> Firebase and the GDPR: which services support EU data residency, the consent needed for Firebase Analytics and Crashlytics, and what to disclose. > > Canonical: https://www.flowconsent.com/en/services/hosting/firebase Hosting # Firebase Unclassified · [Official website](https://firebase.google.com) Firebase is a Google Cloud platform of mobile and web backend services widely used in Europe for authentication, real-time databases, push notifications, hosting and analytics. Most Firebase products run on Google infrastructure with default multi-region storage; Cloud Firestore, Cloud Storage and Cloud Functions can be pinned to EU regions while Firebase Analytics and Cloud Messaging currently process data globally with US storage. [Block Firebase until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Unclassified - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers global Google Cloud infrastructure (default multi-region; explicit EU regions available for Cloud Firestore, Cloud Functions and Cloud Storage) Overview ## What does Firebase do? ## **What is Firebase?** Firebase is a Google Cloud platform that bundles mobile and web backend services into a single SDK. Common products include Firebase Authentication, Cloud Firestore, Realtime Database, Firebase Cloud Messaging, Firebase Analytics, Crashlytics, Firebase Hosting and Cloud Functions. It is widely used in Europe for both mobile apps and web applications because it removes the need to operate authentication, database and analytics infrastructure independently. ## **Cookies and data collected** Firebase Authentication stores user credentials, refresh tokens and session identifiers. Cloud Firestore and Realtime Database store the application data the developer chooses to write. Firebase Cloud Messaging stores device tokens for push notifications. Firebase Analytics collects events, screen views, device information, IP addresses and a persistent app instance identifier (the Firebase Installation ID). Crashlytics collects stack traces, device state and user identifiers if attached. ## **GDPR and ePrivacy implications** Authentication, Cloud Firestore and Realtime Database used to deliver the app rely on contract performance (Art. 6(1)(b) GDPR). Firebase Analytics and Crashlytics rely on consent (Art. 6(1)(a) GDPR) and on Art. 5(3) ePrivacy because they read and write identifiers on the device. Firebase Cloud Messaging marketing campaigns require consent. Use Firebase Consent Mode (Google Consent Mode v2) to enforce consent signals on Analytics. ## **Data transfers and hosting** Cloud Firestore, Cloud Storage and Cloud Functions can be configured to store data in EU regions (europe-west1, europe-west3, eur3, etc.). Firebase Authentication, Firebase Analytics and Cloud Messaging currently process data globally with US storage. Transfers rely on Google's certification under the EU US Data Privacy Framework and on Standard Contractual Clauses included in the Google Cloud Data Processing Addendum. ## **Practical compliance steps** Sign the Google Cloud Data Processing Addendum from your Firebase console. Pin Cloud Firestore and Cloud Storage to an EU region. Enable Firebase Consent Mode and gate Firebase Analytics and Crashlytics behind your consent management platform. For mobile apps, request iOS App Tracking Transparency before enabling Analytics and follow the Android Privacy Sandbox guidance. Document the Firebase services in use, the regions, and the EU US Data Privacy Framework basis in your privacy notice. Compliance ## Firebase and the GDPR Firebase is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for Firebase Analytics, Crashlytics, Cloud Messaging marketing campaigns and any tracking-style identifiers. Contract performance (Art. 6(1)(b)) for Authentication and database operations strictly necessary to deliver the requested service. Strictly necessary cookies and identifiers rely on Art. 5(3) ePrivacy. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, CCPA, German TDDDG ### Impact assessment (DPIA) A DPIA is recommended for Firebase deployments that combine Authentication, Analytics and Crashlytics with significant user volumes, given the global Google Cloud processing and the persistent identifiers used for analytics and marketing. ### Sample text for your banner > This application uses Firebase (Google LLC) for authentication, data storage and analytics. Firebase Analytics and Crashlytics are activated only after your consent. Personal data may be transferred to Google infrastructure outside the EEA under the EU US Data Privacy Framework or Standard Contractual Clauses. Cookies and trackers ## What Firebase sets and contacts - Tracking method mobile and web SDK and backend services from Google Cloud (Firebase Authentication, Cloud Firestore, Realtime Database, Firebase Cloud Messaging, Firebase Analytics, Firebase Hosting, Firebase Crashlytics) - Server location global Google Cloud infrastructure (default multi-region; explicit EU regions available for Cloud Firestore, Cloud Functions and Cloud Storage) - Data transferred outside the EU Firebase is operated by Google LLC, a US company. Most Firebase services run on Google Cloud infrastructure. Some products such as Cloud Firestore, Cloud Storage and Cloud Functions allow selecting EU regions; others (Authentication, Cloud Messaging, Analytics) currently process data globally with US storage. Transfers rely on the Google EU US Data Privacy Framework certification and Standard Contractual Clauses. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------------------- | ------------ | --------------------- | ------------------------------------------------------------------------------------------------------------------- | | firebase\_id\_token | first\_party | 1 hour | Short-lived ID token issued by Firebase Authentication after a successful login. | | firebase\_refresh\_token | first\_party | Variable (long-lived) | Refresh token stored locally so the app can request new ID tokens without forcing re-authentication. | | FIREBASE\_INSTALLATION\_ID | first\_party | Persistent | Persistent app instance identifier used by Firebase Analytics, Crashlytics and Cloud Messaging to attribute events. | | FCM\_TOKEN | first\_party | Persistent | Device token used by Firebase Cloud Messaging to deliver push notifications. | ### Third-party domains contacted (5) - `firebase.googleapis.com` - `firebaseio.com` - `firebaseinstallations.googleapis.com` - `fcmregistrations.googleapis.com` - `firebaselogging-pa.googleapis.com` Questions ## Frequently asked questions about Firebase Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What identifiers does Firebase set? Firebase Authentication issues an ID token (1 hour) and a long-lived refresh token. Firebase Installations creates a persistent app instance identifier used by Analytics, Crashlytics and Cloud Messaging. Firebase Cloud Messaging stores a device token. Firebase Analytics and Crashlytics also write event payloads with device and IP information when active. ### Do I need consent to use Firebase on my website or app? Firebase Authentication and the database services that simply deliver the requested feature do not require a separate cookie banner. Firebase Analytics, Crashlytics and Cloud Messaging marketing campaigns require freely given consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. Use Firebase Consent Mode to gate data collection. ### What is the legal basis for processing personal data through Firebase? Authentication, Cloud Firestore and Realtime Database used to deliver the app rely on contract performance (Art. 6(1)(b)). Firebase Analytics, Crashlytics and Cloud Messaging marketing rely on consent (Art. 6(1)(a)). Tax retention may rely on legal obligation (Art. 6(1)(c)). Strictly necessary identifiers rely on Art. 5(3) ePrivacy. ### Does Firebase transfer data to third countries? Yes for several Firebase products. Cloud Firestore, Cloud Storage and Cloud Functions can be pinned to EU regions. Firebase Authentication, Firebase Analytics and Cloud Messaging currently process data globally with US storage. Transfers rely on the Google EU US Data Privacy Framework certification and on Standard Contractual Clauses included in the Google Cloud Data Processing Addendum. ### Do I need a DPIA for Firebase? A DPIA is recommended for Firebase deployments that combine Authentication, Analytics and Crashlytics with significant user volumes, given the global Google Cloud processing and the persistent identifiers used. A DPIA is normally not required for a small Authentication only or hosting only project. ### How do I implement Firebase compliantly? Sign the Google Cloud Data Processing Addendum from the Firebase console. Pin Cloud Firestore and Cloud Storage to an EU region. Enable Firebase Consent Mode and gate Firebase Analytics and Crashlytics behind your CMP. For mobile apps, request iOS App Tracking Transparency before enabling Analytics. Document Firebase services, regions and the DPF basis in your privacy notice. ### Are there privacy-friendly alternatives to Firebase? EU-based alternatives include Supabase (managed in EU regions on AWS), Appwrite (open source, self hosted or EU cloud), Hasura with EU hosting, and Nhost (EU hosting). For analytics specifically, prefer Plausible, Matomo, Pirsch or Posthog with EU hosting. Selection depends on whether you need full backend services or only specific Firebase products. ### How should I update my privacy policy for Firebase? List the Firebase services in use (Authentication, Cloud Firestore, Storage, Functions, Cloud Messaging, Analytics, Crashlytics) with their purpose, the regions configured and the persistent identifiers issued. State that data may be transferred to Google infrastructure outside the EEA under the EU US Data Privacy Framework or Standard Contractual Clauses, and reference the Google Cloud Data Processing Addendum. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Kinsta](https://www.flowconsent.com/en/services/hosting/kinsta) [Kinsta is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Kinsta supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Kinsta ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/kinsta) [Hosting](https://www.flowconsent.com/en/services/hosting/kinsta) · ### [AWS](https://www.flowconsent.com/en/services/hosting/aws) [AWS is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. AWS is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, AWS offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/hosting/aws) [Hosting](https://www.flowconsent.com/en/services/hosting/aws) · ### [VirtFusion](https://www.flowconsent.com/en/services/hosting/virtfusion) [VirtFusion is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. VirtFusion supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, VirtFusion ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/virtfusion) [Hosting](https://www.flowconsent.com/en/services/hosting/virtfusion) · ### [Hosting Ukraine](https://www.flowconsent.com/en/services/hosting/hosting-ukraine) [Hosting Ukraine is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Hosting Ukraine supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Hosting Ukraine enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/hosting/hosting-ukraine) [Hosting](https://www.flowconsent.com/en/services/hosting/hosting-ukraine) · ### [Hypercorn](https://www.flowconsent.com/en/services/hosting/hypercorn) [Hypercorn is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Hypercorn supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Hypercorn ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/hypercorn) [Hosting](https://www.flowconsent.com/en/services/hosting/hypercorn) · ### [Hiawatha](https://www.flowconsent.com/en/services/hosting/hiawatha) [Hiawatha is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Hiawatha supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Hiawatha ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/hiawatha) [Hosting](https://www.flowconsent.com/en/services/hosting/hiawatha) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)