Docs

Legal basis

This page summarizes the reasoning 3x is designed around for sites in Germany and the EU. It is not legal advice; your DPO decides. The technical facts it relies on are listed in Privacy and GDPR.

Two separate questions

  1. Device access (TDDDG § 25 / ePrivacy Art. 5(3)) – may the script read or store information on the visitor's device?
  2. Processing of personal data (GDPR Art. 6) – may the resulting data be processed?

Device access

  • 3x stores nothing on the device before consent (no cookies, no localStorage, no sessionStorage). The only write without consent is the opt-out flag a visitor sets deliberately.
  • Reads before consent are limited to what the browser sends or exposes for delivering the page (URL, referrer, language) and, in the cookieless mode, layout and interaction state of the page itself (viewport, scroll position, visibility, clicks on the site's own elements). The argument for these reads is § 25 (2) no. 2 TDDDG: they are strictly necessary to provide the service the operator offers – a website whose reach and usability is measured – and do not access information beyond the page itself.
  • If your DPO does not follow that argument for viewport and scroll reads, switch the project to the strict mode: before consent the SDK then reads only URL, referrer, language and clicks or events on the site's own elements. With require, nothing is measured before consent.
  • Everything that clearly needs consent – persistent ids, screen properties, first-touch storage, advertising cookies (_fbp, _fbc, _ttp) and CMP APIs – happens only after consent.

Processing

  • Reach measurement without identifiers: the daily visitor hash is pseudonymous for one day and becomes anonymous when its salt is deleted. Legitimate interest (Art. 6(1)(f) GDPR) in measuring the website and its campaigns is the usual basis; the balancing test favours the operator because no profile across days, sites or devices is possible and the visitor can opt out.
  • Leads you collect through forms are processed under the basis of the form (contract initiation, Art. 6(1)(b), or consent). identify() sends only hashes; plaintext lead fields are stored only when you send them from your server and the project enables it.
  • Server-side conversions send hashed contact data and click ids to ad platforms. Operators usually rely on legitimate interest for B2B lead reporting or on consent; Google may treat EEA conversions without a consent signal restrictively. Decide per project, document it in the privacy policy, and configure definitions accordingly – for example requireServerConfirmation, or no web-triggered conversions at all.

Opt-out

Offer the opt-out link (?x3_notrack=1, or the project's parameter) in the privacy policy. Honouring GPC is on by default for new projects.

Joint controllership and transfers

3x itself does not share data with anyone. Data reaches third parties only through what you configure: ad platforms for conversions (you are a controller towards them; check their terms, for example Meta's and LinkedIn's data processing terms) and Composio for reading your own ad accounts. Hosting location and sub-processors depend on your deployment (Self-hosting).