PostHog

Overview

PostHog is an open-source product analytics and session recording platform that competes with Mixpanel, Amplitude, and FullStory. It tracks custom user events, feature flag exposures, and session replays. Uniquely, PostHog can be self-hosted on the organization's own infrastructure (PostHog Open Source) or used as a managed cloud service (PostHog Cloud), giving teams full control over data residency.

What This Script Does

PostHog's browser library (posthog.js) is a single comprehensive SDK that handles event capture, session recording, feature flags, A/B testing, and user identification.

Script Files and Domains

• posthog.js — Loaded from app.posthog.com/static/chunk-*.js (PostHog Cloud) or from the self-hosted instance domain. Approximately 80–200KB depending on configuration.
• API endpoint: app.posthog.com/capture/ (US Cloud), eu.posthog.com/capture/ (EU Cloud), or the self-hosted instance URL.
• Feature flag evaluation: app.posthog.com/decide/

Cookies and Storage

• ph_{project_api_key}_posthog — Primary PostHog cookie. Contains a JSON payload with the distinct user ID, session ID, and properties set via identify() or people.set(). Default expiry: 1 year. Set as a first-party cookie on the host domain.
• ph_opt_in_{project_api_key} / ph_opt_out_{project_api_key} — Opt-in/opt-out state cookies. Used when opt_in_site_apps or explicit consent management is configured.
• posthog_crosssubdomain_id — Cross-subdomain identity cookie (if configured). Persists for 1 year.
• PostHog also stores event queues and session metadata in localStorage under ph_ prefixed keys.

Data Collected Per Interaction

• $pageview event: URL, referrer, page title, screen dimensions, viewport dimensions
• $autocapture events (if enabled): clicks, form submissions, and input changes — capturing element text, CSS classes, and DOM structure up to the nearest identifiable ancestor
• $session_recording_snapshot events: DOM mutations and user interactions recorded as session replays (if session recording is enabled)
• Custom events: any events defined by the site operator via posthog.capture()
• $identify call: links the anonymous ID to a named user ID along with trait data (name, email, plan, etc.)
• Feature flag exposure events: which flags were evaluated and what variant was returned
• Performance: Page load timing is captured if the Performance Observer API is available

Feature Flags and A/B Testing Feature flag state is evaluated server-side and returned to the client on initialization. The SDK stores flag values locally and reports $feature_flag_called events when flags are evaluated. This enables product teams to correlate flag variants with conversion metrics.

Consent & Compliance

Consent category: Analytics

• GDPR/ePrivacy: PostHog Cloud (US or EU) requires consent as it constitutes third-party data processing. The ph_* cookie identifies individuals across sessions and requires opt-in under ePrivacy. If using PostHog EU Cloud (eu.posthog.com), data stays within the EU, removing the cross-border transfer concern, but consent is still required for the cookie.
• Self-hosted PostHog: If deployed on the organization's own infrastructure with no third-party data transfer, GDPR's third-party processor obligations do not apply. However, the cookie identifying individual users still requires consent under ePrivacy unless fully anonymized. PostHog offers a disable_cookie mode that uses sessionStorage instead of persistent cookies — under this mode, combined with IP anonymization, some DPAs may recognize a legitimate interest basis.
• CCPA/CPRA: Event data linked to a distinct user ID constitutes personal information collection. Opt-out rights apply.
• Session recording: Session replay captures detailed user interactions (keystrokes, mouse movements, DOM content) and constitutes sensitive behavioral profiling. This requires explicit consent regardless of GDPR basis.
• EU-US Data Privacy Framework: PostHog participates in the DPF for US Cloud deployments.

Should You Block This Without Consent?

Conditional. For PostHog Cloud deployments with session recording, block until analytics consent is granted. For self-hosted PostHog with cookie disabled, IP anonymized, and no session recording, a legitimate interest basis may be defensible with appropriate documentation. Default PostHog Cloud configurations require consent before initialization.