FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Braze

MarketingOfficial website

Braze is a customer engagement platform that combines email, push, SMS, web push and in app messaging with behavioral analytics. The Web SDK creates persistent identifiers and tracks behavior across sessions, so prior opt in consent is required under ePrivacy and GDPR.

Block Braze until consentScan my site
Overview

What does Braze do?

What Braze is and how it engages users

Braze is a customer engagement platform founded in 2011 by Braze Inc. in New York. It combines orchestrated multi channel messaging (email, push, SMS, web push, in app messaging, Content Cards) with behavioral analytics, segmentation, A/B testing and journey building (Canvas). Braze is deployed via Web SDK, mobile SDK (iOS, Android, React Native, Flutter) and server side REST API. The Web SDK is loaded from a Braze CDN (js.appboycdn.com or sdk.iad-XX.braze.com) on the customer website.

Cookies and identifiers set on visitors

The Braze Web SDK creates a persistent identifier stored in local storage (ab.storage.userId), a device id (ab.storage.deviceId), session metadata (ab.storage.sessionId) and cached campaign and Content Card data (ab.storage.contentCards, ab.storage.feed). When a customer calls braze.changeUser(externalId), the SDK links the device profile to the customer identifier known by your application. The SDK then sends events to a Braze ingest endpoint (sdk.iad-XX.braze.com or sdk.fra-XX.braze.eu) including page views, custom events and user attributes.

GDPR and ePrivacy implications

The Braze identifiers persist across sessions and link behavior across visits, building rich behavioral profiles. Article 5(3) of the ePrivacy Directive requires prior opt in consent because the SDK stores information on the visitor terminal. Article 6(1)(a) GDPR (consent) is the standard legal basis. Transactional messages tied to a contract can rely on Article 6(1)(b). The customer is the controller, Braze Inc. is the processor under Article 28 GDPR with a DPA available in the Master Services Agreement.

Data transfers and Schrems II

Request an EU pod (EU 01 or EU 02 in Frankfurt) at onboarding so user profiles, behavioral events and message content stay in the EEA. The Braze SDK URL changes to sdk.fra-XX.braze.eu for EU pods. Braze Inc. corporate operations and product analytics include US providers, covered by Standard Contractual Clauses and the EU US Data Privacy Framework. The CDN that serves the SDK JavaScript file is global, which is acceptable since the JavaScript file is content, not personal data.

Practical compliance steps

Gate the Braze Web SDK behind your consent management platform so braze.openSession() only fires after consent. Integrate Braze with Google Consent Mode v2 or IAB TCF. Request an EU pod. Sign the Braze DPA. Document the processor in your RoPA with pod region, retention and the list of channels enabled. Implement DSAR endpoints, Braze offers REST APIs to export and delete user data. Use server side data minimization, avoid sending sensitive attributes unless strictly needed. Carry out a DPIA before going live.

Compliance

Braze and the GDPR

Braze is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Article 6(1)(a) GDPR (consent) and Article 5(3) ePrivacy because the Braze Web SDK creates persistent identifiers, tracks behavior across sessions, builds profiles and triggers retargeting. Article 6(1)(b) (performance of a contract) applies to transactional messages triggered by user actions when the messaging is clearly part of the service.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Schrems II if a US pod is used, IAB TCF when integrated with consent management vendors, French CNIL guidelines on web tracking

Impact assessment (DPIA)

A DPIA is required for typical Braze deployments because the platform performs systematic profiling, cross channel tracking and behavioral segmentation of identified users. Document the legal basis for each segment and campaign, the EU pod selection, the retention period for user attributes and events, the data minimization rules and the integration with a consent management platform.

Sample text for your banner

We use Braze to personalize messages we send you across email, push notifications and in app campaigns. Braze stores a persistent identifier and tracks your interactions to build a profile of your preferences. These cookies and identifiers are activated only after you accept them in the consent banner.
Cookies and trackers

What Braze sets and contacts

Tracking method
Customer engagement platform combining cross channel messaging (email, push, in app, SMS, web push), behavioral analytics and customer segmentation. The Braze Web SDK (sdk.js loaded from a Braze CDN like js.appboycdn.com) identifies visitors via a persistent ab.storage.userId entry in local storage, captures session events, page views and custom events, and stores them in the customer Braze workspace.
Server location
Braze Inc. (New York, United States) with regional pods on Amazon Web Services. Workspaces are provisioned on a specific pod, options include EU 01 (Frankfurt, AWS eu-central-1), EU 02 (Frankfurt), US 01 to 09 (Virginia and Oregon), Australia 01 (Sydney). The Braze REST APIs and dashboards live at rest.iad-XX.braze.com or rest.fra-XX.braze.eu for EU pods.

