Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Zuora is a subscription billing and commerce platform that powers recurring billing, hosted checkout pages and the Zuora.js client library for collecting payment details. Its checkout sets strictly necessary cookies to operate and secure the payment, while Zuora hosted and marketing pages use analytics and advertising cookies that require consent. Subscription data is hosted on AWS in a customer selectable region, with a US default data center and an EU option in Frankfurt. Because Zuora is US headquartered, EU use can involve a transfer to a third country unless EU residency is provisioned.
Zuora is a subscription billing and commerce platform used by businesses to manage recurring revenue. It provides hosted checkout pages and a client library known as Zuora.js that collects payment details directly into Zuora controlled fields, which keeps the merchant out of scope for raw card data. The platform handles subscription lifecycle, invoicing, payments and revenue recognition on behalf of the merchant. Zuora is a US headquartered company, and its services run on Amazon Web Services in a region you can select. A default US data center is provided, with an EU data center in Frankfurt and an APAC data center in Japan for customers who need regional residency. Because billing data accumulates over time, understanding where it is stored and which cookies are set is essential for compliance.
The Zuora hosted checkout and Zuora.js can set strictly necessary cookies that operate the payment page and secure the session, which do not require consent. Zuora corporate and marketing pages additionally use analytics and advertising cookies, and Zuora states that it and its partners use cookies including for advertising, which are not strictly necessary and require consent. The data collected through the platform includes payment details, subscription and billing information, contact data and technical metadata such as IP address used to operate and secure the service. The billing data is processed by Zuora as a processor acting on the merchant''s documented instructions. The distinction between the necessary checkout cookies and the optional analytics and advertising cookies must be reflected clearly in your cookie banner and policy. Always confirm the live cookie behaviour in your own deployment.
Under the GDPR the legal basis for processing a subscription and billing the customer is contract performance, while fraud prevention and securing the checkout rest on legitimate interest. Under the ePrivacy Directive the strictly necessary checkout cookies are exempt from consent, but the analytics and advertising cookies require prior opt in. Zuora acts as a processor for the billing data and provides a data processing agreement, so you should sign it and confirm the controller and processor roles. PSD2 introduces obligations such as strong customer authentication for payments, which interacts with the checkout flow. Because Zuora is US headquartered and the default data center is in the US, an international transfer assessment is usually required unless you provision the EU data center. Clear documentation and a robust consent flow are essential.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You do not need consent for the strictly necessary checkout cookies, so the payment page can load and customers can pay. You do need prior consent for the analytics and advertising cookies on Zuora hosted and marketing pages, which should be integrated with your consent management platform and blocked until the visitor accepts the relevant category. A clean pattern is to let the billing and checkout function while gating only the optional tracking. Your consent banner should explain that some cookies are essential to operate and secure the checkout, and that others are optional. Verify that declining the optional categories genuinely prevents those cookies from being set on hosted pages. Keep a record of consent so you can demonstrate compliance to a supervisory authority.
Zuora hosts customer data on AWS in a region you can select, with a default US Cloud Data Center in North America, an EU Cloud Data Center with primary hosting in Frankfurt and failover in Ireland, and an APAC data center in Japan. For an EU website the cleanest option is to provision the EU data center so subscription data stays within the EU. If you use the default US data center, or if US based staff can access the data, this is a transfer to a third country that the GDPR only permits with an appropriate safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses, supported by a transfer impact assessment. Document the chosen region and the safeguard in your records of processing and privacy notice. Review the arrangement periodically as the legal landscape evolves.
Start by signing the Zuora data processing agreement and choosing the EU data center if you need EU residency for subscription data. Configure your consent management platform so the strictly necessary checkout cookies run while analytics and advertising cookies are blocked until consent. Update your privacy notice and cookie policy to explain the billing processing, the legal bases of contract and legitimate interest, the consent based optional cookies, and the data center region. Set retention periods for billing records that respect tax and financial record keeping rules and apply data minimisation elsewhere. Implement strong customer authentication as required by PSD2 in the checkout flow. Complete a transfer impact assessment where US storage or access applies and, given the volume and sensitivity of billing data, a Data Protection Impact Assessment. Finally, keep your documentation aligned with the live configuration and data center choice.
