FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Amazon SES

AnalyticsOfficial website

Amazon Simple Email Service (Amazon SES) is the email-sending service of Amazon Web Services, used for transactional and marketing email at scale. EU developers commonly use SES with an EU region (Frankfurt, Ireland, Paris, Stockholm, Milan) for low cost and EU residency. SES does not run any script in the recipient browser by default; optional tracking pixels and click redirects add lightweight tracking.

Block Amazon SES until consentScan my site
Overview

What does Amazon SES do?

What Amazon SES is

Amazon Simple Email Service (Amazon SES) is the email-sending service of Amazon Web Services, launched in 2011. It is widely used to send transactional email (order confirmations, password resets), system notifications, and marketing campaigns at scale, with pay-as-you-go pricing per thousand messages. SES exposes both an SMTP relay and a REST API and is available in multiple AWS regions, including five EU regions (Ireland, Frankfurt, Paris, Stockholm, Milan).

What data Amazon SES processes

Recipient email address, sender identity, full message payload (headers, subject, body, attachments), and message metadata (timestamps, IDs). With configuration sets, SES can also record open events (1x1 pixel) and click events (URL redirect), generating engagement metadata per recipient. Bounce and complaint feedback are processed via the SES feedback loop. No client-side cookies are set by SES on the sender website; tracking pixels embedded in emails are loaded by the recipient mail client when the email is opened.

GDPR and ePrivacy implications

Email addresses are personal data. Transactional emails (purchase confirmation, password reset) rely on contract performance under Art. 6(1)(b). Marketing emails require either consent (Art. 6(1)(a)) or the strict customer-relationship exception of the ePrivacy Directive Art. 13(2) where applicable. Open tracking pixels and click tracking can themselves constitute online identifiers under ePrivacy and, in the strictest reading, require consent. Always include a clear and accessible unsubscribe mechanism in every marketing email.

International data transfers

Choose an EU region (Frankfurt, Ireland, Paris, Stockholm, Milan) to keep the email data plane inside the EEA. The AWS control plane, IAM, billing, and support may still involve US access. AWS is certified under the EU-US Data Privacy Framework, and the AWS Data Processing Addendum incorporates Standard Contractual Clauses. Run a short Transfer Impact Assessment focused on the residual US access for control-plane operations.

Practical compliance steps

Pick an EU AWS region at setup, sign the AWS DPA, review the SES configuration set for open/click tracking and disable it for transactional emails where engagement metrics are not needed, maintain a clean consent register for marketing lists, include unsubscribe and physical address in every marketing message, configure SPF/DKIM/DMARC for deliverability, and document SES in the RoPA as a processor.

Compliance

Amazon SES and the GDPR

Legal basis
Contract performance (Art. 6(1)(b) GDPR) for transactional emails (order confirmation, password reset); consent (Art. 6(1)(a)) for marketing emails; legitimate interest (Art. 6(1)(f)) for security and operational notices
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, CAN-SPAM Act (US), CASL (Canada)

Impact assessment (DPIA)

Amazon SES processes email recipient addresses, sender identity, full email payload (subject, body, attachments), and (when enabled) open and click events. Key DPIA considerations: (1) email addresses are personal data; (2) the email body itself may contain sensitive personal data (medical, financial, legal); (3) EU region selection keeps the data plane in the EU, but the AWS control plane and global services still involve transfers; (4) open tracking pixels and click tracking links are themselves online identifiers and can require consent under ePrivacy when they go beyond strict service delivery; (5) bounce and complaint feedback loops generate additional metadata. A DPIA is recommended for marketing campaigns at scale.

Sample text for your banner

We use Amazon SES (Amazon Web Services) to send transactional and marketing emails. The email content, your address, and (for marketing emails) tracking events are processed by AWS in our chosen EU region. Transfers outside the EEA rely on AWS Standard Contractual Clauses and the EU-US Data Privacy Framework certification. You can unsubscribe from marketing emails at any time via the link in every message.
Cookies and trackers

What Amazon SES sets and contacts

Tracking method
Server-side SMTP relay and AWS SDK API for sending transactional and marketing email; no client-side script in typical deployments. Optional open and click tracking pixels add lightweight tracking links.
Server location
Multiple AWS regions worldwide. EU customers can select EU regions: eu-west-1 (Ireland), eu-central-1 (Frankfurt), eu-west-3 (Paris), eu-north-1 (Stockholm), eu-south-1 (Milan).
Cookieless mode available
Yes
Data transferred outside the EU
Amazon SES is operated by Amazon Web Services, Inc. (US). When sending from an EU region, the email payload is stored and processed in that region, but the AWS control plane, logging, and support may still involve US-based access. International transfers rely on the AWS Data Processing Addendum, Standard Contractual Clauses, and the EU-US Data Privacy Framework adequacy decision (AWS is DPF-certified).

