> Plivo and the GDPR: SMS and voice data processing, transfers to the US under standard contractual clauses and consent for browser calling features. > > Canonical: https://www.flowconsent.com/en/services/customer-support/plivo Customer support # Plivo Preferences · [Official website](https://www.plivo.com) Plivo is a US-based CPaaS (Communications Platform as a Service) competing with Twilio and Vonage. European businesses use Plivo to send transactional and marketing SMS, run voice IVR, deliver one-time passwords, and route phone calls. Although core communications happen server-side, Plivo's browser SDK can load JavaScript for click-to-call, and the platform processes large volumes of phone numbers, call recordings, and message content, falling squarely under the GDPR, the ePrivacy Directive and national telecoms law. [Block Plivo until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Preferences - Prior consent Required - Documented cookies 3 - Third-party domains 5 - Servers Plivo Inc., headquartered in San Francisco, United States. EU regional infrastructure available (Frankfurt) for voice and messaging termination Overview ## What does Plivo do? ## **What is Plivo** Plivo is a US-headquartered Communications Platform as a Service company providing programmable voice, SMS, MMS, WhatsApp Business and verification APIs. It competes with Twilio, Vonage and MessageBird and is popular in Europe for transactional messaging, two-factor authentication, marketing SMS and call centre voice routing. Most usage is backend (server-to-API), but Plivo also ships a JavaScript SDK for WebRTC click-to-call deployed on websites. ## **What data Plivo processes** Plivo handles phone numbers (sender and recipient), SMS content, call duration and routing metadata, call recordings (when enabled), voicemail, IVR keypress inputs, WebRTC session identifiers, IP addresses, and operator-level Mobile Network Code information. For verified-by-Plivo flows, identity documents may also be processed. The browser SDK sets a small number of cookies and localStorage entries to manage WebRTC session state. ## **GDPR and ePrivacy implications** Phone numbers are personal data. Marketing SMS to EU consumers requires prior, explicit consent under Art. 13 ePrivacy and Art. 6(1)(a) GDPR, with no soft opt-in in most member states for new prospects. Transactional SMS (order confirmation, OTP) can rely on contract or legitimate interest. Call recordings require dual consent (caller and recipient) and clear announcement at the start of the call. Plivo's DPA sets the controller and processor relationship and includes the 2021 SCCs for transfers to the United States. ## **Data transfer to the United States** Plivo offers EU regional infrastructure (Frankfurt) which keeps voice and SMS termination in the EU. However, Plivo Inc. as a US controller retains access to metadata, billing data, support interactions and call recordings. The transfer is covered by SCCs and, where applicable, by the EU-US Data Privacy Framework. A Transfer Impact Assessment is required: document the data categories, the supplementary measures (encryption, access controls), and any residual risk of US government access. ## **Consent for marketing SMS and click-to-call** For marketing SMS, collect granular, freely given consent at the point of phone number collection (a separate unchecked box, not bundled with terms of service). Honour STOP replies and maintain a suppression list. For WebRTC click-to-call, the browser SDK requires consent before establishing a media stream; under the ePrivacy Directive the access to the device's microphone is itself a regulated event. Gate the SDK behind a CMP category and provide a clear announcement. ## **Compliance checklist** 1\. Sign the Plivo DPA and select the EU region for storage where available. 2. Map all SMS, voice and recording flows in a Record of Processing Activities. 3. Run a DPIA covering call recording and marketing SMS. 4. Configure your sign-up forms to capture granular SMS consent and store proof of consent. 5. Document Plivo in your privacy notice including US transfer disclosure. 6. Build an automated STOP-reply suppression list. 7. Limit call recording retention to the minimum necessary, with role-based access controls. Compliance ## Plivo and the GDPR Plivo is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for marketing SMS or voice; Contract performance (Art. 6(1)(b) GDPR) for transactional notifications; Legitimate interest (Art. 6(1)(f) GDPR) for fraud prevention and OTP delivery - Risk level high - Applicable regulations GDPR, ePrivacy Directive, ePrivacy Regulation (proposed), TCPA (US), national telecoms acts ### Impact assessment (DPIA) Plivo processes phone numbers, call detail records, SMS message content (including OTPs and marketing copy), call recordings, voicemail, and customer support interactions. Key DPIA considerations: (1) phone number is a direct identifier under GDPR; (2) call recordings may contain special category data (health, beliefs); (3) marketing SMS triggers ePrivacy Art. 13 prior consent rules with no soft opt-in for B2C in most member states; (4) data transfer to US support and engineering; (5) Plivo's sub-processors include cloud providers (AWS) and global telecoms carriers, expanding the data flow map; (6) law enforcement access risks for stored call recordings. A DPIA is strongly recommended for any deployment involving call recording, marketing campaigns, or sensitive verticals. ### Sample text for your banner > I consent to receive SMS communications from \ at the number provided, including marketing messages and product updates. Messages are sent via Plivo Inc. in the United States, under Standard Contractual Clauses. Message frequency varies, message and data rates may apply, and I can opt out at any time by replying STOP. Cookies and trackers ## What Plivo sets and contacts - Tracking method Backend communications API (voice, SMS, MMS, WhatsApp) typically invoked server-side; browser SDK for click-to-call may load JavaScript on the storefront and connect via WebRTC - Server location Plivo Inc., headquartered in San Francisco, United States. EU regional infrastructure available (Frankfurt) for voice and messaging termination - Cookieless mode available Yes - Data transferred outside the EU Even when EU regional endpoints are selected for traffic processing, Plivo as a US-based controller has access to metadata, call detail records and SMS content for operational and support purposes. Transfers are governed by Standard Contractual Clauses included in the Plivo DPA. A Transfer Impact Assessment is required given the volume and nature of communications data. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------------------------- | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- | | plivo\_session | Functional | Session | Stores the WebRTC session token when the Plivo browser SDK is used for click-to-call. Required to maintain the active media stream. | | plivo\_endpoint | Functional | Session | Identifies the JavaScript SDK endpoint instance for signalling and reconnection during WebRTC calls. | | plivo\_consent (localStorage) | Functional | 1 year | Records whether the visitor has accepted the click-to-call notice and microphone access. | ### Third-party domains contacted (5) - `plivo.com` - `api.plivo.com` - `cdn.plivo.com` - `phlo.plivo.com` - `sdk.plivo.com` Questions ## Frequently asked questions about Plivo Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies and storage items does Plivo use? Most usage is server-side and sets no cookies on your visitors. The Plivo browser SDK for WebRTC click-to-call may set plivo\_session, plivo\_endpoint (session identifiers), and store WebRTC media constraints in localStorage. None of these are strictly necessary unless click-to-call is the primary site function. ### Do I need consent for SMS sent through Plivo? Yes for marketing SMS. Under Art. 13 ePrivacy and most national implementations, marketing SMS requires prior, explicit, opt-in consent at the moment the phone number is collected. For transactional SMS such as order confirmations or password resets, you can rely on contract performance or legitimate interest, with transparency in your privacy notice. ### What is the legal basis for one-time passwords (OTP)? OTP delivery is generally based on legitimate interest under Art. 6(1)(f) GDPR for security and fraud prevention, or contract performance when the user requested the authenticated service. A balancing test should be documented, especially for SMS-based 2FA which is now considered weaker than authenticator apps. ### Is data transferred to the United States? Yes. Plivo Inc. is headquartered in San Francisco. Even with EU region selection (Frankfurt), Plivo's US team retains access for support, billing, fraud and engineering purposes. The Plivo DPA includes the 2021 SCCs and Plivo participates in the EU-US Data Privacy Framework where applicable. Document the transfer and run a TIA. ### Do I need a DPIA for Plivo? A DPIA is recommended for any deployment that records calls, performs marketing campaigns to large audiences, or processes sensitive context (health, legal, financial). The combination of voice content, phone numbers and US transfer typically meets Art. 35(3) GDPR criteria. ### How do I deploy Plivo in compliance? Sign the Plivo DPA, select EU region for storage, gate marketing SMS behind granular consent with proof of capture, configure STOP handling and suppression lists, document everything in your Record of Processing Activities, and disclose Plivo and the US transfer in your privacy notice. For voice recording, implement automated retention policies and role-based access. ### What are EU-based alternatives to Plivo? EU-based or EU-hosted CPaaS alternatives include MessageBird (Netherlands, EU), Sinch (Sweden, EU regional), Infobip (Croatia, EU), Vonage (US but with EU regions), and CM.com (Netherlands). For SMS-only flows, Belgian operator Esendex and German Spryng are EU-native options. ### How do I update my cookie policy and privacy notice? If you use the Plivo browser SDK, list plivo\_session and plivo\_endpoint in your cookie policy with their purpose and duration. In your privacy notice, identify Plivo Inc. as a data processor, specify the US transfer (EU-US DPF or SCCs), list the categories of personal data processed (phone numbers, message content, call recordings, IP), and describe data subject rights including deletion of recordings. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [Asapp](https://www.flowconsent.com/en/services/customer-support/asapp) [Asapp is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Asapp offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Asapp empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/customer-support/asapp) [Analytics](https://www.flowconsent.com/en/services/customer-support/asapp) · ### [Front Chat](https://www.flowconsent.com/en/services/customer-support/front-chat) [Front Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. Front Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, Front Chat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/front-chat) [Preferences](https://www.flowconsent.com/en/services/customer-support/front-chat) · ### [Richpanel](https://www.flowconsent.com/en/services/customer-support/richpanel) [Richpanel is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Richpanel provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Richpanel helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/customer-support/richpanel) [Marketing](https://www.flowconsent.com/en/services/customer-support/richpanel) · ### [Let's Connect](https://www.flowconsent.com/en/services/customer-support/let-s-connect) [Let's Connect is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. Let's Connect supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, Let's Connect helps create unified digital ecosystems that drive efficiency.](https://www.flowconsent.com/en/services/customer-support/let-s-connect) [Preferences](https://www.flowconsent.com/en/services/customer-support/let-s-connect) · ### [BookingKoala](https://www.flowconsent.com/en/services/customer-support/bookingkoala) [BookingKoala is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. BookingKoala supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, BookingKoala ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/customer-support/bookingkoala) [Customer support](https://www.flowconsent.com/en/services/customer-support/bookingkoala) · ### [Hesk](https://www.flowconsent.com/en/services/customer-support/hesk) [Hesk is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Hesk provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Hesk helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/customer-support/hesk) [Marketing](https://www.flowconsent.com/en/services/customer-support/hesk) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)