Privacy policy clauses for PostHog
PostHog is an open-source product analytics platform that tracks user interactions, session behavior, and feature usage on websites and applications. Companies use PostHog to understand how users engage with their products, identify friction points, and measure feature performance through event tracking and session replay technology.
Free scan · No signup · Results in 60 seconds
What data PostHog collects
Your privacy policy must disclose each of the following data types when you use PostHog.
When does PostHog trigger privacy obligations?
Installation triggers immediate obligations
The moment you install PostHog's SDK on your website or app, user event data, device identifiers, and session recordings begin flowing to PostHog Inc servers in the US (or EU infrastructure if selected). This triggers three regulatory obligations:
GDPR (if you have EU users): PostHog collects personal data (user IDs, IP addresses, device fingerprints in recordings). Under GDPR Article 13/14, you must provide a privacy notice *before* collection starts, disclosing the processor (PostHog Inc), the data types, the legal basis (typically consent or legitimate interest), and retention periods. You must also execute a Data Processing Agreement (DPA) with PostHog under Article 28.
ePrivacy Directive Article 5(3):
