Zuora

What Zuora Is

Zuora is a subscription billing and commerce platform used by businesses to manage recurring revenue. It provides hosted checkout pages and a client library known as Zuora.js that collects payment details directly into Zuora controlled fields, which keeps the merchant out of scope for raw card data. The platform handles subscription lifecycle, invoicing, payments and revenue recognition on behalf of the merchant. Zuora is a US headquartered company, and its services run on Amazon Web Services in a region you can select. A default US data center is provided, with an EU data center in Frankfurt and an APAC data center in Japan for customers who need regional residency. Because billing data accumulates over time, understanding where it is stored and which cookies are set is essential for compliance.

Cookies and Data Collected

The Zuora hosted checkout and Zuora.js can set strictly necessary cookies that operate the payment page and secure the session, which do not require consent. Zuora corporate and marketing pages additionally use analytics and advertising cookies, and Zuora states that it and its partners use cookies including for advertising, which are not strictly necessary and require consent. The data collected through the platform includes payment details, subscription and billing information, contact data and technical metadata such as IP address used to operate and secure the service. The billing data is processed by Zuora as a processor acting on the merchant's documented instructions. The distinction between the necessary checkout cookies and the optional analytics and advertising cookies must be reflected clearly in your cookie banner and policy. Always confirm the live cookie behaviour in your own deployment.

GDPR and ePrivacy Implications

Under the GDPR the legal basis for processing a subscription and billing the customer is contract performance, while fraud prevention and securing the checkout rest on legitimate interest. Under the ePrivacy Directive the strictly necessary checkout cookies are exempt from consent, but the analytics and advertising cookies require prior opt in. Zuora acts as a processor for the billing data and provides a data processing agreement, so you should sign it and confirm the controller and processor roles. PSD2 introduces obligations such as strong customer authentication for payments, which interacts with the checkout flow. Because Zuora is US headquartered and the default data center is in the US, an international transfer assessment is usually required unless you provision the EU data center. Clear documentation and a robust consent flow are essential.

Consent Requirements and CMP Integration

You do not need consent for the strictly necessary checkout cookies, so the payment page can load and customers can pay. You do need prior consent for the analytics and advertising cookies on Zuora hosted and marketing pages, which should be integrated with your consent management platform and blocked until the visitor accepts the relevant category. A clean pattern is to let the billing and checkout function while gating only the optional tracking. Your consent banner should explain that some cookies are essential to operate and secure the checkout, and that others are optional. Verify that declining the optional categories genuinely prevents those cookies from being set on hosted pages. Keep a record of consent so you can demonstrate compliance to a supervisory authority.

International Data Transfers

Zuora hosts customer data on AWS in a region you can select, with a default US Cloud Data Center in North America, an EU Cloud Data Center with primary hosting in Frankfurt and failover in Ireland, and an APAC data center in Japan. For an EU website the cleanest option is to provision the EU data center so subscription data stays within the EU. If you use the default US data center, or if US based staff can access the data, this is a transfer to a third country that the GDPR only permits with an appropriate safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses, supported by a transfer impact assessment. Document the chosen region and the safeguard in your records of processing and privacy notice. Review the arrangement periodically as the legal landscape evolves.

Practical Compliance Steps

Start by signing the Zuora data processing agreement and choosing the EU data center if you need EU residency for subscription data. Configure your consent management platform so the strictly necessary checkout cookies run while analytics and advertising cookies are blocked until consent. Update your privacy notice and cookie policy to explain the billing processing, the legal bases of contract and legitimate interest, the consent based optional cookies, and the data center region. Set retention periods for billing records that respect tax and financial record keeping rules and apply data minimisation elsewhere. Implement strong customer authentication as required by PSD2 in the checkout flow. Complete a transfer impact assessment where US storage or access applies and, given the volume and sensitivity of billing data, a Data Protection Impact Assessment. Finally, keep your documentation aligned with the live configuration and data center choice.