> Using Dropbox under GDPR: EU data residency on Business Advanced, US CLOUD Act exposure and cookies of the Chooser, Saver and Embedder components. > > Canonical: https://www.flowconsent.com/en/services/hosting/dropbox Hosting # Dropbox Preferences · [Official website](https://www.dropbox.com) Dropbox is a cloud file storage, sharing and collaboration service from Dropbox Inc. (San Francisco). On a website it appears in two main forms: as a backend storage processor for user uploaded files (via the Dropbox API or third party connectors), or as an embedded component, the Dropbox Chooser, Saver or Embedder, that lets visitors interact with Dropbox content from the operator's page. The embedded components load JavaScript and cookies from dropbox.com, which triggers consent requirements under ePrivacy. [Block Dropbox until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Preferences - Prior consent Required - Documented cookies 5 - Third-party domains 5 - Servers United States primary (Dropbox Inc., San Francisco) with EU residency option (Dropbox Business Advanced plus customers can opt into German data centres operated by Dropbox in Frankfurt for content storage). Account metadata and audit logs remain in the US even with EU content residency. Overview ## What does Dropbox do? ## **What Dropbox is** Dropbox is one of the original cloud file storage and synchronisation services, operated by Dropbox Inc., headquartered in San Francisco and listed on NASDAQ. On a website, Dropbox appears either as a backend storage processor (the operator uses the Dropbox API or a third party connector to store files in a Dropbox account) or as an embedded component (Dropbox Chooser to pick a file from the visitor's Dropbox, Dropbox Saver to save a file into the visitor's Dropbox, Dropbox Embedder to preview a shared file). The embedded components are JavaScript widgets loaded from www\.dropbox.com. ## **Data flows by use case** For backend storage, the operator's server uploads files to a Dropbox folder via the API. The file content and metadata sit in Dropbox infrastructure. For embedded components, the visitor's browser loads JavaScript directly from dropbox.com and authenticates against the visitor's own Dropbox account. In that flow, Dropbox sees the visitor's IP address, user agent, the referring URL of the operator's page, and the visitor's Dropbox account identity. Dropbox sets a handful of cookies (lid, gvc, t, hp\_session) on the dropbox.com domain. ## **GDPR and ePrivacy implications** For backend storage, GDPR applies and Dropbox acts as a data processor under its Business Agreement and Data Processing Addendum. ePrivacy Art. 5(3) does not apply unless cookies are set on the visitor's device. For embedded components, both apply: cookies on dropbox.com require consent, and the personal data shared with Dropbox (IP, account identity, referrer) is subject to the GDPR. Operators should treat embedded components as third party widgets that need a granular consent gate (functional or marketing depending on use case). ## **Data residency and US CLOUD Act** Dropbox Business Advanced and Enterprise plans include EU data residency: file content is stored in Dropbox owned data centres in Germany (Frankfurt). Account metadata, sharing audit logs and team management data still flow to US infrastructure. Dropbox Inc. is a US company subject to the US CLOUD Act, which European supervisors (BfDI, DSK, CNIL) flag as a residual transfer concern. Dropbox self certifies under the EU US Data Privacy Framework and provides Standard Contractual Clauses. For HIPAA covered entities, Dropbox offers a separate HIPAA addendum. ## **Encryption and key management** Dropbox encrypts files at rest with AES 256 and in transit with TLS 1.2+. Key management is provider managed on standard plans. Operators with high sensitivity needs can use client side encryption tools like Cryptomator before uploading files to Dropbox, which removes Dropbox's ability to read content but is incompatible with Dropbox preview and search features. Enterprise plans offer additional security controls including watermarking, advanced audit logs and granular admin controls. ## **Practical compliance steps** Sign the Dropbox Business Agreement and the Data Processing Addendum. For EU content residency, subscribe to Business Advanced or Enterprise and enable the EU storage option. Document Dropbox as a processor in the record of processing with the data categories, the storage location, the retention period and the US transfer mechanism. For embedded components on public pages, wrap them in a Consent Management Platform gate (functional or marketing) and list the dropbox.com cookies in the cookie policy. Run a Transfer Impact Assessment for any storage of personal data, with mitigations (EU residency, encryption, limited admin access). Compliance ## Dropbox and the GDPR Dropbox is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Depends on use case. Contract necessity (GDPR Art. 6(1)(b)) for storing user uploaded files as part of a service. Consent (Art. 6(1)(a)) for Dropbox Embedder previews, share buttons or sign in flows loaded on public pages with cookies. Legitimate interest (Art. 6(1)(f)) for backend file storage of business records. