Interactive Avatar: Widget privacy and consent
Before you put the widget on your site, you’ll want to know what it sends, to whom and when. You need that to describe the widget in your privacy notice, and to connect it to your cookie or consent tool so it waits for the visitor’s choice.
The widget contacts Synthesia at three moments: when the script loads, when the widget frame loads, and when the visitor starts a call. If the deployment has bot protection on, the widget also loads Cloudflare Turnstile, which is a third party.
What the widget sends, and when
The sections below go through each moment in the order a visitor meets them. Consent deferral can hold back the second and third moments until the visitor agrees.
When the script loads
With the script snippet, the visitor’s browser fetches runtime.js from Synthesia as soon as the page loads. This happens before any consent decision, even with consent deferral. Like any request, it sends the visitor’s IP address, user agent and Referer header. The Referer is your page’s origin by default, or its full URL if your page’s referrer policy allows that.
When the widget frame loads
Once the frame loads, the widget fetches its document, scripts and styles from Synthesia, along with the deployment’s avatar picture and logo.
The widget also sends diagnostic records to Synthesia. They say that the widget loaded and how long that took, that it was shown, and each time the bubble opens or closes. Each record carries the deployment’s configuration ID, a random ID for this page load and the widget version. The record that says the widget was shown also carries the script version, the embed mode and your page’s origin.
All these requests carry the visitor’s IP address and user agent. The request for the frame sends only your origin as the referrer, never the full URL of your page.
When the visitor starts a call
The widget asks for the microphone and requests a session only after the visitor clicks to start a call.
If the deployment has bot protection on, which is the default for new deployments, the widget first loads Cloudflare Turnstile from challenges.cloudflare.com inside the frame. Cloudflare is a third party. The call then connects to Synthesia’s media servers.
During the call, the widget sends more diagnostic records: one for each step of starting the call, and one for how and when the call ended. If the deployment keeps transcripts, the widget tells the visitor that the conversation is being transcribed.
Cookies and storage
runtime.js doesn’t read your page’s content, set cookies or use local storage.
Consent deferral
With the script snippet, you can keep the widget from loading until the visitor consents. Add data-consent="deferred" to the script tag, or consent="deferred" to the <synthesia-interactive-avatar> element. The script then creates no frame and sends no request until your consent tool calls init():
The element also has its own init() method.
Consent deferral can’t stop the browser from fetching runtime.js, because runtime.js is what reads the deferral setting. If you need no request to Synthesia at all before consent, add the script tag to the page only after the visitor consents. Most consent tools can do this for you.
The iframe snippet has no consent deferral of its own. If you use it, let your consent tool add it to the page after consent, in the same way.
What we keep
Our CDN serves runtime.js, and we keep its request logs for runtime.js for up to 2 years. These logs hold no visitor data. They record only the time, the CDN location, the method, the path, the status and whether the cache answered, with no IP address, user agent, referrer or query string.
For these script requests, our web application firewall logs only the ones it blocks or flags, for example because of a rate limit. Those entries include the IP address and the request headers, and we keep them for 12 months.