-apps-analytics.herokuapp.comEssential

essential-apps-analytics.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

design-packs.herokuapp.comEssential

design-packs.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gdpr-mm-geolocation.herokuapp.comEssential

gdpr-mm-geolocation.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

deliverytimer.herokuapp.comEssential

deliverytimer.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

tnc-app.herokuapp.comEssential

tnc-app.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

obscure-escarpment-2240.herokuapp.comEssential

obscure-escarpment-2240.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

servicify-appointments.herokuapp.comEssential

servicify-appointments.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

xapps-geo-ca956fdeab0c.herokuapp.comEssential

xapps-geo-ca956fdeab0c.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

poboxblocker.herokuapp.comEssential

poboxblocker.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

error-reporter-163cf957cedf.herokuapp.comEssential

error-reporter-163cf957cedf.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

cstt-app.herokuapp.comEssential

cstt-app.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gcb-app.herokuapp.comEssential

gcb-app.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

cart-discount.herokuapp.comEssential

cart-discount.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

sellup.herokuapp.comEssential

sellup.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

quantity-breaks-now.herokuapp.comEssential

quantity-breaks-now.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

design-packs-v2-f486db037e95.herokuapp.comEssential

design-packs-v2-f486db037e95.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

superbump.herokuapp.comEssential

superbump.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

session-recording-now.herokuapp.comEssential

session-recording-now.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

pfp-app.herokuapp.comEssential

pfp-app.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

wholesale-pricing-now.herokuapp.comEssential

wholesale-pricing-now.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

live-visitor-counts.herokuapp.comEssential

live-visitor-counts.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

consent-insights-3c23a978f31a.herokuapp.comEssential

consent-insights-3c23a978f31a.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

accessibility-spark.herokuapp.comEssential

accessibility-spark.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

xgen-product-recommendations-c1d79539c721.herokuapp.comEssential

xgen-product-recommendations-c1d79539c721.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

eedition-server.herokuapp.comEssential

eedition-server.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

faqs-plus.herokuapp.comEssential

faqs-plus.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gow-media-server.herokuapp.comEssential

gow-media-server.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

knock2-backend-2ba4792164c3.herokuapp.comEssential

knock2-backend-2ba4792164c3.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

shopify-gift-with-purchase-b91cd9320ca5.herokuapp.comEssential

shopify-gift-with-purchase-b91cd9320ca5.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

referralfetch.herokuapp.comEssential

referralfetch.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

vuhaus-api-production.herokuapp.comEssential

vuhaus-api-production.herokuapp.com is an essential domain operated by Salesforce.com, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

+ 28 more tracked domains, shown by how common they are across scanned sites.

Cookies Salesforce.com Sets (5)

cqcid

Salesforce Commerce Cloud (CQuotient) anonymous shopper identifier.

cquid

Salesforce Commerce Cloud (CQuotient) authenticated shopper identifier.

visitor_id*

Pardot (Account Engagement) prospect identifier. The cookie name is visitor_id<accountID> with no separator; the suffix encodes the Pardot business unit so multi-account sites get one cookie per Pardot tenant.

liveagent_oref

Salesforce Live Agent referrer state for an active chat session.

liveagent_sid

Salesforce Live Agent chat session identifier.