Mixpanel

Overview

Mixpanel is a product analytics platform used by product, growth, and data teams to understand user behavior within web and mobile applications. Unlike page-view-centric analytics tools, Mixpanel is built around event-based tracking: every user action (button click, feature use, form submission, purchase, etc.) is captured as a discrete event with attached properties. This powers funnel analysis, retention cohort tracking, A/B experiment measurement, and user-level behavioral timelines.

What This Script Does

The Mixpanel JavaScript SDK (mixpanel.min.js) is loaded from cdn.mxpnl.com or bundled directly into the site's JavaScript. It initializes an in-memory queue and begins capturing events immediately on load.

Cookies Set by Mixpanel:

• mp_[token]_mixpanel — the primary Mixpanel super-property cookie; first-party, persistent, typically expires after 365 days; stores the Mixpanel distinct ID (a UUID assigned to the browser), super properties (persistent key-value attributes set by the site, such as plan type or user segment), and the last event timestamp. This is the cookie that creates a persistent cross-session user identity
• mp_[token]_mixpanel_session — session-scoped companion cookie used to detect new sessions for session-start events
• mp_optout — opt-out marker cookie if the site implements Mixpanel's opt-out API; persists indefinitely

Data Collected Per Event:

• Custom event name and properties defined by the site (can include any key-value pairs)
• Automatic properties: browser name and version, OS, screen dimensions, referrer URL, current URL, UTM campaign parameters, and device type
• IP address (used for geographic enrichment — city, region, country — then typically discarded or hashed depending on configuration)
• Mixpanel distinct ID (the persistent UUID from the mp_* cookie)
• If mixpanel.identify(userId) is called: the anonymous ID is aliased to a known user ID, merging the anonymous event history with the authenticated user profile

Network Requests:

• Events are batched and sent via POST to api.mixpanel.com/track or api.mixpanel.com/engage (for people profile updates)
• Profile update calls ($set, $increment, $append) to api.mixpanel.com/engage can attach PII such as email addresses and names directly to user profiles if the site passes them

Mixpanel Inc. is a US company participating in the EU-US Data Privacy Framework, providing an adequacy mechanism for EU-to-US data transfers. Mixpanel offers a DPA and supports EU data residency (EU data stored in EU servers) as a paid option.

Consent & Compliance

Mixpanel falls under the analytics consent category. It processes personal data — persistent UUIDs, full behavioral event streams, IP-derived location data, and potentially PII (email, name, user ID) if passed by the site. Under GDPR Article 6(1)(a) and Article 5(3) of the ePrivacy Directive, Mixpanel requires explicit opt-in consent because it sets a 365-day persistent tracking cookie for non-essential product analytics. Data protection authorities in the EU have consistently ruled that analytics tools using persistent identifiers cannot rely on legitimate interest as a lawful basis. Under CCPA/CPRA, the persistent behavioral profiling constitutes collection of personal information requiring disclosure; if event data is shared with third parties for advertising or profiling, it may trigger opt-out obligations.

Should You Block This Without Consent?

Yes. Mixpanel sets a persistent 365-day tracking cookie and builds detailed behavioral profiles of individual users across sessions. Block until the user explicitly consents to analytics.