Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
The Twitch Player is the embeddable video and stream player from Twitch, the live streaming platform owned by Amazon. When the player is embedded on a page, it loads scripts that set identifying and analytics cookies such as unique_id and twitch.lohp.countryCode. These cookies are not strictly necessary, so prior consent is required under the GDPR and the ePrivacy Directive. Data is processed in the United States.
The Twitch Player is the embeddable player from Twitch, the live streaming service owned by Amazon. Site owners use it to display live channels, video on demand, and clips directly on their pages through an iframe or the Twitch embed script. When the player loads, the visitor browser connects to Twitch domains, which deliver the video and set cookies used for identification and analytics.
The embed sets third party cookies such as unique_id and unique_id_durable, which act as device identifiers for about one year, twitch.lohp.countryCode to store the visitor region, and server_session_id for the current session. Alongside these cookies, Twitch receives the visitor IP address, browser and device information, the referring page, and viewing behaviour. Because the identifiers are persistent and tied to a device, the processing constitutes personal data under the GDPR.
Because these cookies are written to and read from the visitor device for identification and analytics rather than strictly necessary functions, Article 5(3) of the ePrivacy Directive requires prior consent. The persistent identifiers and IP address make the data personal under the GDPR, so a lawful basis, clear information, and an entry in your record of processing activities are required. The player must not load before consent has been given.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent must be collected before any Twitch domain is contacted, so the player iframe and the embed script have to be blocked until the visitor actively opts in. A recommended pattern is a click to load wrapper that defers the embed and shows a static preview with a play button until consent is given. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard.
Twitch is owned by Amazon and processes data in the United States, so document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses. In practice, gate the embed behind your consent management platform, use a click to load wrapper, and list the Twitch cookies and their durations in your cookie policy. Name Twitch Interactive and Amazon as recipients, disclose the US processing, and review periodically because cookie names and durations can change.
Websites using Twitch Player must obtain user consent under GDPR regulations.
DPIA considerations
The Twitch Player sets persistent device identifiers such as unique_id and unique_id_durable with a one year lifetime, stores region information, and sends IP addresses and viewing behaviour to Amazon owned infrastructure in the United States. A DPIA should assess the scale of tracking through embedded players, the persistence of the identifiers, the international transfer to the US under the Data Privacy Framework, and retention, with mitigations such as click to load gating and consent control.
Sample consent text
We use the Twitch player to show you live streams and videos on our site. When you allow it, Twitch places cookies on your device to identify your browser and measure usage, and it may receive your IP address and device information. This content loads only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
player.twitch.tvstatic.twitchcdn.netgql.twitch.tvspade.twitch.tvCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| unique_id | marketing | 1 year | Device identifier set by Twitch to recognise the visitor browser across sessions and pages. |
| unique_id_durable | marketing | 1 year | Durable device identifier used by Twitch to maintain recognition of the visitor browser over time. |
| twitch.lohp.countryCode | analytics | 1 year | Stores the visitor region or country code to tailor content and measure regional usage. |
| server_session_id | analytics | Session | Identifies the current session so that Twitch can associate player activity within a single visit. |
Twitch Player uses cookies for user preferences — inform visitors with a consent banner.
The Twitch embed sets third party cookies such as unique_id and unique_id_durable, which act as device identifiers for about one year, twitch.lohp.countryCode to store the visitor region for about one year, and server_session_id for the current session. Additional cookies may be set when the visitor is logged in to Twitch.
Yes. The cookies set by the embed are identifying and analytics cookies that are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the player contacts Twitch. A click to load wrapper that defers the embed until consent is the simplest compliant approach.
The storage and reading of cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data such as IP addresses and device identifiers relies on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available because consent is already required to set the cookies.
Yes. Twitch is owned by Amazon and processes data in the United States, so IP addresses and viewing data can be transferred there. Document the transfer under the EU US Data Privacy Framework, under which Amazon is certified, and the Standard Contractual Clauses as a complementary safeguard.
A full DPIA is not always mandatory, but it is advisable when you embed Twitch across many pages or combine it with other tracking. Document the purposes, the persistent identifiers and their durations, the international transfer to the US, and retention, and apply mitigations such as click to load gating and consent control.
Block the player iframe and the embed script until the visitor accepts the marketing category in your consent management platform. Use a click to load wrapper that shows a static preview and loads the real embed only after consent, list the Twitch cookies in your cookie policy, and disclose the US processing.
You can link out to the Twitch channel instead of embedding, host your own video on demand with a privacy friendly player, or use a thumbnail that opens Twitch in a new tab. These options reduce or remove third party cookies and US transfers, at the cost of inline live streaming.
List each Twitch cookie such as unique_id, unique_id_durable, and twitch.lohp.countryCode with its purpose and duration, name Twitch Interactive and Amazon as recipients, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan because cookie names and durations can change.