Teachable

What is Teachable and who operates it

Teachable is an online course platform launched in 2014 in New York and used by independent creators, coaches and small training companies to sell courses, coaching sessions, communities and digital downloads. The service is operated by Teachable Inc., a US company that became a subsidiary of the Brazilian group Hotmart in 2020. As a result, the production stack runs on Amazon Web Services data centres in the United States, while corporate and group-level processing also takes place in Brazil. For European customers, this means that any personal data entered by students or by the school administrator (email, name, billing details, learning activity) leaves the European Economic Area as soon as it reaches the Teachable platform.

What data and cookies Teachable collects

On the school front-end and inside the learning area, Teachable sets first-party cookies such as _teachable_session for authentication and CSRF protection, plus internal identifiers used to track course progress, quiz attempts and video viewing. Depending on the integrations enabled by the school owner, Teachable can also load Google Analytics (_ga, _gid), Facebook Pixel (_fbp, fr), Google Ads conversion tags, Mailchimp and Intercom scripts. Payment flows rely on Stripe and PayPal, which add their own cookies and fingerprinting signals for fraud prevention. From a GDPR perspective, all of this qualifies as personal data because it can be combined with the student account.

GDPR and ePrivacy implications

The school owner is the data controller for the student data hosted on Teachable, while Teachable Inc. acts as a processor under Art. 28 GDPR. The course catalogue and marketing pages typically fall under the ePrivacy Directive: any non-strictly-necessary cookie (analytics, advertising, social pixels, A/B testing) requires prior, informed and freely given consent before it is dropped. The strictly necessary session cookie used to keep students logged in can be exempted under the ePrivacy Article 5(3) exemption, provided its scope is limited to authentication and course delivery.

Consent and lawful basis

Two lawful bases usually apply in parallel. Performance of a contract under Art. 6(1)(b) GDPR covers the course enrolment, the delivery of lessons and the payment processing. Consent under Art. 6(1)(a) GDPR is required for marketing communications, retargeting pixels, advanced analytics and any optional integration. A compliant consent banner must block Google Analytics, Facebook Pixel and similar third-party tags until the visitor clicks Accept, must offer a refuse option as visible as the accept option, and must store proof of consent for audit purposes.

Data transfers to the United States and Brazil

Because Teachable hosts its infrastructure on AWS US and its parent company Hotmart operates from Brazil, every European student record is transferred outside the EEA. Teachable participates in the EU US Data Privacy Framework for the US leg of the transfer, but a complementary path to Brazil must be covered by Standard Contractual Clauses under Art. 46(2)(c) GDPR. Schools handling sensitive content (medical training, religious teaching, political education) should run a Transfer Impact Assessment, document supplementary measures such as encryption at rest and pseudonymisation, and update the record of processing activities accordingly.

Practical compliance steps

To deploy Teachable in a compliant manner, sign the Data Processing Addendum offered by Teachable, list Teachable Inc., Hotmart, AWS, Stripe, Mailgun and Intercom as sub-processors in your privacy notice, install a Consent Management Platform that blocks marketing scripts by default, and tag any custom code embedded through the Teachable Power Editor as conditional on consent. Define retention rules for inactive students, expose a working data subject request workflow (access, rectification, erasure, portability), and review the Teachable sub-processor page at least once per year.