Websites using Zuora must obtain user consent under GDPR regulations.
DPIA considerations
Zuora processes subscription and payment data over time, often building a billing history that can profile customer behaviour, so a careful assessment is warranted. A Data Protection Impact Assessment should document the data collected at checkout and stored in the billing system, the chosen data center region, the strictly necessary versus consent based cookies, and any access to data from the United States. Record the PSD2 obligations such as strong customer authentication and the retention periods for billing records that may be set by tax and financial law. If you use the default US data center, the transfer safeguard and its impact assessment should be central to the DPIA.
Sample consent text
This website uses Zuora to manage subscriptions and process payments. Cookies that are strictly necessary to operate and secure your checkout are always active. With your consent, we also set analytics and advertising cookies, and your data may be processed in a Zuora data center; you can accept or decline the optional cookies at any time.
Third-party domains contacted
zuora.comstatic.zuora.comrest.zuora.comrest.eu.zuora.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Checkout session | strictly_necessary | session | Operates the hosted checkout and Zuora.js payment page and maintains the secure payment session so the customer can complete the transaction. |
| Security and fraud | strictly_necessary | session to persistent | Secures the checkout session and helps detect irregular behaviour to protect the payment. |
| Analytics | analytics | up to 2 years | Set on Zuora hosted and marketing pages to understand how visitors use the site. Not strictly necessary and requires consent. |
| Advertising | marketing | up to 1 year | Used by Zuora and its partners for advertising purposes. Not strictly necessary and requires consent. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
The Zuora hosted checkout and Zuora.js set strictly necessary cookies to operate the payment page and secure the session, which do not require consent. Zuora corporate and marketing pages additionally use analytics and advertising cookies, which are not strictly necessary and require consent. Always confirm the live cookie behaviour in your own deployment.
Consent is not required for the strictly necessary checkout cookies, so the payment page can function. Consent is required for the analytics and advertising cookies on Zuora hosted and marketing pages, which must be blocked until the visitor accepts the relevant category through your consent banner.
The legal basis is contract performance under GDPR Article 6(1)(b) for processing the subscription and billing the customer requested, plus legitimate interest under Article 6(1)(f) for fraud prevention and securing the checkout. The analytics and advertising cookies need consent under Article 6(1)(a).
It can. Zuora is US headquartered and the default data center is in the US, so without EU provisioning subscription data is stored in a third country. Zuora offers an EU Cloud Data Center in Frankfurt with failover in Ireland; if you use US storage or US access, a safeguard such as the EU US Data Privacy Framework or Standard Contractual Clauses plus a transfer impact assessment is required.
A Data Protection Impact Assessment is advisable because Zuora processes subscription and payment data over time and can build a billing history that profiles customers, particularly at high volumes or with US storage. The DPIA should cover the data collected and stored, the data center region, the cookie categories and any US access.
Sign the Zuora data processing agreement, choose the EU data center if you need EU residency, and integrate the analytics and advertising cookies with your consent management platform so they are blocked until consent. Update your privacy and cookie policies, set retention for billing records, and implement strong customer authentication required by PSD2.
Other subscription billing and payment platforms include Stripe Billing, Chargebee, Recurly and Paddle, each with its own cookie and data residency profile. For the strongest EU data residency, prefer a provider that can store billing data in the EU and keeps optional analytics and advertising cookies clearly separated and consent based.
List the strictly necessary checkout cookies separately from the optional analytics and advertising cookies, with their purpose and approximate duration. State that Zuora is the billing and payment processor, disclose the data center region you use, and note the transfer safeguard if data is stored in or accessed from the US. Review the entry whenever the configuration or data center choice changes.