Cookies set (5)

NameTypeDurationPurpose
ab.storage.userIdfirst-party (local storage)Persistent (until cleared)Persistent user identifier set by the Braze Web SDK to recognise the same person across sessions and link behavior to the external user id provided by the customer. Requires consent.
ab.storage.deviceIdfirst-party (local storage)Persistent (until cleared)Persistent device identifier used by Braze for anonymous tracking before identification and to merge sessions. Requires consent.
ab.storage.sessionIdfirst-party (local storage)Session (30 minutes of inactivity by default)Session identifier used to group events from the same visit. Requires consent.
ab.storage.contentCardsfirst-party (local storage)Up to 30 daysCaches the Content Cards feed delivered to the device so the Braze widget can render without a network call. Requires consent.
ab.storage.feedfirst-party (local storage)Up to 30 daysCaches the News Feed cards delivered to the device. Requires consent.

Third-party domains contacted (8)

  • braze.com
  • braze.eu
  • appboycdn.com
  • js.appboycdn.com
  • sdk.iad-01.braze.com
  • sdk.fra-01.braze.eu
  • rest.iad-01.braze.com
  • rest.fra-01.braze.eu
Questions

Frequently asked questions about Braze

Can't find your question? Write to us, we answer fast.

Does Braze set cookies on website visitors?

The Braze Web SDK stores persistent identifiers in local storage (ab.storage.userId, ab.storage.deviceId, ab.storage.sessionId) and may also use cookies depending on the implementation. These identifiers persist across sessions and require consent.

Do I need consent for Braze under GDPR and ePrivacy?

Yes. Prior opt in consent is required because the Web SDK stores persistent identifiers on the visitor terminal and builds behavioral profiles for cross channel messaging.

What is the legal basis for processing data with Braze?

Article 6(1)(a) GDPR (consent) for behavioral tracking and marketing campaigns. Article 6(1)(b) (performance of a contract) for transactional messages triggered by a clear service relationship. The customer is the controller, Braze Inc. is the processor with a DPA in the Master Services Agreement.

Does Braze transfer data to the United States?

Not when an EU pod (EU 01 or EU 02 in Frankfurt) is selected for the workspace. The SDK endpoints are then sdk.fra-XX.braze.eu. Some Braze corporate operations and product analytics use US providers under SCCs and the EU US Data Privacy Framework.

Is a DPIA required for Braze?

Yes. Article 35 GDPR makes a DPIA mandatory because Braze enables systematic profiling, cross channel tracking and segmentation of identified users. Document the EU pod, retention, data minimization rules, consent mechanism and DSAR procedure.

How do I implement Braze compliantly?

Gate the Web SDK behind a consent management platform, integrate with Google Consent Mode v2 or IAB TCF, request an EU pod, sign the Braze DPA, document the processor in your RoPA, implement DSAR via the Braze REST API, minimize sensitive attributes, run a DPIA before launch.

What are the alternatives to Braze?

Other customer engagement platforms include Iterable (US), Klaviyo (US), Salesforce Marketing Cloud, Adobe Journey Optimizer, Bloomreach (Czech Republic), Emarsys (SAP, EU), Insider (Turkey), Selligent and CleverTap.

How do I update the cookie policy for Braze?

List the Braze Web SDK identifiers (ab.storage.userId, ab.storage.deviceId, ab.storage.sessionId, ab.storage.contentCards) in your cookie disclosure with retention and purpose. Indicate the EU pod, the categories of personal data processed (events, attributes) and the channels enabled. Update whenever the SDK or pod configuration changes.

Same category

More services: Marketing

See the whole category

Adoric

Adoric is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Adoric enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Adoric empowers marketing teams to achieve measurable growth.

Marketing

EarlyParrot

EarlyParrot is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. EarlyParrot supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, EarlyParrot ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

eTrigue

eTrigue is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. eTrigue enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, eTrigue empowers marketing teams to achieve measurable growth.

Marketing

Talkable

Talkable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Talkable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Talkable helps deliver the right message to the right audience at the right time.

Marketing

Spotzer

Spotzer is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Spotzer supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Spotzer enables informed decisions that improve experience and drive results.

Analytics

Thrive Leads

Thrive Leads is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Thrive Leads supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Thrive Leads enables informed decisions that improve experience and drive results.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site