> How Amazon S3 handles personal data, why region selection matters, whether consent is needed and how to comply with GDPR, ePrivacy and Schrems II. > > Canonical: https://www.flowconsent.com/en/services/cdn/amazon-s3 CDN # Amazon S3 Unclassified · [Official website](https://aws.amazon.com/s3/) Amazon Simple Storage Service (S3) is the object storage service provided by Amazon Web Services. It stores files (images, videos, documents, backups) in buckets, served via HTTPS endpoints or as origin behind Amazon CloudFront. S3 itself does not set client side cookies, but it transmits visitor IP addresses to AWS, which in turn raises GDPR questions about region choice, data processing agreements and access by US authorities. [Block Amazon S3 until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CDN](https://www.flowconsent.com/en/services/cdn) - Consent Unclassified - Prior consent Not required - Documented cookies 1 - Third-party domains 8 - Servers Region selected by the customer; for EU customers the recommended regions are eu-central-1 (Frankfurt), eu-west-1 (Ireland), eu-west-3 (Paris), eu-north-1 (Stockholm) or eu-south-1 (Milan). When using S3 as origin behind CloudFront, edge caching can deliver content from servers worldwide. Overview ## What does Amazon S3 do? ## **What is Amazon S3** Amazon Simple Storage Service (S3) is the flagship object storage service of Amazon Web Services. It exposes buckets that can hold any number of files (images, videos, documents, archives, application data, machine learning datasets) and serves them through HTTPS endpoints, pre signed URLs, REST APIs or as origin behind Amazon CloudFront. S3 is one of the foundational components of the modern web: media libraries, application backups, static sites and CMS uploads frequently land in an S3 bucket somewhere. From a privacy perspective, S3 is interesting because it stores or relays personal data without setting client side cookies of its own. ## **What data S3 collects** S3 processes the objects you put into a bucket plus the metadata of every request: requester IP address, HTTP method, requested object key, response size, latency and any custom headers. When S3 server access logging or AWS CloudTrail are enabled, these access records are stored in another bucket and can include IP addresses considered personal data under the GDPR. S3 does not set cookies on the visitor's browser. If the bucket is fronted by CloudFront, additional edge logs are kept by AWS for security and performance purposes. ## **GDPR and ePrivacy implications** S3 itself is a processor in the meaning of Article 28 GDPR when serving user content for a controller. The AWS Data Processing Addendum is the standard contract, supplemented by the EU SCCs in the AWS GDPR DPA and the EU US Data Privacy Framework certification of Amazon Web Services Inc. ePrivacy is generally not engaged because S3 does not write to or read from the user terminal beyond standard HTTP cache. The main concerns are the location of storage, the legal access regime of the chosen region, and the IP based logging produced by S3 and CloudFront. ## **Is consent required** No, not for the simple act of serving a file from S3 to a visitor. The storage itself rests on legitimate interest or contract performance. Consent only becomes relevant if the bucket is used to host tracking pixels, marketing assets coupled with analytics or scripts that themselves require consent. The Schrems II discussion applies more strongly when buckets are in a US region: in that case, the recipient of personal data is in the US even if no commercial use is made of it, and the privacy policy must reflect that. ## **Data transfers and access by US authorities** AWS lets you pick the storage region for each bucket. When the region is in the EU and no replication or cross region access is enabled, the persistent storage stays in Europe. However, Amazon Web Services Inc. is a US controller and certain support and security activities can be performed from the US. Following the EDPB recommendations after Schrems II, AWS publishes a Transfer Impact Assessment for EU customers and provides the EU US Data Privacy Framework as a transfer mechanism. Encryption with customer managed keys (SSE C or KMS) gives an additional layer of protection. ## **Practical compliance steps** Pick an EU region for buckets that hold personal data, sign the AWS DPA, enable server side encryption (KMS for stronger control), restrict bucket access through IAM and S3 Block Public Access, and shorten the retention of S3 server access logs. Document the role of Amazon Web Services EMEA SARL as the EU contracting entity. Mention Amazon S3 and AWS in the privacy policy with a clear note about the region and transfer mechanism. If you absolutely need a US bucket, conduct and document a Transfer Impact Assessment and consider client side encryption. Compliance ## Amazon S3 and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for delivering static assets to the visitor, contract (Art. 6(1)(b)) where S3 stores user files necessary to provide the service; consent (Art. 6(1)(a)) is only needed when S3 is used to host marketing assets coupled with tracking - Risk level low - Applicable regulations GDPR, ePrivacy Directive (limited, since S3 itself does not set cookies), DORA for regulated entities, EU US Data Privacy Framework, NIS2 for essential operators ### Impact assessment (DPIA) When S3 stores or serves personal data (user uploaded files, customer documents, profile pictures), a DPIA is recommended if the volume is large, the data sensitive or the bucket is configured in a non EU region. Document the storage region, encryption configuration, AWS DPA reliance and any logging that captures personal data such as IP addresses. ### Sample text for your banner > We host certain assets and files on Amazon S3 (Amazon Web Services). Loading them transmits your IP address to AWS infrastructure, which may include servers located in or accessed from the United States. Do you accept? Cookies and trackers ## What Amazon S3 sets and contacts - Tracking method Object storage HTTPS endpoint, accessed via direct URLs (s3.amazonaws.com or region specific endpoints), pre signed URLs, REST API, S3 SDK or as origin behind a CloudFront distribution. Optional S3 server access logs and AWS CloudTrail capture request metadata including IP address. - Server location Region selected by the customer; for EU customers the recommended regions are eu-central-1 (Frankfurt), eu-west-1 (Ireland), eu-west-3 (Paris), eu-north-1 (Stockholm) or eu-south-1 (Milan). When using S3 as origin behind CloudFront, edge caching can deliver content from servers worldwide. - Cookieless mode available Yes - Data transferred outside the EU S3 itself does not transfer data to third countries when configured in an EU region for storage. However, the requesting visitor IP is processed by AWS edge infrastructure that may sit outside the EU, and AWS as a controller has access from the United States for support, security and government request handling. Amazon Web Services Inc. is certified under the EU US Data Privacy Framework and offers the AWS Data Processing Addendum with EU SCCs. ### Cookies set (1) | Name | Type | Duration | Purpose | | --------------------------- | ---- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | No cookies set by S3 itself | none | N/A | Amazon S3 is a pure HTTPS object store and does not set browser cookies. When fronted by CloudFront with signed cookies, CloudFront cookies (CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id) may be set; these are documented under the CloudFront service. | ### Third-party domains contacted (8) - `s3.amazonaws.com` - `s3.eu-central-1.amazonaws.com` - `s3.eu-west-1.amazonaws.com` - `s3.eu-west-3.amazonaws.com` - `s3.eu-north-1.amazonaws.com` - `s3.dualstack.amazonaws.com` - `.s3.amazonaws.com` - `cloudfront.net` Questions ## Frequently asked questions about Amazon S3 Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Amazon S3 set cookies on visitors' browsers? No. S3 is a pure HTTPS object storage service and does not set client side cookies. When S3 is used as origin behind Amazon CloudFront, CloudFront itself may set technical cookies if signed cookies are enabled, but plain S3 access does not. ### Do I need consent to serve files from S3? No, not as such. Serving static assets from S3 is necessary to provide the website and rests on legitimate interest or contract performance. Consent enters the picture only when the assets you serve are tracking pixels, marketing content combined with measurement, or scripts that themselves require consent. ### What is the legal basis for using Amazon S3? Legitimate interest (Art. 6(1)(f) GDPR) for delivering site assets, contract performance (Art. 6(1)(b)) when S3 stores user files that are part of the service, and legal obligation (Art. 6(1)(c)) for accounting backups. AWS acts as a processor under the AWS Data Processing Addendum. ### Are data transfers to the United States involved with S3? Not by default if you pick an EU region and disable cross region replication. However, Amazon Web Services Inc. remains accessible from the US for support, security and government requests. The EU US Data Privacy Framework and AWS SCCs cover residual transfers. For buckets in US regions the transfer is direct and must be documented. ### Do I need a DPIA for S3? For typical asset serving, no. For large scale personal data storage (user generated content, customer documents, healthcare or financial data), conduct a DPIA covering data location, encryption, access controls and logging. Include AWS DPA, KMS configuration and bucket policies. ### How do I implement S3 compliantly? Pick an EU region, sign the AWS GDPR DPA, enable server side encryption with KMS, lock down buckets with Block Public Access, use IAM and bucket policies to restrict access, enable S3 Object Lock for retention compliance, and shorten the retention of Server Access Logs and CloudTrail trails to what is necessary. ### What are the alternatives to Amazon S3? EU based object storage services include OVHcloud Object Storage, Scaleway Object Storage, IONOS S3 Object Storage and Hetzner Storage Box. They offer S3 compatible APIs while keeping the data in EU jurisdictions. For sovereign cloud needs in France, look at OVH SecNumCloud or Outscale. ### How should the privacy policy describe S3? State that you use Amazon S3 from Amazon Web Services EMEA SARL (Luxembourg) as a processor, the region where buckets are stored, the categories of personal data involved (user files, IP logs), the retention period, and the transfer mechanism (Data Privacy Framework and SCCs in the AWS GDPR DPA). Same category ## More services: CDN [See the whole category](https://www.flowconsent.com/en/services/cdn) ### [Sotoon](https://www.flowconsent.com/en/services/cdn/sotoon) [Sotoon is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sotoon integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sotoon helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/sotoon) [CDN](https://www.flowconsent.com/en/services/cdn/sotoon) · ### [Google Hosted Libraries](https://www.flowconsent.com/en/services/cdn/google-hosted-libraries) [Google Hosted Libraries is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Google Hosted Libraries is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Google Hosted Libraries offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/cdn/google-hosted-libraries) [CDN](https://www.flowconsent.com/en/services/cdn/google-hosted-libraries) · ### [Sitecore Experience Edge](https://www.flowconsent.com/en/services/cdn/sitecore-experience-edge) [Sitecore Experience Edge is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sitecore Experience Edge integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sitecore Experience Edge helps organizations maintain robust websites that meet.](https://www.flowconsent.com/en/services/cdn/sitecore-experience-edge) [CDN](https://www.flowconsent.com/en/services/cdn/sitecore-experience-edge) · ### [WPCacheOn](https://www.flowconsent.com/en/services/cdn/wpcacheon) [WPCacheOn is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. WPCacheOn integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, WPCacheOn helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/wpcacheon) [CDN](https://www.flowconsent.com/en/services/cdn/wpcacheon) · ### [JSPM](https://www.flowconsent.com/en/services/cdn/jspm) [JSPM is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. JSPM integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, JSPM helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/jspm) [CDN](https://www.flowconsent.com/en/services/cdn/jspm) · ### [Statically](https://www.flowconsent.com/en/services/cdn/statically) [Statically is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Statically supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Statically ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/statically) [CDN](https://www.flowconsent.com/en/services/cdn/statically) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)