Using Sentry in a GDPR-compliant way

Sentry (sentry.io) collects client-side and server-side error reports with stack trace, URL, browser, sometimes IP address and — depending on configuration — session replays and user input. The default cloud runs in the USA.

Sentry is often classified as a "pure developer tool" and overlooked in data protection terms. In fact, a standard setup regularly processes personal data: the IP address is captured as a default attribute, breadcrumbs log click paths and sometimes input, and if a user ID is set, the errors can be attributed to a person. This is permissible, but only with a legal basis, DPA and transfer safeguards.

The biggest lever is the SDK configuration. The sendDefaultPii option controls whether the IP address and other identifiers are automatically sent along — set to false, this significantly reduces the personal reference. In addition, "data scrubbing" can be enabled server-side, which removes patterns such as email addresses, credit card numbers or named fields from the events before they are stored.

Session replay is its own category: it records users' interaction with the page, comparable to Hotjar or Microsoft Clarity, and therefore clearly requires consent. Anyone using replay should couple it to the consent tool, set masking to the maximum and mention it separately in the privacy policy. For the US transfer, Sentry now offers an EU data residency option that avoids the transfer.

Is this a risk?

The Sentry browser SDK loads on page view and can transmit data on an error that is personal (IP, user ID, entered form values in the breadcrumb/replay context). For non-essential access to the device, § 25 (1) TDDDG applies; session replay clearly requires consent. Processing needs a legal basis (usually legitimate interest in stability, Art. 6 (1)(f)), a data processing agreement with Functional Software Inc. and a transfer basis for the USA.

What you can do

• Conclude a data processing agreement (Data Processing Addendum) with Sentry; alternatively choose the EU region (sentry.io with EU data residency) or self-hosting.
• Data minimisation in the SDK: sendDefaultPii to false, do not store IP addresses, enable server-side scrubbing of sensitive fields.
• Load session replay only with consent and set masking to "all text and input".
• Name Sentry as recipient, the purpose (bug fixing), legal basis, retention period and, where applicable, the US transfer in the privacy policy.

Häufige Fragen

Is Sentry allowed without consent?

Pure error tracking (without session replay, with sendDefaultPii=false) can in many cases be based on a legitimate interest in the stability of the service. Session replay, on the other hand, requires consent.

Do I need a data processing agreement for Sentry?

Yes. Functional Software Inc. processes the error data on your behalf. The Data Processing Addendum applies once the terms are accepted and should be documented.

How do I avoid the US transfer?

Sentry offers an EU region with data residency in the EU; alternatively Sentry can be self-hosted. Both keep the error data within the EU.

What data does Sentry collect by default?

Stack trace, affected URL, browser and operating system, release version, breadcrumbs (click and navigation history) and — unless disabled — the IP address and any set user ID.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.