Typeform

Overview

Typeform is an interactive form and survey platform that uses a conversational, one-question-at-a-time format to increase completion rates. It is widely used for lead generation forms, customer satisfaction surveys, product feedback collection, and event registrations, with native integrations to HubSpot, Salesforce, Slack, and Google Sheets.

What This Script Does

Typeform can be embedded in three modes: full-page (redirecting to typeform.com), iframe embed, or via the Typeform JavaScript Embed SDK which injects the form as an inline widget, popup, slider, or popover.

Script Files and Domains

• embed.typeform.com/next/embed.js — The Typeform Embed SDK. Approximately 40–80KB minified. Handles widget rendering, form state, and communication between the host page and the Typeform iframe.
• form.typeform.com — The form iframe origin delivering the form UI and question logic.
• api.typeform.com — Backend API receiving responses and returning conditional logic decisions for complex forms.
• images.typeform.com — CDN delivering media assets embedded in forms (background images, logos).

Cookies Set

• __cf_bm — Cloudflare Bot Management cookie set on typeform.com domains. Expires in 30 minutes. Used for bot mitigation, not user tracking.
• _hjid — Hotjar cookie may appear if Typeform has Hotjar enabled on its own form pages. Persists 1 year.
• Form session state is maintained via localStorage within the iframe context to allow users to resume partially completed forms across page reloads.
• No persistent first-party tracking cookies are set on the host website's domain by the embed.

Data Collected Per Interaction

• All question responses (text, multiple-choice selections, ratings, file uploads)
• Question-level metrics: time spent per question, response edits, back-navigation events
• Form-level metrics: start time, completion time, drop-off question (where user abandoned)
• Hidden fields: the embed SDK supports passing URL parameters (UTM values, user IDs) as hidden fields, which are stored alongside the response
• Browser metadata and IP address (captured server-side at submission)

Third-Party Integrations on Submission Typeform's native integrations forward response data automatically: HubSpot (create/update contacts), Salesforce (create leads), Mailchimp (add subscribers), Google Sheets (append rows), Slack (post notifications), and Zapier/Make for custom workflows. Each integration is a downstream data processor.

Analytics Features The Typeform analytics dashboard shows drop-off rates, completion rates, and response trends. No cross-site tracking of users outside the Typeform context is performed.

Consent & Compliance

Consent category: Functional

• GDPR: Typeform acts as a data processor under GDPR. A Data Processing Agreement is available and required. Form responses containing personal data require a lawful basis — typically contract performance (contact forms), legitimate interest (feedback surveys), or explicit consent (marketing lead generation). The embed itself does not require a consent banner, but the data collected must be disclosed in the site's privacy policy, especially if responses are forwarded to HubSpot, Salesforce, or other marketing platforms.
• ePrivacy: The Typeform embed uses localStorage (not cookies) for form state on the host site. The Cloudflare __cf_bm cookie is a security cookie. Under strict ePrivacy interpretation, loading a third-party iframe always requires disclosure, but functional form embeds are generally accepted without prior consent when they serve a user-initiated purpose.
• CCPA/CPRA: Form responses are voluntarily provided by users and do not constitute a sale. Hidden field UTM tracking should be disclosed. Downstream integrations (Salesforce, Marketo) represent data sharing that must be disclosed.
• EU-US Data Privacy Framework: Typeform is incorporated in Spain (EU company), so primary processing is within the EU. US-based integrations (HubSpot, Salesforce) require SCCs or DPF reliance.

Should You Block This Without Consent?

No. Typeform embeds serve a functional purpose initiated by the user interacting with the form. They do not perform cross-site tracking, advertising attribution, or behavioral profiling outside the form context. When used for marketing lead capture with UTM tracking, the form falls partially under marketing purposes, but the embed itself does not need to be blocked — ensure your privacy policy discloses the data collection and downstream integrations.