Agora

What is Agora?

Agora is a real time engagement platform headquartered in Santa Clara, California, with a related Chinese entity, Shanghai Agora Lab, that operates the China region. Developers integrate the Agora Web SDK, Voice SDK, Video SDK and Real Time Messaging SDK into a website or mobile app to add live audio, live video, interactive streaming, voice chat and signaling. The SDK opens encrypted WebRTC connections to the Agora Software Defined Real time Network (SD RTN), a global edge network with nodes in the European Union, the United Kingdom, the Americas, Asia Pacific and the Middle East.

For European publishers, Agora is appealing because it provides low latency global infrastructure, but it routes media through a US controlled control plane and writes session identifiers, device fingerprints and quality of experience telemetry to first party storage on the integrating site. Voice and video communications are sensitive personal data, which raises the GDPR risk profile of any Agora deployment.

Cookies and data collected by Agora

On a typical integration the Agora SDK writes a session identifier, a peer connection identifier, device capabilities (camera and microphone, codecs, network type) and a small device fingerprint to first party storage (localStorage and IndexedDB) of the embedding site. It opens WebSocket and DTLS/SRTP connections to *.agora.io edge gateways, transmits the audio and video media and continuously sends Quality of Experience (QoE) statistics, including bitrate, jitter, packet loss, IP address and rough geolocation, to statscollector domains.

On agora.io properties (console, dashboard, marketing pages) Agora also sets functional cookies (csrf, session) and uses third party analytics such as Google Analytics, Hotjar and HubSpot. Cloud Recording and Cloud Transcription, when enabled, store the resulting audio, video and text files in Agora controlled buckets (Amazon S3 by default) for the duration configured by the developer.

GDPR and ePrivacy implications

Voice and video are content data that fall fully within Articles 4 and 5 of the GDPR. Agora acts as a processor (Art. 28 GDPR) on behalf of the publisher who is the controller. The publisher must sign the Agora Data Processing Addendum, document the legal basis, inform users in a privacy notice and implement appropriate technical and organisational measures (TOMs) including encryption in transit (DTLS/SRTP) and access controls on Cloud Recording.

Under ePrivacy (Art. 5(3) of Directive 2002/58/EC and its national transpositions in France, Germany, Spain and other EU member states), the session and device identifiers written to local storage by the Agora SDK are equivalent to cookies. Strictly necessary identifiers needed for the call the user has explicitly initiated may be exempt from prior consent, but device fingerprinting, QoE telemetry, third party analytics on the agora.io domain and any recording always require prior consent.

Consent requirements

Best practice is to load the Agora SDK only after the user has clicked a clear call to action such as Start call, Join room or Enable camera. That click can serve as the legal basis under Art. 6(1)(b) GDPR (contract performance) for the strictly necessary session identifiers. A separate opt in is required for optional recording, transcription, AI based voice analytics and any quality survey or marketing telemetry that goes to third party analytics on the publisher domain.

In the European Union the EDPB consistently considers voice and video processing as high risk, so consent should be granular (call vs recording vs transcription vs analytics), informed (the privacy notice must mention US transfers and the Agora SD RTN) and as easy to withdraw as to give.

International data transfers

Agora Inc. is established in the United States. Although the SD RTN has edge nodes in Frankfurt, Amsterdam, London, Singapore and Sao Paulo, the control plane, account management and most logs remain in the US. The China region is operated by Shanghai Agora Lab and must be treated as a separate transfer to a country without an adequacy decision.

The Agora DPA incorporates the European Commission Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum. EU customers can request that media servers are pinned to the EU region. A Transfer Impact Assessment should review US surveillance laws (FISA 702, EO 12333) and the additional risk of any China region usage.

Practical compliance steps

Sign the Agora DPA from the Agora console. Configure region restriction to the EU when possible. Defer SDK loading until the user clicks to join a call. Wire recording, transcription and AI analytics to a separate optional consent in your CMP. Add Agora to your Article 30 Record of Processing Activities, list *.agora.io and statscollector domains in your privacy policy and CSP. Document the international transfers, run a Transfer Impact Assessment and complete a DPIA covering voice and video content.