> Is Patreon GDPR compliant? Which cookies the Patreon embed sets, why consent is required and how data transfers to the US are covered by SCCs and DPF. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/patreon E-commerce # Patreon Preferences · [Official website](https://www.patreon.com) Patreon is a US based membership platform headquartered in San Francisco that lets creators run paid recurring memberships, drip content and patron only communities. Creators set up tiers on patreon.com and either link to their public Patreon page or embed a join button and tier widgets on their own site. The embed sets non strictly necessary cookies, and Patreon acts as the merchant of record for digital memberships in the EU, collecting EU VAT on the creator's behalf. EU sites must gate the embed behind consent and document the US transfer. [Block Patreon until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 5 - Servers United States (Patreon Inc., San Francisco, California, headquarters); production hosted on Google Cloud Platform US regions and AWS US East; static assets and patron media served from Cloudflare and Patreon's own usercontent CDN with EU edge presence Overview ## What does Patreon do? ## **What is Patreon?** Patreon is a US based membership platform incorporated as Patreon Inc., founded in 2013 by Jack Conte and Sam Yam, with headquarters in San Francisco. Creators (musicians, podcasters, illustrators, news outlets, software developers) set up a Patreon page, define monthly or annual tiers and publish exclusive posts, audio, video or downloads for their paying patrons. Patreon hosts the public page, the patron portal, the messaging and the audio/video player. For most EU patrons paying for digital memberships, Patreon is the merchant of record: Patreon collects the EU VAT, issues the receipt and pays the creator the net revenue. Payments are routed through Stripe and PayPal. ## **Cookies and data collected** When a Patreon embed is on the creator's own site, JavaScript loads from c.patreon.com or c10.patreonusercontent.com. The embed opens an iframe to patreon.com that sets first party Patreon cookies (session, csrf, patreon device id, patreon language preference) and Cloudflare bot management cookies. Stripe and PayPal flows during checkout add \_\_stripe\_mid, \_\_stripe\_sid, m and paypal\_\* cookies. Patreon itself runs Google Analytics 4, Optimizely, Sentry and Segment on patreon.com. ## **GDPR and ePrivacy implications** Loading the Patreon embed sets non strictly necessary cookies before the visitor acts, which triggers Art. 5(3) ePrivacy and requires prior consent in the EU. Once the visitor joins on patreon.com, the membership processing is on contract performance and Patreon acts as a separate controller for the VAT and tax data. Patreon also processes patron messages, posts and rewards on the creator's behalf, with creators acting as joint controllers for that content. ## **Consent and implementation** For EU traffic, replace the embed by a plain link to the public Patreon page until the visitor has accepted the functional or marketing category in your CMP. Once consent is given, the Patreon embed and the join button can load. Once on patreon.com, the patron is subject to Patreon's own privacy notice and cookie controls. ## **International data transfers** Patreon processes EU patron data on Google Cloud US and AWS US East. The Patreon DPA includes the EU Standard Contractual Clauses (modules 2 and 3) and the UK IDTA, and Patreon is self certified under the EU US Data Privacy Framework. Onward transfers happen to Stripe and PayPal, which apply their own SCCs and DPF certifications. ## **Practical compliance steps** Sign the Patreon DPA from your creator settings. Gate the embed behind a CMP. List Patreon, Stripe and PayPal in your privacy notice and Article 30 record. Document the US transfer with SCCs and DPF. Update your terms so refunds, VAT receipts and disputes go through Patreon as merchant of record for digital memberships in the EU. Compliance ## Patreon and the GDPR Patreon is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the Patreon embed widget and join button loaded on the creator's own site, because they set non strictly necessary cookies before any visitor action. Contract performance (Art. 6(1)(b)) for the membership the patron subscribes to on patreon.com. Legal obligation (Art. 6(1)(c)) for EU VAT, AML and tax record keeping, since Patreon is the merchant of record for digital memberships. - Risk level medium - Applicable regulations GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, EU VAT Directive (Council Directive 2006/112/EC), PSD2, PCI DSS, US CCPA/CPRA ### Impact assessment (DPIA) A DPIA is not normally required for a creator with a small Patreon. It can become relevant for media operations using Patreon alongside extensive analytics, profiling, course completion tracking and AI driven content delivery on the same audience. ### Sample text for your banner > Memberships on this site are powered by Patreon (Patreon Inc., United States), our merchant of record for digital memberships in the EU. The Patreon embed sets functional and analytics cookies, opens a page on patreon.com, processes payments through Stripe and PayPal and remits EU VAT on our behalf. International transfers to the US are covered by Standard Contractual Clauses and the EU US Data Privacy Framework. Cookies and trackers ## What Patreon sets and contacts - Tracking method Membership and recurring revenue platform: hosted public pages on patreon.com, an embeddable join button loaded from c10.patreonusercontent.com / c.patreon.com, plus tag based widgets that display Patron tiers; first party Patreon session, CSRF and identification cookies are set on patreon.com, Stripe and PayPal handle the payment iframe and recurring billing - Server location United States (Patreon Inc., San Francisco, California, headquarters); production hosted on Google Cloud Platform US regions and AWS US East; static assets and patron media served from Cloudflare and Patreon's own usercontent CDN with EU edge presence - Data transferred outside the EU Patreon Inc. is established in the United States. Personal data of patrons (names, emails, address for physical rewards, payment metadata, message history) is processed on GCP US and AWS US East. Patreon is self certified under the EU US Data Privacy Framework, and its DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum. As merchant of record for digital memberships in the EU, Patreon also collects EU VAT on behalf of creators. ### Cookies set (6) | Name | Type | Duration | Purpose | | ------------------- | ------------ | ---------- | ---------------------------------------------------------------------------------------------------------------------------------- | | session\_id | third\_party | 2 weeks | Patreon functional session cookie set on patreon.com to keep an authenticated patron session and the in progress membership flow. | | csrf\_token | third\_party | Session | CSRF protection token for Patreon API calls during the membership and payment flow. | | patreon\_device\_id | third\_party | 1 year | Persistent Patreon device identifier used to recognise the same browser across sessions and to detect suspicious sign in attempts. | | \_\_cf\_bm | third\_party | 30 minutes | Cloudflare bot management cookie set on patreon.com to distinguish humans from automated traffic. | | \_\_stripe\_mid | third\_party | 1 year | Stripe machine identifier loaded during the Patreon Stripe checkout step for fraud prevention. | | \_\_stripe\_sid | third\_party | 30 minutes | Stripe session identifier loaded during the Patreon Stripe checkout step for fraud detection. | ### Third-party domains contacted (5) - `patreon.com` - `c.patreon.com` - `c10.patreonusercontent.com` - `js.stripe.com` - `www.paypal.com` Questions ## Frequently asked questions about Patreon Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Patreon set? When the Patreon embed loads, it sets first party Patreon cookies on patreon.com (session\_id, csrf\_token, patreon\_device\_id, locale) and Cloudflare bot management cookies (\_\_cf\_bm, \_cfuvid). The Stripe checkout adds \_\_stripe\_mid, \_\_stripe\_sid and m; PayPal adds paypal\_\* cookies. Patreon's own site runs Google Analytics 4, Optimizely, Sentry and Segment. ### Do I need consent to load the Patreon embed? Yes. The embed sets non strictly necessary cookies before any visitor action, so Art. 5(3) ePrivacy requires prior consent in the EU. Use a CMP to gate the embed and rely on a plain link to the public Patreon page until consent is given. ### What is the legal basis for using Patreon? Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the embed cookies. Contract performance (Art. 6(1)(b)) for the membership processing on patreon.com. Legal obligation (Art. 6(1)(c)) for EU VAT collection, since Patreon is the merchant of record for digital memberships in the EU. ### Does Patreon transfer data to third countries? Yes. Patreon Inc. is established in the United States and processes EU patron data on Google Cloud US and AWS US East. The Patreon DPA incorporates the EU Standard Contractual Clauses and the UK IDTA, and Patreon is self certified under the EU US Data Privacy Framework. Stripe and PayPal apply their own SCCs and DPF certifications. ### Do I need a DPIA for Patreon? A DPIA is not normally required for a small creator using Patreon as a tip jar. It can become appropriate for media operations using Patreon alongside extensive analytics, profiling, course completion tracking and AI content delivery on the same audience. ### How do I implement Patreon compliantly? Sign the Patreon DPA, gate the embed behind a CMP, list Patreon, Stripe and PayPal in your privacy notice and Article 30 record, document the US transfer with SCCs and DPF, and direct refund, VAT receipt and dispute requests to Patreon as merchant of record. ### Are there alternatives to Patreon? EU friendly alternatives include Steady (Germany), Tipeee (France), Liberapay (France, non profit), Ko fi (UK), Buy Me a Coffee (US), Substack (US with DPF), Beehiiv (US with DPF) and self managed setups based on Stripe Billing or Mollie subscriptions. ### How should I update my cookie and privacy policy for Patreon? List the Patreon, Cloudflare, Stripe and PayPal cookies in your cookie policy with their categories and durations. In your privacy notice describe Patreon as your membership platform and merchant of record, the embed, the iframe to patreon.com, the US transfer with SCCs and DPF and the role of Stripe and PayPal as separate processors. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Partial.ly](https://www.flowconsent.com/en/services/ecommerce/partial-ly) [Partial.ly is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Partial.ly supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Partial.ly ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/partial-ly) [Preferences](https://www.flowconsent.com/en/services/ecommerce/partial-ly) · ### [CareCart Sales Pop Up](https://www.flowconsent.com/en/services/ecommerce/carecart-sales-pop-up) [CareCart Sales Pop Up is a conversion optimization tool that helps websites create engaging popups, overlays, and on-site messages to capture leads and boost conversions. It features an intuitive visual builder, advanced targeting rules, and A/B testing. CareCart Sales Pop Up supports exit-intent detection, scroll triggers, and time-based displays, ensuring messages appear at the optimal moment. With CRM and email marketing integrations, CareCart Sales Pop Up helps businesses grow subscriber lists and.](https://www.flowconsent.com/en/services/ecommerce/carecart-sales-pop-up) [Preferences](https://www.flowconsent.com/en/services/ecommerce/carecart-sales-pop-up) · ### [Convertim](https://www.flowconsent.com/en/services/ecommerce/convertim) [Convertim is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Convertim supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Convertim ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/convertim) [Preferences](https://www.flowconsent.com/en/services/ecommerce/convertim) · ### [Projesoft](https://www.flowconsent.com/en/services/ecommerce/projesoft) [Projesoft is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Projesoft supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Projesoft ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/projesoft) [Preferences](https://www.flowconsent.com/en/services/ecommerce/projesoft) · ### [Lojas Online CTT](https://www.flowconsent.com/en/services/ecommerce/lojas-online-ctt) [Lojas Online CTT is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, Lojas Online CTT delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.](https://www.flowconsent.com/en/services/ecommerce/lojas-online-ctt) [Preferences](https://www.flowconsent.com/en/services/ecommerce/lojas-online-ctt) · ### [Searchanise](https://www.flowconsent.com/en/services/ecommerce/searchanise) [Searchanise is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Searchanise offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Searchanise empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/ecommerce/searchanise) [Analytics](https://www.flowconsent.com/en/services/ecommerce/searchanise) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)