FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

ThriveCart

PreferencesOfficial website

ThriveCart is a US based shopping cart and checkout platform for digital products and online courses that embeds a JavaScript checkout into the merchant site and orchestrates upsells, affiliate tracking and marketing pixels.

Block ThriveCart until consentScan my site
Overview

What does ThriveCart do?

What ThriveCart actually does

ThriveCart is a hosted checkout and sales funnel platform operated by ThriveCart LLC (Phoenix, Arizona). It provides high converting one page checkouts, one click upsells, downsells and bumps, affiliate management, subscription billing through Stripe, PayPal and Authorize.Net, and a lifetime licence model that has made it popular with European information product creators. ThriveCart embeds on the publisher domain via JavaScript or as a full redirect to a thrivecart.com page.

Cookies and storage set by ThriveCart

On the publisher domain ThriveCart sets the first party cookies tc_pixel_v (visitor identifier for the abandonment funnel, 1 year), tc_session (current cart session, 30 minutes) and __tc_affiliate (affiliate referral id, 60 days). On the checkout subdomain thrivecart.com the platform writes its own session, security and CSRF cookies (PHPSESSID, __cf_bm, _tc_csrf). When the publisher activates the ThriveCart Pixel, an additional tc_pixel cookie tracks behaviour across pages for retargeting.

Lawful basis and consent

The checkout flow itself is contractual: performance of the sale (GDPR art. 6(1)(b)), legal obligation to keep invoices (GDPR art. 6(1)(c)) and legitimate interest in fraud prevention. The strictly necessary cookies (session, CSRF, PHPSESSID) are exempt from consent under ePrivacy art. 5(3). The ThriveCart Pixel and the affiliate cookie are non essential and require prior consent. The merchant must also comply with the PSD2 strong customer authentication for any payment above 30 EUR and with the EU consumer rights directive (right to withdraw within 14 days).

International data transfers

ThriveCart LLC is certified under the EU US Data Privacy Framework since 27 October 2023. Customer data is hosted on AWS US East (Virginia) and on Google Cloud Iowa. The Cloudflare CDN serves static assets globally. Card data is tokenised by the payment processor (Stripe, PayPal, Authorize.Net) so it does not transit through ThriveCart in raw form. The ThriveCart DPA incorporates the EU Standard Contractual Clauses and is accepted automatically when the customer signs the terms.

Practical compliance checklist

Gate the ThriveCart Pixel behind the marketing category of your CMP. Disable the affiliate tracking cookie if you do not run an affiliate programme. Display the price including VAT for European customers and integrate a VAT MOSS report through the ThriveCart EU VAT module. Provide the right to withdraw within 14 days for distance contracts. Document ThriveCart LLC and the payment processors in your records of processing (GDPR art. 30) and in the privacy notice. Run a DPIA if the cart processes special categories of data (health products, religious content).

Alternatives

Direct alternatives include SamCart, ClickFunnels, PayKickStart, Kajabi (US bundle), Podia, and EU options like Lemon Squeezy (Merchant of Record based in Ireland), Paddle (UK and Ireland), Digistore24 (Germany), and Stripe Checkout when paired with a self hosted shop.

Compliance

ThriveCart and the GDPR

ThriveCart is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
For the checkout itself (entering name, email, card data, performing the purchase): performance of a contract (GDPR art. 6(1)(b)) and legal obligation for accounting and tax records. For embedded ThriveCart Pixel, cart abandonment retargeting and behavioural cookies: consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) is required before loading the script.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, PSD2 SCA, PCI DSS, EU consumer rights directive, German BGB §312j, French Code de la consommation art. L221, TTDSG, LOPDGDD, LIL

Impact assessment (DPIA)

A DPIA is recommended because ThriveCart processes payment, billing and behavioural data of European customers in the US. Document the categories, retention and Schrems II safeguards.

