Thinkific

What Thinkific is and how it works

Thinkific is an online course platform founded in 2012 in Vancouver, British Columbia and operated by Thinkific Labs Inc., a public company listed on the Toronto Stock Exchange (TSE:THNC). The platform enables creators, coaches, educators, and businesses to design, host, and sell online courses, membership communities, coaching sessions, and downloadable digital products. Students access course sites either on a Thinkific subdomain (yoursite.thinkific.com) or on a fully branded custom domain configured by the course creator. Under the hood, course content, student profiles, progress tracking, quizzes, and payment flows are served from AWS infrastructure located in Canada and the United States.

Data and cookies collected by Thinkific

Thinkific sets several first-party cookies on the course site domain. The _thinkific_session cookie keeps a learner signed in across pages. The tcsi cookie (Thinkific course site identifier) ties a browser to a specific course site. When Google Analytics integration is enabled, _ga and _gid cookies are dropped for measurement. A thinkific_split cookie may also be set for A/B testing of pricing pages and checkout flows. In addition to cookies, Thinkific collects student names, email addresses, billing information processed through Stripe or PayPal, course progress, quiz answers, IP addresses, and device or browser metadata. Custom integrations with Google Analytics, Facebook Pixel, Mailchimp, or Zapier can extend the volume and granularity of data captured.

GDPR and ePrivacy implications

When a Thinkific course is offered to learners in the European Union, both the GDPR and the ePrivacy Directive (also known as the Cookie Law) apply. The course creator is typically the data controller and Thinkific Labs Inc. acts as a data processor under a Data Processing Addendum. Strictly necessary cookies such as the session cookie can be set without prior consent because they are required to deliver the service requested by the user. Analytics, A/B testing, and marketing cookies, including Google Analytics, Facebook Pixel, and any Mailchimp tracking, require prior, free, specific, informed, and unambiguous consent before they are dropped, in line with Art. 5(3) of the ePrivacy Directive and Art. 7 GDPR.

International data transfers: Canada and United States

Thinkific processes personal data on AWS regions located in Canada and the United States. Transfers to Canada benefit from a European Commission adequacy decision covering commercial organisations subject to PIPEDA, which means no additional safeguards are required for that leg of the processing. Transfers to AWS US, however, must be framed by Standard Contractual Clauses under Art. 46(2)(c) GDPR, complemented by a Transfer Impact Assessment evaluating US surveillance laws such as FISA 702 and Executive Order 12333. Course creators should document these transfers in their Record of Processing Activities and disclose them in their privacy notice, including a clear reference to the recipient country and the legal mechanism used.

Practical compliance steps for Thinkific course sites

To deploy Thinkific in a GDPR and ePrivacy compliant way: sign and store the Thinkific Data Processing Addendum, list Thinkific Labs Inc. as a sub-processor in your privacy notice, configure a Consent Management Platform such as Axeptio to block analytics, A/B testing, and marketing scripts until consent is collected, update your cookie policy with the exact list of Thinkific cookies and their retention, expose a clear consent banner on both marketing pages and course sites, document Canada (adequacy) and US (SCCs plus TIA) transfers in your Record of Processing Activities, and offer learners straightforward ways to exercise their access, rectification, erasure, and portability rights.