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (for embedded components that load cookies), US CLOUD Act, German BfDI guidance on US cloud services, French CNIL guidance on hyperscalers, Schrems II case law ### Impact assessment (DPIA) Dropbox processing differs by use case. DPIA considerations: (1) for backend file storage, content can be stored in German data centres if the operator subscribes to Dropbox Business Advanced or Enterprise; account metadata and audit logs still flow to the US; (2) US CLOUD Act exposure is the main residual transfer risk, as Dropbox Inc. is a US company; (3) Dropbox Chooser, Saver and Embedder components load JavaScript from dropbox.com on the operator's page, which sets cookies (lid, gvc, t, hp\_session) and creates a third party tracking touchpoint requiring consent; (4) if file content includes special category data (health records, identity documents, financial), the DPIA must reflect the higher risk and the operator should evaluate Dropbox encryption options or self managed encryption keys; (5) Dropbox supports its own Data Processing Addendum and Standard Contractual Clauses, plus a Business Advanced HIPAA option for healthcare. A DPIA is recommended whenever Dropbox is used for special category data or as a primary backend storage of personal data. ### Sample text for your banner > We use Dropbox from Dropbox Inc. as our cloud file storage and sharing platform. For our business plan, file content is stored in Dropbox data centres in Germany, while account metadata and audit logs are processed by Dropbox in the United States. Dropbox Inc. is exposed to the US CLOUD Act, so we have signed Standard Contractual Clauses and rely on the EU US Data Privacy Framework. If you see a Dropbox embedded preview or button on our site, Dropbox sets cookies on dropbox.com and you can refuse consent in our cookie settings. Cookies and trackers ## What Dropbox sets and contacts - Tracking method Cloud file storage, sharing and collaboration service. Used as backend storage for user uploaded files, or to embed Dropbox file previews and document picker components into a website via the Dropbox Chooser and Embedder JavaScript SDKs. When the embedded components load on a public website, Dropbox sets first party and third party cookies on dropbox.com to identify the visitor and maintain sharing session state. - Server location United States primary (Dropbox Inc., San Francisco) with EU residency option (Dropbox Business Advanced plus customers can opt into German data centres operated by Dropbox in Frankfurt for content storage). Account metadata and audit logs remain in the US even with EU content residency. - Data transferred outside the EU Dropbox Inc. is a US company headquartered in San Francisco. Default deployment processes both content and metadata on US AWS infrastructure. EU residency for file content is available on Dropbox Business Advanced and Dropbox Business Enterprise plans, with content stored in German data centres, but account metadata and audit logs remain in the US. Dropbox self certifies under the EU US Data Privacy Framework and offers Standard Contractual Clauses for transfers outside the DPF. ### Cookies set (5) | Name | Type | Duration | Purpose | | ----------- | ------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | lid | Functional / Marketing | 11 months | Set by Dropbox on dropbox.com. Persistent identifier used to recognise the visitor across visits to Dropbox properties and embedded components. | | gvc | Functional | 11 months | Set by Dropbox on dropbox.com. Stores a Google verification challenge value used during Dropbox sign in flows that involve Google accounts. | | t | Strictly Necessary / Functional | Session | Set by Dropbox on dropbox.com. CSRF protection token used to validate requests during interactive flows (sign in, file sharing, Chooser, Saver). | | hp\_session | Functional | Session | Set by Dropbox on dropbox.com. Session identifier used by the Dropbox home page and embedded components to maintain the visitor's session state across navigation. | | bjar | Marketing | 13 months | Set by Dropbox on dropbox.com. Used for advertising attribution and audience building across Dropbox campaigns. | ### Third-party domains contacted (5) - `dropbox.com` - `www.dropbox.com` - `cfl.dropboxstatic.com` - `api.dropboxapi.com` - `content.dropboxapi.com` Questions ## Frequently asked questions about Dropbox Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Dropbox set? Dropbox itself does not set cookies on the operator's domain when used as backend storage. When the Dropbox Chooser, Saver or Embedder is loaded on a public page, Dropbox sets