> How the AfterShip shipment tracking widget handles cookies, consent, transfers to Hong Kong and the United States, and GDPR and ePrivacy obligations.
>
> Canonical: https://www.flowconsent.com/en/services/ecommerce/aftership

E-commerce

# AfterShip

Preferences · [Official website](https://www.aftership.com)

AfterShip is a Hong Kong based SaaS platform that aggregates shipment tracking data from more than 1100 carriers and powers branded tracking pages, post purchase notifications and returns automation. The tracking widget sets first party cookies on the merchant domain and transmits order, shipment and contact data to AfterShip servers in Hong Kong, the United States and the EU.

[Block AfterShip until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [E-commerce](https://www.flowconsent.com/en/services/ecommerce)

- Consent

  Preferences

- Prior consent

  Required

- Documented cookies

  5

- Third-party domains

  5

- Servers

  Primary infrastructure on AWS in the United States (us east 1) and Hong Kong, with regional points of presence in Europe (Frankfurt) and Singapore. AfterShip Limited is headquartered in Hong Kong with subsidiaries in the US, India and the Netherlands. Enterprise customers may opt for the EU region for data residency.

Overview

## What does AfterShip do?

## **What AfterShip is**

AfterShip is a Hong Kong based SaaS platform launched in 2012 and operated by AfterShip Limited. It connects to more than 1100 carriers worldwide and provides merchants with branded tracking pages, transactional notifications, returns management and post purchase upsells. Stores embed an AfterShip widget or redirect customers to a hosted tracking page, and order data flow into the AfterShip platform via API.

## **Cookies and data collected**

On the merchant domain AfterShip sets first party cookies such as afid (AfterShip device identifier) and \_aftership\_session (session identifier). On the hosted aftership.com tracking page additional cookies for analytics, A B testing and marketing pixels (Meta, Google, TikTok) may be set when the merchant activates them. AfterShip also processes order numbers, tracking numbers, shipping address, email and phone for notifications.

## **GDPR and ePrivacy implications**

Core tracking serves the contract between merchant and buyer and qualifies under Art. 6(1)(b) GDPR. Optional analytics, marketing notifications and retargeting pixels go beyond contractual necessity and need consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive. AfterShip acts as processor for the merchant and as controller for its own service improvement and aggregate analytics.

## **Consent requirements**

Strictly necessary tracking cookies and the transactional shipment status email or SMS do not need prior consent. Any marketing channel, behavioural retargeting on the branded tracking page or post purchase upsell offer that uses behavioural data requires opt in consent collected by a CMP and propagated to AfterShip via tag manager rules or AfterShip consent settings.

## **Data transfers**

Order and contact data flow to AfterShip infrastructure in the United States and Hong Kong, with optional EU residency for enterprise plans. Hong Kong has no adequacy decision under Art. 45 GDPR, so transfers rely on Standard Contractual Clauses (Art. 46 GDPR) and supplementary measures. A Transfer Impact Assessment is mandatory and the privacy policy must list AfterShip as a recipient outside the EEA.

## **Practical compliance steps**

Sign the AfterShip Data Processing Addendum, include the SCCs in module two configuration, run a Transfer Impact Assessment for Hong Kong and the United States, configure the CMP to block marketing pixels and analytics on the tracking page until consent, list AfterShip as a subprocessor in the privacy policy and document the retention periods set in the AfterShip dashboard.

Compliance

## AfterShip and the GDPR

AfterShip is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

- Legal basis

  Contractual necessity under Art. 6(1)(b) GDPR for the core shipment tracking functionality (the user expects delivery updates). Marketing notifications, branded tracking page analytics, retargeting pixels and post purchase upsell features require explicit consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive.

- Risk level

  medium

- Applicable regulations

  GDPR, ePrivacy Directive (Cookie Law), CCPA, PDPO (Hong Kong), PIPL (where applicable)

### Impact assessment (DPIA)

A DPIA is recommended whenever AfterShip is deployed beyond strictly necessary tracking, in particular when post purchase marketing notifications, branded tracking page analytics, retargeting pixels or AI powered estimated delivery models are enabled. Address the international transfer to Hong Kong and the United States, the volume of order and contact data, and the use of contact details for behavioural triggers. Document the supplementary measures around the SCCs.

### Sample text for your banner

> We use AfterShip to keep you informed about your shipments. The afid and \_aftership\_session cookies are strictly necessary for tracking your order and are set on the basis of contractual necessity. Optional marketing notifications, retargeting and tracking page analytics are activated only after you click accept in our privacy banner.

Cookies and trackers

## What AfterShip sets and contacts

- Tracking method

  Client side JavaScript widget plus REST API. The AfterShip Tracking Button and branded tracking page load a tracking.js script from cdn.aftership.com that sets first party cookies on the merchant domain (afid for the AfterShip identifier, \_aftership\_session for session) and may set third party cookies on aftership.com when the customer redirects to the hosted tracking page. Order, shipment, address and email or phone data are transmitted to AfterShip via API.

- Server location

  Primary infrastructure on AWS in the United States (us east 1) and Hong Kong, with regional points of presence in Europe (Frankfurt) and Singapore. AfterShip Limited is headquartered in Hong Kong with subsidiaries in the US, India and the Netherlands. Enterprise customers may opt for the EU region for data residency.

