Smartsheet

Overview

Smartsheet is a cloud-based work management platform used for project planning, task tracking, and collaborative workflows. When detected on websites, Smartsheet appears through embedded web forms that collect structured data from visitors for intake workflows, registrations, or feedback. The forms feed submissions directly into Smartsheet grids (spreadsheet-like workspaces), automating data capture for business processes managed within the platform.

What This Script Does

Smartsheet embeds forms on websites via iframes from Smartsheet's servers.

• Forms: Smartsheet forms load via iframe from app.smartsheet.com/b/form/, rendering input fields configured by the form creator — text fields, dropdowns, date pickers, file attachments, and conditional sections that show or hide based on previous answers
• Form submission: When a visitor completes the form, all field values are transmitted to Smartsheet's servers and written as a new row in the designated Smartsheet grid. The form can trigger automated workflows (notifications, approvals, status updates) within Smartsheet.
• Scripts loaded: The iframe loads Smartsheet's application JavaScript for form rendering, validation, and submission handling
• Cookies set: Minimal session cookies within the iframe on the smartsheet.com domain for form state and CSRF protection. These do not affect the host domain due to iframe sandboxing.
• Data collected: Form field values submitted by the visitor (names, emails, phone numbers, custom data). The form does not collect browser fingerprint data, track page views, or monitor visitor behavior on the host page.
• No behavioral tracking: Smartsheet forms are purely data collection mechanisms with no analytics, tracking pixels, or visitor identification beyond the form submission itself.

Consent & Compliance

Smartsheet forms fall under the functional consent category.

Under GDPR and ePrivacy, embedded Smartsheet forms serve a functional purpose — collecting structured data that visitors explicitly submit. The iframe-based delivery isolates any cookies from the host domain. The ePrivacy Directive's requirements focus on the form's cookies being scoped within the iframe (third-party cookie context). Personal data collected through form fields requires a GDPR-compliant legal basis, typically the visitor's explicit action of submitting the form.

Under CCPA/CPRA, form submission data constitutes personal information. The host site should disclose Smartsheet as a data processor.

Smartsheet offers data processing agreements and SOC 2 Type II certification.

Should You Block This Without Consent?

No. Smartsheet forms are functional data collection tools with no tracking or advertising components. Visitors explicitly interact with and submit the form. The iframe-based embed isolates cookies from the host domain. Blocking would remove the form functionality, preventing visitors from submitting the data the website is designed to collect.