cookies on the dropbox.com domain (lid, gvc, t, hp\_session, and others depending on whether the visitor is signed in to a Dropbox account). ### Is consent required for Dropbox? For backend storage, consent depends on the underlying processing purpose, not on Dropbox itself. For embedded components on public pages, the dropbox.com cookies are not strictly necessary and ePrivacy Art. 5(3) requires prior consent before the component loads. ### What is the legal basis for Dropbox processing? Backend storage typically rests on contract necessity under Art. 6(1)(b) (when storing files for a service the user signed up to) or legitimate interest under Art. 6(1)(f) (for internal business document storage). Embedded components require consent under Art. 6(1)(a). ### Does Dropbox transfer data to the United States? Yes by default. EU content residency is available on Business Advanced and Enterprise plans, with file content stored in German data centres, but account metadata and audit logs remain in the US. Dropbox self certifies under the EU US Data Privacy Framework and offers SCCs. US CLOUD Act exposure must be assessed. ### Do I need a DPIA for Dropbox? A DPIA is recommended whenever Dropbox is used for special category data (health, identity documents, financial), or as primary backend storage of personal data at scale. For ad hoc use of embedded components or small scale storage, the DPIA threshold may not be met but documentation in the record of processing is still required. ### How do I implement Dropbox compliantly? Sign the Dropbox Business Agreement and DPA. Subscribe to Business Advanced or Enterprise and enable EU content residency. For embedded components on public pages, gate them behind a Consent Management Platform with explicit user consent. Document Dropbox in the record of processing with data categories, storage location, retention period and US transfer mechanism. Consider client side encryption for very sensitive content. ### What alternatives to Dropbox exist? EU sovereign alternatives include Tresorit (Switzerland, end to end encrypted), pCloud (Switzerland), Sync.com (Canada, zero knowledge), Nextcloud (Germany, self hosted) and OVH Object Storage (France). US alternatives include Box, Google Drive, Microsoft OneDrive and Amazon S3, all with similar US CLOUD Act considerations. ### How should I update my cookie or privacy policy? List Dropbox as a sub processor in the privacy notice with the data categories, the EU content residency status, and the US transfer mechanism. If the Chooser, Saver or Embedder is used on public pages, list the dropbox.com cookies (lid, gvc, t, hp\_session) in the cookie policy as functional or marketing cookies depending on use case. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Mittwald](https://www.flowconsent.com/en/services/hosting/mittwald) [Mittwald is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Mittwald offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Mittwald empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/mittwald) [Hosting](https://www.flowconsent.com/en/services/hosting/mittwald) · ### [Hypercloudhost](https://www.flowconsent.com/en/services/hosting/hypercloudhost) [Hypercloudhost is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hypercloudhost offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hypercloudhost empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/hypercloudhost) [Hosting](https://www.flowconsent.com/en/services/hosting/hypercloudhost) · ### [Nexcess](https://www.flowconsent.com/en/services/hosting/nexcess) [Nexcess is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Nexcess integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Nexcess helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/nexcess) [Hosting](https://www.flowconsent.com/en/services/hosting/nexcess) · ### [i-MSCP](https://www.flowconsent.com/en/services/hosting/i-mscp) [i-MSCP is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. i-MSCP supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, i-MSCP ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/i-mscp) [Hosting](https://www.flowconsent.com/en/services/hosting/i-mscp) · ### [Amazon ELB](https://www.flowconsent.com/en/services/hosting/amazon-elb) [Amazon ELB is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Amazon ELB enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Amazon ELB empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/hosting/amazon-elb) [Essential](https://www.flowconsent.com/en/services/hosting/amazon-elb) · ### [YalinHost](https://www.flowconsent.com/en/services/hosting/yalinhost) [YalinHost is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. YalinHost offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, YalinHost empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/yalinhost) [Hosting](https://www.flowconsent.com/en/services/hosting/yalinhost) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)