Sample text for your banner

We use ThriveCart, a US based shopping cart provided by ThriveCart LLC, to process your purchase. The checkout itself relies on the contract you place with us (GDPR art. 6(1)(b)) and on the legal obligation to keep accounting records; we therefore do not ask for cookie consent to display it. The ThriveCart Pixel that powers cart abandonment retargeting and behavioural analytics is only loaded if you accept the marketing or analytics category in our cookie preferences. Your name, email, billing data and payment metadata are processed by ThriveCart in the United States under the EU US Data Privacy Framework and the EU Standard Contractual Clauses.
Cookies and trackers

What ThriveCart sets and contacts

Tracking method
hosted_checkout_javascript_embed_and_redirect
Server location
ThriveCart is operated from the United States on AWS US East (Virginia) and Google Cloud Iowa. The checkout page is served from thrivecart.com via the global Cloudflare CDN.
Data transferred outside the EU
ThriveCart LLC is established in Phoenix, Arizona. Customer billing data, behavioural events (cart abandonment, upsell decisions) and payment metadata are processed in the United States. Transfers rely on the EU US Data Privacy Framework certification (ThriveCart LLC, active since 27 October 2023) and on the EU Standard Contractual Clauses appended to the customer terms. PCI scope is covered by Stripe, PayPal or Authorize.Net depending on the configured gateway.

Cookies set (13)

NameTypeDurationPurpose
TC_SESSIDFirst party (ThriveCart)SessionMaintains the cart and checkout session for the customer.
tc_sessionfirst_partysessionMaintains the buyer checkout session and cart state on the ThriveCart subdomain.
tc_sessionhttp_cookieSessionStrictly necessary first party cookie that stores the checkout session identifier so the buyer can move between steps (order bump, upsell, confirmation) without losing the order context.
TC_AFFFirst party (ThriveCart)60 daysStores the affiliate referrer used to attribute the sale.
tc_cartfirst_party30 daysRecovers the abandoned cart contents if the buyer returns before completing the checkout.
tc_carthttp_cookie30 daysCookie that remembers the items in the current cart so a returning visitor can resume an abandoned checkout, classified as functional unless the merchant also uses it for behavioural targeting.
tc_affiliatehttp_cookie60 daysMarketing cookie that stores the JV partner identifier responsible for the click that brought the visitor to the checkout, used by the ThriveCart affiliate program for commission attribution.
TC_VISITORFirst party (ThriveCart)13 monthsAnonymous visitor identifier used by the analytics module.
tc_affiliatefirst_party60 days (configurable)Attributes the sale to a JV affiliate partner; not strictly necessary, requires consent under ePrivacy Art. 5(3).
TC_PREPFirst party (ThriveCart)14 daysStores cart preparation state to prefill information when the customer returns.
_fbpfirst_party90 daysSet by the optional Facebook Pixel integration to identify browsers for ad attribution.
tc_couponhttp_cookie7 daysFunctional cookie that pre fills the discount code that the buyer initially clicked on, so it survives across page reloads during the conversion funnel.
_gcl_awfirst_party90 daysSet by the optional Google Ads conversion tag for attribution and remarketing.

Third-party domains contacted (7)

  • thrivecart.com
  • thrivecart.com
  • cart.thrivecart.com
  • cart.thrivecart.com
  • thrivecart-static.s3.amazonaws.com
  • api.thrivecart.com
  • cdn.thrivecart.com
Questions

Frequently asked questions about ThriveCart

Can't find your question? Write to us, we answer fast.

Which cookies does ThriveCart set?

ThriveCart sets strictly necessary cookies (tc_session, tc_cart) to maintain the checkout state, plus tc_affiliate to attribute the sale to a JV partner (typically 60 days, configurable). Any Facebook Pixel (_fbp, _fbc), Google Ads (_gcl_aw) or TikTok pixel that the merchant enables in the dashboard is loaded by the same script and falls under the marketing category.

What cookies does ThriveCart set?

First party cookies TC_SESSID (cart session), TC_AFF (affiliate referrer, 60 days), TC_VISITOR (visitor tracking, 13 months) and TC_PREP (cart preparation, 14 days). Stripe and PayPal may also set their own cookies during the payment step.

Do customers have to consent to ThriveCart?

Consent is not required for the checkout cookies that are strictly necessary to complete the purchase under Article 5(3) ePrivacy. Consent is required for any affiliate cookie and any marketing pixel deployed through ThriveCart, because these cookies are not strictly necessary and combine personal data for advertising purposes.

Do I need consent for ThriveCart?

Strictly necessary cookies (session, fraud) can be loaded without consent. Affiliate and analytics cookies are non essential and require prior consent under Art. 5(3) ePrivacy.

