Atatus

Overview

Atatus is an application performance monitoring (APM) and real user monitoring (RUM) platform aimed at engineering and DevOps teams. It provides frontend error tracking, page load performance metrics, and user session insight to help developers identify and resolve production issues. Atatus competes with Sentry, Datadog RUM, and New Relic Browser in the frontend observability space. Its scripts run on the websites of companies that have integrated Atatus for production monitoring purposes.

What This Script Does

Atatus loads a lightweight monitoring agent from its CDN, typically via a script tag pointing to cdn.atatus.com.

Error tracking:

• Attaches global error handlers (window.onerror, unhandledrejection) to capture uncaught JavaScript exceptions
• Records the error message, stack trace, file name, and line number
• Captures the browser, OS, and viewport dimensions at the time of the error

Real user monitoring:

• Measures page load timing using the Navigation Timing API — including DNS resolution, TCP connection, TTFB, DOM interactive, and fully loaded timestamps
• Tracks AJAX and fetch request durations and error rates via XMLHttpRequest and Fetch API instrumentation
• Records Core Web Vitals (LCP, FID/INP, CLS) where browser APIs are available

Session tracking:

• Assigns a session identifier to correlate multiple events within a user's visit
• May capture page URL sequences to reconstruct user paths through the application
• Session identifiers are typically stored in sessionStorage and do not persist beyond the browser tab

Data transmission:

All collected metrics and error payloads are sent to api.atatus.com endpoints. Payloads include page URL, session ID, browser metadata, and the specific performance or error data.

Consent & Compliance

GDPR and ePrivacy Directive: Atatus collects technical performance data tied to individual browser sessions. While IP address (processed server-side on receipt) and session identifiers constitute personal data under GDPR, the processing purpose is legitimate operational interest — identifying software defects and performance regressions. Under GDPR, legitimate interests (Article 6(1)(f)) may provide a lawful basis for RUM and error monitoring data collection. The ePrivacy Directive's cookie requirements may apply if Atatus uses persistent storage rather than sessionStorage for its identifiers, but most RUM implementations use non-persistent session tracking.

CCPA/CPRA: Error and performance data shared with Atatus constitutes disclosure of personal information to a service provider. This is permissible under CCPA with a Data Processing Agreement. The data is not used for advertising purposes and would not constitute a "sale."

Consent category: analytics — Atatus collects behavioral and technical data about user sessions for the site operator's internal engineering purposes.

Should You Block This Without Consent?

Yes.

Although Atatus serves an operational rather than advertising purpose, it collects session-level behavioral data (page paths, interaction timing, error context) and transmits it to a third-party server. Under a strict interpretation of GDPR and the ePrivacy Directive, analytics tools that collect personal data require consent unless a legitimate interest assessment supports the processing. Site operators who rely on Atatus for production error monitoring should conduct an LIA and consider whether functional exemptions apply, but as a default, blocking Atatus without consent is the conservative and compliant approach.