Collected data

Contentsquare collects comprehensive visitor interaction data while protecting personal information through email filtering and optional masking features.

The tag collects the following data by default. Some features collect additional data points, which are described on their own pages: Error analysis, Voice of Customer, and Product Analytics.

In particular, potential Personal Data would be:

1. Into the HTML content that is sent for a small fraction of your visitors. Solutions to prevent this from happening:

   • Remove some sensitive content (this chapter explains how)

   • Totally deactivate this for all users (some features may then be unavailable like Session Replay or retroactive background; ask your Account Manager)

2. Into Custom Variables sent to Contentsquare servers (to prevent this from happening, make sure that the values that you wish to collect could not be linked to one individual)

• The tag doesn't collect the values of form fields. For a field change, it collects which field changed and whether it was left blank, never its content.

• The tag doesn't collect what the user types. Keystrokes are collected as categories, not characters: every letter, digit, and symbol is reported as a single alphanumerical value, alongside the named keys (Enter, Backspace, Delete, Tab, Escape, arrows, and the modifier keys).

• The tag redacts the following patterns before the data is sent to Contentsquare servers:

  Pattern	Replaced with
  Email addresses, including URL-encoded ones	CS_ANONYMIZED_EMAIL
  Credit card numbers, when the number passes a Luhn checksum	CS_ANONYMIZED_PII
  Digit sequences of 9 digits or more, such as phone and social security numbers	• per digit

  Email redaction applies to URLs, Custom Vars, Dynamic Vars, e-commerce transaction IDs, Session Replay, and the messages collected by Error analysis. Credit card and digit-sequence redaction applies to the text collected by Session Replay. If your project masks numbers, every digit is redacted instead. Target text is not redacted: when it contains any of these patterns, it is not collected at all.

The Tag automatically collects the following data. Any values you explicitly send via Custom Vars or Dynamic Vars are also collected.

Rows marked accessibility analysis only are collected only when accessibility analysis is active on the project. Everything else is collected by default.

The two Clicked Element rows in the previous table correspond to the target-text setting on your project, which decides which elements contribute their text:

• Buttons and links only — text is collected for the nearest button or a ancestor of the clicked element, and nothing else.
• All elements — any clicked element contributes its text.

Target text is trimmed to 100 characters. It is dropped entirely when the element is masked, when it contains a masked child, or when its text contains one of the redacted patterns, or any digit if your project masks numbers.

Collected when you send e-commerce transactions — see E-commerce transactions.

Projects collecting Product Analytics data natively send all the data described earlier on this page, plus the data in this section. See Product Analytics for the commands that produce it.

The Tag attaches the following parameters to every pageview and event request, so that reporting is not limited to the first pageview of a session. Session-level values are restored from the _cs_s_ctx cookie.

Page title collection can be disabled with hidePageTitle.

click, tap, change, and submit interactions are collected as events so they can be analyzed without prior tagging. Each one carries:

• The target path of the element the user interacted with.
• The element hierarchy of that element, when hierarchy collection is enabled on the project.
• The merged custom properties in scope: pageview properties, visit properties, and any properties resolved by your event enrichers.

The hierarchy is the chain of ancestor elements from the interacted element up to — and stopping at — the document body. Each level is serialized as its tag name, then its id, then its classes in alphabetical order, then its remaining attributes:

@button;#submit-order;.btn;.btn-primary;[data-testid=confirm];|@div;.checkout-footer;|

Levels are separated by |. The whole hierarchy is capped at 1024 characters and truncated from the outermost level; a single attribute value longer than 1024 characters is dropped.

The following are never collected, whatever your masking settings:

Hierarchy collection also respects your project's masking settings. On a masked element, no attributes are collected at all. When anonymization is active, attributes outside your project's allowlist are collected by name only, without their value.