Is consent required for Smartsheet on my website?

No. Smartsheet embeds forms via iframe to collect structured user submissions. Cookies are scoped within the iframe to the smartsheet.com domain and do not affect the host site. No tracking or advertising components are present.

What does Smartsheet track?

Smartsheet only collects data explicitly submitted through its embedded forms — names, emails, and other configured fields. The iframe sandboxing prevents any host-domain cookies. No behavioral analytics or visitor identification occurs.

How does ConsentStack handle Smartsheet?

ConsentStack classifies Smartsheet as functional and does not block it by default. The iframe-based embed has no tracking footprint on the host domain. ConsentStack allows Smartsheet forms to load without requiring prior visitor consent.

What tracker domains does Smartsheet use?

ConsentStack has catalogued tracker domains for Smartsheet including smartsheet.com. These are the network destinations Smartsheet's scripts contact, which a consent platform blocks until a visitor agrees.

Smartsheet - Embedded Form Consent Profile

Back to Vendor Library

Overview

Smartsheet is a cloud-based work management platform used for project planning, task tracking, and collaborative workflows. When detected on websites, Smartsheet appears through embedded web forms that collect structured data from visitors for intake workflows, registrations, or feedback. The forms feed submissions directly into Smartsheet grids (spreadsheet-like workspaces), automating data capture for business processes managed within the platform.

What This Script Does

Smartsheet embeds forms on websites via iframes from Smartsheet's servers.

Forms: Smartsheet forms load via iframe from app.smartsheet.com/b/form/, rendering input fields configured by the form creator — text fields, dropdowns, date pickers, file attachments, and conditional sections that show or hide based on previous answers
Form submission: When a visitor completes the form, all field values are transmitted to Smartsheet's servers and written as a new row in the designated Smartsheet grid. The form can trigger automated workflows (notifications, approvals, status updates) within Smartsheet.
Scripts loaded: The iframe loads Smartsheet's application JavaScript for form rendering, validation, and submission handling
Cookies set: Minimal session cookies within the iframe on the smartsheet.com domain for form state and CSRF protection. These do not affect the host domain due to iframe sandboxing.
Data collected: Form field values submitted by the visitor (names, emails, phone numbers, custom data). The form does not collect browser fingerprint data, track page views, or monitor visitor behavior on the host page.
No behavioral tracking: Smartsheet forms are purely data collection mechanisms with no analytics, tracking pixels, or visitor identification beyond the form submission itself.

Consent & Compliance

Smartsheet forms fall under the functional consent category.

Under GDPR and ePrivacy, embedded Smartsheet forms serve a functional purpose — collecting structured data that visitors explicitly submit. The iframe-based delivery isolates any cookies from the host domain. The ePrivacy Directive's requirements focus on the form's cookies being scoped within the iframe (third-party cookie context). Personal data collected through form fields requires a GDPR-compliant legal basis, typically the visitor's explicit action of submitting the form.

Under CCPA/CPRA, form submission data constitutes personal information. The host site should disclose Smartsheet as a data processor.

Smartsheet offers data processing agreements and SOC 2 Type II certification.

Should You Block This Without Consent?

No. Smartsheet forms are functional data collection tools with no tracking or advertising components. Visitors explicitly interact with and submit the form. The iframe-based embed isolates cookies from the host domain. Blocking would remove the form functionality, preventing visitors from submitting the data the website is designed to collect.

Is Smartsheet GDPR compliant?

Smartsheet typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Smartsheet can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Smartsheet, not on Smartsheet itself.

Visit website