1. Introduction to the GDPR and privacy in Dynatrace #
Collecting data through Real User Monitoring (RUM) and Session Replay raises important GDPR compliance questions.
The observability challenge under the GDPR #
The General Data Protection Regulation (GDPR) imposes strict rules on the collection and processing of personal data (PII). By capturing user sessions, IP addresses and interactions (clicks, keystrokes through Session Replay), Dynatrace is on the front line. Fortunately, the platform offers a range of features under the Data Privacy name to anonymize, mask and make collection conditional on the user's explicit consent.
2. Global data protection configuration #
Dynatrace lets you configure the behavior of the JavaScript agent according to your company's privacy rules.
Enable opt-in mode (explicit consent) #
To comply with the GDPR, you must not track a user without their consent. Dynatrace offers the Opt-in mode setting.
To enable it: go to your web application settings > Data privacy. Turn on Enable opt-in mode. When this mode is active, the JavaScript OneAgent is injected but collects no performance or session data until the user has accepted tracking cookies. The application must then call the Dynatrace JavaScript API (dtrum.enable(), or manage the dtConsent cookie) when the cookie banner is accepted.
Do Not Track (DNT) #
Also in the Data privacy section, you can enable the Respect 'Do Not Track' headers setting. Dynatrace will simply ignore users who have configured their browser not to be tracked.
3. Data masking and IP addresses #
Masking is a crucial technique to ensure that sensitive data never leaves the user's browser.
Anonymizing IP addresses #
The GDPR considers the IP address to be personal data. In the global settings (Settings > Preferences > Data privacy and security), enable Mask IP addresses and GPS coordinates. Dynatrace replaces the last octet of the IP address with a zero (e.g. 192.168.10.0 instead of 192.168.10.45), making exact identification impossible while keeping sufficient regional geolocation.
Masking in Session Replay #
If you use Session Replay, you potentially capture the content of the page the user sees. Dynatrace offers several masking levels:
- Mask all: masks all DOM content (text is replaced by asterisks). It is the safest but the least usable.
- Mask user input: masks only form fields. Passwords are always masked by default and cannot be unmasked.
- Mask by CSS selector: you can specify precise CSS classes (e.g.
.pii-data,.credit-card) to target exactly what must be blurred.
4. Enabling user identifier collection (user tagging) #
For effective customer support, it is often useful to link a Dynatrace session to a user identifier (email, customer ID). Here is how to configure it in compliance with the GDPR.
Why configure user tagging? #
By default, Dynatrace identifies users anonymously (through a persistent cookie generating a random ID). Enabling identifier collection lets you quickly find the session of a customer who reported a bug, or filter dashboards by user profile.
GDPR warning: By linking a session to an email address or a customer ID, you centralize highly personal data. Make sure you have the user's consent (opt-in mode active) and that your legal notices mention the use of Dynatrace to analyze the user experience. The captured identifier must be relevant (prefer an encrypted user ID over a full name if possible).
How to configure the user tag (identifier capture) #
Follow these steps to configure the capture in the Dynatrace interface:
- Go to the Applications (or Frontend) menu and select your application.
- Click the application's Settings, then expand the Capturing section.
- Click User tag and add a new rule (Add user tag rule).
Choosing the capture method #
Dynatrace offers several methods to extract the identifier on the client side. Choose the one that best fits your application's architecture:
| Method | Description and example |
|---|---|
| CSS Selector | Captures the text contained in an HTML element of the page. Useful if the user's name is displayed in the header. (e.g. #user-profile-name) |
| JavaScript variable | Captures the value of a global JavaScript variable. Perfect for single-page applications (SPA). (e.g. window.appContext.user.id) |
| Cookie value | Retrieves the value of a specific cookie. Ideal if the business session ID is managed by a non-HttpOnly cookie. |
| Meta tag | Captures the value of a <meta name="user-id" content="12345"> tag present in the DOM. |
| Server-side request attribute | Used when the identifier is not on the client side but is extracted on the backend through OneAgent (e.g. an HTTP request attribute). |
Once the rule is configured, check in Session segmentation: sessions previously named 'Anonymous' will now show the captured value.
Data cleanup (cleanup rule) #
If the capture method retrieves superfluous data (for example 'Bonjour martin@entreprise.com' when you only want 'martin@entreprise.com'), Dynatrace lets you apply a cleanup rule (regex) within the user tag rule itself. For example, you can use Bonjour (.*) to keep only the string captured by the group.
5. Summary of best practices #
A quick checklist to stay GDPR-compliant with Dynatrace.
Compliance checklist #
- [ ] Opt-in mode is enabled and linked to your consent management platform (CMP).
- [ ] IP address masking is enabled globally.
- [ ] Session Replay masks all personal input fields (at a minimum).
- [ ] User tagging (identifier collection) preferably uses a pseudonymized technical ID (e.g. UUID), or is formally covered by your privacy policy if it uses email addresses.
- [ ] You have defined short data retention rules for personal session data (e.g. 35 days maximum).