- Data transferred outside the EU

  AfterShip Limited is established in Hong Kong, a third country under the GDPR with no adequacy decision. Even with EU regional storage, support, telemetry and machine learning models route data through Hong Kong, the United States and India. AfterShip relies on Standard Contractual Clauses and supplementary measures, customers must complete a Transfer Impact Assessment and update their privacy policy accordingly.

### Cookies set (5)

| Name                 | Type        | Duration | Purpose                                                                                                    |
| -------------------- | ----------- | -------- | ---------------------------------------------------------------------------------------------------------- |
| afid                 | first party | 1 year   | AfterShip device identifier used to recognise the same visitor across visits to the branded tracking page. |
| \_aftership\_session | first party | session  | Session identifier for the current visit to the tracking widget or branded tracking page.                  |
| \_aftership\_visitor | first party | 1 year   | Stable visitor identifier used to attribute marketing events on the branded tracking page.                 |
| \_aftership\_ab      | first party | 90 days  | Stores A B testing variants assigned by AfterShip on the branded tracking page.                            |
| \_ga                 | third party | 2 years  | Google Analytics 4 client identifier loaded by AfterShip when the merchant connects a GA4 property.        |

### Third-party domains contacted (5)

- `aftership.com`
- `cdn.aftership.com`
- `api.aftership.com`
- `track.aftership.com`
- `analytics.aftership.com`

Questions

## Frequently asked questions about AfterShip

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Which cookies does AfterShip set?

AfterShip sets first party cookies afid (1 year), \_aftership\_session (session), \_aftership\_visitor (1 year) and \_aftership\_ab (90 days) for tracking and A B testing. When the merchant enables analytics or marketing integrations, AfterShip also injects \_ga, Meta Pixel, TikTok Pixel and Google Ads cookies on the branded tracking page.

### Do I need consent for AfterShip?

Strictly necessary tracking cookies and the transactional notifications rely on contractual necessity, so no consent is required. Optional analytics, marketing pixels and behavioural retargeting on the branded tracking page require explicit opt in consent under Art. 5(3) ePrivacy Directive and Art. 6(1)(a) GDPR.

### What legal basis applies?

Core shipment tracking and transactional updates rely on Art. 6(1)(b) GDPR (performance of the sales contract). Marketing notifications and retargeting rely on Art. 6(1)(a) GDPR (consent). Internal fraud prevention and product analytics by AfterShip rely on Art. 6(1)(f) GDPR (legitimate interest).

### Are data transferred outside the EU?

Yes. Order and contact data flow to AfterShip infrastructure in the United States and Hong Kong by default, with optional EU residency for enterprise plans. Hong Kong has no adequacy decision, so AfterShip relies on Standard Contractual Clauses plus supplementary measures, and a Transfer Impact Assessment is required.

### Is a DPIA required?

A DPIA is recommended for deployments that include marketing notifications, behavioural retargeting, AI estimated delivery models or processing of large order volumes. Cover the international transfer to Hong Kong and the United States, the volume of contact data and the post purchase profiling.

### How do I deploy AfterShip compliantly?

Sign the AfterShip DPA with SCCs, run a Transfer Impact Assessment, integrate AfterShip behind your CMP so marketing pixels and analytics on the tracking page are blocked before consent, configure data retention and customer deletion in the AfterShip dashboard, and list AfterShip as a subprocessor in the privacy policy.

### What are the alternatives to AfterShip?

EU based alternatives include Shipup (France), Sendcloud Tracking (Netherlands), parcelLab (Germany), Trackify and Outvio (Spain). For self hosted control, merchants can build a custom integration directly with carrier APIs and host the tracking page on EU infrastructure.

### How should AfterShip appear in my cookie policy?

List the afid, \_aftership\_session, \_aftership\_visitor and \_aftership\_ab cookies under functional cookies with their respective durations, mention AfterShip Limited as a Hong Kong based subprocessor, link to the AfterShip privacy policy and state that transfers rely on Standard Contractual Clauses.

Same category

## More services: E-commerce

[See the whole category](https://www.flowconsent.com/en/services/ecommerce)

### [ParcelPanel](https://www.flowconsent.com/en/services/ecommerce/parcelpanel)

[ParcelPanel is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ParcelPanel integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ParcelPanel helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/parcelpanel)

[E-commerce](https://www.flowconsent.com/en/services/ecommerce/parcelpanel)

·

### [Dandomain](https://www.flowconsent.com/en/services/ecommerce/dandomain)

[DanDomain is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. DanDomain integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, DanDomain helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/dandomain)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/dandomain)

·

### [Reshop](https://www.flowconsent.com/en/services/ecommerce/reshop)

[Reshop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Reshop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Reshop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/reshop)

[E-commerce](https://www.flowconsent.com/en/services/ecommerce/reshop)

·

### [Mixin](https://www.flowconsent.com/en/services/ecommerce/mixin)

[Mixin is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mixin supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mixin ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/mixin)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/mixin)

·

### [Shop Pay Installments](https://www.flowconsent.com/en/services/ecommerce/shop-pay-installments)

[Shop Pay Installments is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, Shop Pay Installments delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.](https://www.flowconsent.com/en/services/ecommerce/shop-pay-installments)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/shop-pay-installments)

·

### [AlumnIQ](https://www.flowconsent.com/en/services/ecommerce/alumniq)

[AlumnIQ is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AlumnIQ supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AlumnIQ ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/alumniq)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/alumniq)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)