Cookies set (1)

NameTypeDurationPurpose
No cookies on the sender websiteN/AN/AAmazon SES is a server-side email-sending service and does not set cookies on the sender website. The tracking pixel inside an outbound email is loaded by the recipient mail client, not by the sender domain.

Third-party domains contacted (7)

  • email.eu-west-1.amazonaws.com
  • email.eu-central-1.amazonaws.com
  • email.eu-west-3.amazonaws.com
  • email.eu-north-1.amazonaws.com
  • email.eu-south-1.amazonaws.com
  • aws.amazon.com
  • r.<config-set>.amazonses.com
Questions

Frequently asked questions about Amazon SES

Can't find your question? Write to us, we answer fast.

Does Amazon SES set cookies?

No cookies on the sender website. The tracking pixel placed inside an email is loaded by the recipient mail client when the email is opened; modern mail clients (Apple Mail with privacy protection, Gmail image proxy) routinely strip or obfuscate that signal.

Does Amazon SES require user consent?

For transactional emails sent under contract performance, no consent is required for the sending itself. Open and click tracking enabled in marketing campaigns and the marketing emails themselves require consent under GDPR Art. 6(1)(a) and the soft opt-in conditions of Art. 13(2) ePrivacy.

What is the legal basis for Amazon SES?

Contract performance (Art. 6(1)(b)) for transactional email, consent (Art. 6(1)(a)) for marketing email, legitimate interest (Art. 6(1)(f)) for security and operational notices, with documented LIA.

Does Amazon SES transfer data to the United States?

When using an EU region (Frankfurt, Ireland, Paris, Stockholm, Milan), the email data plane stays in the EU. The AWS control plane and global services involve US access. AWS is certified under the EU-US Data Privacy Framework and the AWS DPA incorporates SCCs.

Do I need a DPIA for Amazon SES?

For transactional email, generally no. For marketing campaigns at scale with open and click tracking, document a short DPIA covering the legal basis, the tracking pixels, the retention of engagement data, and the unsubscribe workflow.

How do I implement Amazon SES compliantly?

Pick an EU AWS region, sign the AWS DPA, disable open/click tracking for transactional emails, maintain a clean consent register for marketing lists, include unsubscribe and a physical address in every marketing email, configure SPF/DKIM/DMARC, and document SES as a processor in your RoPA.

What are the alternatives to Amazon SES?

EU-based alternatives: Brevo (France), Mailjet (France, Sinch), Mailgun EU region (Germany), Postmark EU region, Sparkpost EU. EU-friendly self-hosted: Postfix with OpenDKIM, MailerSend, listmonk plus SMTP. Privacy-friendly newsletter services: Buttondown, Mailcoach.

How do I update the cookie policy for Amazon SES?

SES does not set cookies on your website, so no cookie policy entry is required for the sending side. Mention SES in the privacy notice under the email subprocessors section, with the chosen AWS region, the DPA and SCC references, and the DPF certification.

Same category

More services: Marketing

See the whole category

Zipteams

Zipteams is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Zipteams supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Zipteams ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Zevioo

Zevioo is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Zevioo enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Zevioo empowers marketing teams to achieve measurable growth.

Marketing

Emotive

Emotive is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Emotive enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Emotive empowers marketing teams to achieve measurable growth.

Marketing

Resultify

Resultify is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Resultify enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Resultify empowers marketing teams to achieve measurable growth.

Marketing

SchemaPlus

SchemaPlus is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SchemaPlus supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SchemaPlus ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

NET-RESULTS

NET-RESULTS is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. NET-RESULTS enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, NET-RESULTS empowers marketing teams to achieve measurable growth.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site