What is the legal basis for processing data through ThriveCart?

The processing of buyer name, email, address and payment details is based on Article 6(1)(b) GDPR, performance of contract. Tax related processing falls under Article 6(1)(c), legal obligation. Marketing pixels and affiliate cookies rely on Article 6(1)(a), consent. Some fraud prevention processing can rely on Article 6(1)(f), legitimate interest.

What is the legal basis for ThriveCart?

Contract performance (Art. 6(1)(b) GDPR) for processing the order. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for affiliate or analytics cookies. Legal obligation (Art. 6(1)(c)) for accounting and tax retention.

Does ThriveCart transfer data to the United States?

Yes. Buyer data is processed on AWS US East (Virginia) by ThriveCart LLC. The EU US Data Privacy Framework decision of 10 July 2023 covers the transfer when ThriveCart is certified; otherwise the DPA includes Standard Contractual Clauses and a documented Transfer Impact Assessment is recommended.

Does ThriveCart transfer data to the US?

Yes. All checkout and customer data is processed in US AWS regions. Transfers rely on EU SCCs; ThriveCart is not currently certified under the EU US Data Privacy Framework, so complete a Transfer Impact Assessment.

Is a DPIA needed for ThriveCart?

A DPIA is advisable when ThriveCart is used for high volume sales, subscriptions, sensitive verticals (health, finance, minors) or when affiliate audiences are exported to advertising networks. The DPIA must analyse the US transfer leg, the joint controllership for affiliate tracking and the chain of payment processors that handle card data.

Do I need a DPIA for ThriveCart?

A DPIA is recommended because of the US transfer, payment data and customer profiling for affiliate marketing. Document the safeguards and retention period.

How do I implement ThriveCart compliantly?

Sign the DPA from the ThriveCart admin, use a CMP that exposes the consent state via Google Consent Mode v2, enable the pixel only after the visitor has opted into the marketing category, and proxy the checkout under your own subdomain when possible to reduce third party cookie issues in Safari and Firefox. Display the affiliate cookie duration in the cookie policy.

How do I implement ThriveCart compliantly?

Sign the DPA, complete an SCC backed TIA, list ThriveCart in your Article 30 record as a processor in a third country, block analytics/affiliate cookies behind your CMP, inform customers in the privacy notice and the checkout footer.

What are the alternatives to ThriveCart?

EU alternatives: Digistore24 (Germany), CopeCart (Germany), Affilo Connect (Spain), Plug'n Paid (Cyprus). For broader checkout: Paddle (Merchant of Record, UK), Mollie (Netherlands), Stripe Checkout (with EU contracting), SamCart (US), Shopify Checkout.

What are the alternatives to ThriveCart?

Alternatives include SamCart, Kajabi Payments, Stripe Checkout combined with FastSpring or Paddle (which act as merchant of record), Lemon Squeezy, and EU based options like SendOwl or Quaderno Connect. Paddle and FastSpring shift the seller of record relationship outside the EU, which simplifies VAT but changes the consent footprint.

How do I keep my cookie policy up to date with ThriveCart?

Re scan your checkout with your CMP after every change (new pixel, new affiliate program, new payment processor), update the cookie register with the new tc_ or pixel cookies, and synchronise the privacy notice when ThriveCart adds new sub processors. Subscribe to the ThriveCart change log to be notified of new integrations.

How do I update my cookie policy for ThriveCart?

List each TC_* cookie with purpose, retention and legal basis. Mention ThriveCart, LLC as a processor located in the US with SCCs, and a link to ThriveCart's privacy policy. Note any payment gateway cookies (Stripe, PayPal) under their own entries.

Same category

More services: E-commerce

See the whole category

PeckaDesign Publicator

PeckaDesign Publicator is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. PeckaDesign Publicator integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, PeckaDesign Publicator helps organizations maintain robust websites that meet user.

Preferences

eviivo

Eviivo is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Eviivo enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Eviivo empowers marketing teams to achieve measurable growth.

Preferences

2ClickShop

2ClickShop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. 2ClickShop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, 2ClickShop helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Convious

Convious is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Convious provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Convious helps deliver the right message to the right audience at the right time.

Marketing

Easylog

Easylog is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Easylog integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Easylog helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Correos

Correos is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Correos integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Correos helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site