Does a SurveyMonkey embed require visitor consent?

Conditionally. For optional market research or NPS surveys, consent is needed before loading the script. For surveys essential to the service such as required onboarding flows, a functional basis may apply. If survey responses are piped into a CRM for marketing purposes, marketing consent is required regardless of the survey's purpose.

What data does SurveyMonkey collect from respondents?

SurveyMonkey collects all survey responses including free-text answers and demographic fields. It sets sm_uuid (persistent respondent ID to prevent duplicate responses) and ep201/ep202 session tracking cookies. Metadata including completion time, device type, IP address, and per-page timing is captured and stored on SurveyMonkey's servers.

How does ConsentStack handle SurveyMonkey widgets?

ConsentStack classifies SurveyMonkey as functional and analytics. For optional feedback surveys, it gates the script until analytics consent is granted. For essential service surveys, you can configure ConsentStack to allow the widget under functional consent without requiring analytics opt-in, keeping experience frictionless for required flows.

What tracker domains does SurveyMonkey use?

ConsentStack has catalogued tracker domains for SurveyMonkey including widget.surveymonkey.com. These are the network destinations SurveyMonkey's scripts contact, which a consent platform blocks until a visitor agrees.

SurveyMonkey - Survey Widget Consent & Data Privacy

Back to Vendor Library

Overview

SurveyMonkey (rebranded Momentive) is one of the world's largest online survey and feedback platforms, serving businesses, researchers, HR teams, and marketers. Websites embed SurveyMonkey to collect structured feedback through inline widgets, pop-up invitations, or redirects to hosted survey pages. Use cases range from Net Promoter Score (NPS) surveys and product feedback forms to academic research and market research panels.

What This Script Does

Survey Delivery and Interaction

Embeds inline survey widgets or pop-up/slide-in survey invitations triggered by scroll depth, time on page, or exit intent
Loads survey configuration and question data from surveymonkey.com or smwidget.com API endpoints
Handles branching logic, required field validation, and multi-page survey navigation
Submits completed responses to SurveyMonkey's data collection infrastructure
Redirects to hosted survey pages at surveymonkey.com for longer-form surveys

Script Files and CDN

Embed loader: https://widget.surveymonkey.com/collect/website/js/... for pop-up widgets
Inline embed: code snippet that loads from surveymonkey.com or the custom domain smwidget.com
Response submission: https://api.surveymonkey.com/v3/collectors/...

Cookies Set

sm_uuid — persistent respondent identifier, first-party (on surveymonkey.com), used to prevent duplicate responses and track partial completions; duration varies (session to 1 year)
ep201 / ep202 — SurveyMonkey session and tracking cookies set within the embed context
smToken — authentication token if the respondent is a logged-in SurveyMonkey user
Duplicate-prevention cookies: short-lived identifiers that mark a survey as completed to prevent re-presentation

Data Collected

Survey responses, including any personal data included in free-text answers, demographic questions, or contact fields
Partial response data (if the respondent abandons mid-survey) stored against the respondent identifier
Metadata: completion time, page-by-page timing, device type, browser, IP address
If targeting rules are configured: page scroll depth, time on site, or other behavioral triggers that initiated the survey

Integrations

SurveyMonkey integrates with Salesforce, HubSpot, Mailchimp, and other platforms — responses can be piped into CRM systems, creating contact records from survey respondents
If integrated with a CRM, survey data becomes part of a broader marketing profile

Consent & Compliance

Consent category: Functional / Analytics

SurveyMonkey's consent classification depends on the survey's purpose. Under GDPR, responses containing personal data require a lawful basis — consent (Article 6(1)(a)) for optional feedback surveys, or legitimate interest (Article 6(1)(f)) for operational service improvement surveys. The ePrivacy Directive requires consent for duplicate-prevention and tracking cookies. Under CCPA, survey respondents' data (including email addresses and demographic information) constitutes personal information subject to disclosure and opt-out rights. If survey data is piped into a CRM for marketing purposes, it triggers stricter CCPA/CPRA obligations regarding use for advertising.

Should You Block This Without Consent?

Conditional. If surveys are essential to the service (e.g., required onboarding feedback or compliance-mandated assessments), they may be treated as functional. For optional market research, NPS, or marketing audience surveys, the script should be gated behind analytics or functional consent. The data collection scope — particularly when integrated with CRM platforms — can be substantial.

Is SurveyMonkey GDPR compliant?

SurveyMonkey typically loads functional and analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So SurveyMonkey can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads SurveyMonkey, not on SurveyMonkey itself.

Visit website