Brevo

Overview

Brevo (formerly Sendinblue, rebranded 2023) is a Paris-based all-in-one marketing platform offering email campaigns, SMS marketing, transactional email, live chat, CRM, and marketing automation. Founded in 2012, Brevo serves over 500,000 businesses globally, with a particular concentration among small and mid-size companies in Europe. On websites, Brevo appears through its site-tracking script, embeddable newsletter signup forms, pop-up widgets, and the Brevo Conversations live chat widget. Brevo holds ISO 27001 certification and stores European customer data on servers within the EU.

What This Script Does

The Brevo tracking script loads from sibautomation.com (Brevo's automation domain) or js.brevo.com and initialises the site tracking and marketing automation layer. Separately, the Conversations chat widget loads from conversations-widget.brevo.com.

Cookies and identifiers set:

• sib_cuid — Cross-session contact identifier set on the host domain; first-party cookie linking browsing behaviour to a Brevo contact record when the visitor is known (e.g. has submitted a form or clicked an email); expiry 180 days.
• sib_session — Session cookie managing the current browsing session for automation trigger evaluation; expires at session end.
• brevo_cid — Visitor identifier for anonymous tracking prior to contact identification; expiry 13 months.
• __brevo_cid — Alternative cookie name used in some configurations; same purpose as brevo_cid.

Script filenames and CDN: automation.min.js loaded from sibautomation.com; tracker.js from js.brevo.com; chat widget JS from conversations-widget.brevo.com/brevo-conversations-bundle.js.

Per-session data collected:

• Page views with full URL, title, and referrer
• UTM parameters and advertising attribution data
• Form submissions (email address and form field values captured on submit)
• Email link click-through events when visitor arrives via Brevo campaign
• Behavioral triggers: time on page, scroll depth, exit intent (for automation rules)
• Contact profile merge events when anonymous visitor is identified

Automation capabilities: The site tracking script evaluates automation workflow conditions in real time — triggering email sequences, assigning lead scores, updating contact properties in the Brevo CRM, and firing retargeting events based on page visits or behavioural patterns.

Consent & Compliance

Brevo scripts are classified under the marketing category. The site tracking, contact identification, and behavioral automation constitute marketing data processing under GDPR Article 6(1)(a). The sib_cuid and brevo_cid persistent cookies require prior opt-in consent under the ePrivacy Directive. Under CCPA/CPRA, linking browsing behaviour to named contact records constitutes collecting personal information for marketing purposes that must be disclosed with appropriate opt-out rights. The live chat widget may be treated as functional if loaded only upon explicit user initiation (clicking a chat icon), but the background tracking script always requires marketing consent. As a French company, Brevo operates under CNIL guidance, which takes a strict opt-in interpretation of ePrivacy requirements. Brevo's EU data residency provides a favourable GDPR transfer posture for European deployments.

Should You Block This Without Consent?

Yes. Brevo site tracking scripts collect behavioral data and set persistent cookies for marketing automation and contact identification. Block all Brevo tracking components until the user grants marketing consent. The live chat widget may be treated as functional only if it loads exclusively on user initiation with no background tracking.