> iZooto and GDPR: cookies, web push subscriptions, ePrivacy consent, data transfers outside the EU and how to deploy iZooto lawfully on European websites. > > Canonical: https://www.flowconsent.com/en/services/marketing/izooto Marketing # iZooto Marketing · [Official website](https://www.izooto.com) iZooto is a web push notification and audience marketing platform aimed at publishers. It uses the browser Push API to deliver push messages outside the website and tracks subscriber behaviour to segment audiences. Because iZooto stores a unique push subscription token tied to the device and runs behavioural cookies, it is fully subject to GDPR consent rules and the ePrivacy Directive in Europe. Data is processed in India and the United States, both third countries. [Block iZooto until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers United States and India (iZooto is headquartered in India with US infrastructure) Overview ## What does iZooto do? ## **What is iZooto?** iZooto is a web push notification platform tailored to publishers and content brands. It builds and engages owned audiences by collecting browser based push subscriptions and broadcasting alerts when new articles or offers are published. iZooto also offers behavioural segmentation, RSS triggered campaigns and automated drips, all delivered server side via the Web Push protocol. ## **Cookies and data collected** iZooto stores a Web Push subscription endpoint (FCM or Mozilla Autopush) tied to the browser, plus first party cookies (izt\_uid, izt\_session) for tracking subscriber behaviour and segmenting audiences. It collects URLs visited, click patterns on push notifications, country, browser type and device. The push token is the equivalent of a persistent device identifier. ## **GDPR and ePrivacy implications** Article 5(3) of the ePrivacy Directive requires consent before storing the push subscription token in the browser. Article 6 GDPR requires consent for sending direct marketing notifications. The CNIL has reminded publishers that browser native push prompts cannot serve as a substitute for prior consent: a layered banner must precede the prompt. ## **Consent requirements** Implement a custom permission overlay that explains the purposes (push alerts, content recommendations) before triggering the browser native prompt. Behavioural segmentation cookies must be blocked until consent. Provide a clear unsubscribe path inside the website and not only in the browser settings. ## **International data transfers** iZooto operates from India with US infrastructure. India lacks an EU adequacy decision; transfers must rely on Standard Contractual Clauses (Module 2 controller to processor) and a documented Transfer Impact Assessment. The DPDP Act 2023 in India provides additional safeguards but does not equal GDPR. ## **Practical compliance steps** Sign the iZooto DPA with SCCs, configure a custom opt in overlay, integrate with your CMP so the iZooto SDK loads only after consent, define a retention policy for inactive subscribers (e.g. 6 to 12 months), document iZooto in the record of processing and update the cookie banner to mention India and US transfers. Compliance ## iZooto and the GDPR iZooto is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) is required for storing the push subscription endpoint and for behavioural segmentation cookies. Soft opt in does not apply. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, PECR (UK), India DPDP Act 2023, CCPA ### Impact assessment (DPIA) A DPIA is recommended when iZooto is used at scale or combined with behavioural segmentation. Risks include unsolicited push messages, retention of subscription tokens beyond user expectation and transfers to a non adequate jurisdiction (India). ### Sample text for your banner > We use iZooto to send web push notifications about our latest content. With your consent we also analyse which articles you read so we can send relevant alerts. You can revoke consent at any time in your browser settings or via the cookie preferences below. Cookies and trackers ## What iZooto sets and contacts - Tracking method Web push notification platform, browser Push API subscription tokens, behavioural segmentation cookies, opt in prompt manager, server side push delivery - Server location United States and India (iZooto is headquartered in India with US infrastructure) - Data transferred outside the EU Subscriber and behavioural data are processed in India and the United States. Both are third countries lacking an EU adequacy decision and require SCCs plus a transfer impact assessment. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------ | ---------- | --------- | ------------------------------------------------------------------------------------------------------------------------------- | | izt\_uid | persistent | 12 months | Persistent first party cookie storing the unique iZooto subscriber identifier for behaviour tracking and audience segmentation. | | izt\_session | session | Session | Session cookie maintaining the browsing context for a subscriber while the iZooto SDK is active on the page. | | izt\_pn | persistent | 12 months | Stores the push notification preferences and topic subscriptions selected by the user inside the iZooto opt in flow. | ### Third-party domains contacted (4) - `izooto.com` - `cdn.izooto.com` - `api.izooto.com` - `fcm.googleapis.com` Questions ## Frequently asked questions about iZooto Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies and identifiers does iZooto set? iZooto stores a Web Push subscription endpoint (FCM or Mozilla Autopush) plus first party cookies (izt\_uid, izt\_session) used to track subscriber behaviour and segment audiences. The push token acts as a persistent device identifier. ### Does iZooto require GDPR consent? Yes. Storing the push subscription token is a non essential write to the browser triggering Article 5(3) ePrivacy. Sending direct marketing notifications also requires consent under Article 6(1)(a) GDPR. ### What is the legal basis for iZooto? Consent is the only legal basis. Soft opt in does not apply because push notifications are pushed outside the website, beyond the existing customer relationship exception of Article 13 ePrivacy. ### Does iZooto transfer data outside the EU? Yes. Subscriber data is processed in India (head office) and the United States (infrastructure). India lacks an adequacy decision; the US is covered by the DPF when iZooto certifies. SCCs and a TIA are required. ### Do I need a DPIA for iZooto? A DPIA is recommended for large publishers using iZooto with behavioural segmentation, since storing push tokens combined with profiling represents systematic large scale processing. ### How do I implement iZooto compliantly? Show a custom layered consent overlay before the browser native prompt, gate the iZooto SDK behind your CMP, sign the DPA with SCCs, document the service in your record of processing and configure retention policies for inactive subscribers. ### Are there alternatives to iZooto? Alternatives include OneSignal (US), Pushwoosh (US/CY), Webpushr (US), VWO Engage (formerly PushCrew, IN), and EU based options like Notix (EU) and Adcuri. Consider data residency and the existence of an EU adequacy mechanism for each. ### How do I update my cookie policy for iZooto? List iZooto as a marketing notification processor with cookies izt\_uid and izt\_session, push subscription token storage, retention period, sub processors (Google FCM, Mozilla Autopush), India and US transfers, SCC reference and link to the iZooto privacy policy. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Brevo](https://www.flowconsent.com/en/services/marketing/brevo) [Brevo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Brevo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Brevo helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/brevo) [Marketing](https://www.flowconsent.com/en/services/marketing/brevo) · ### [Formrun](https://www.flowconsent.com/en/services/marketing/formrun) [Formrun is a form building and data collection platform that helps businesses create professional online forms, surveys, and questionnaires without coding. It offers a drag-and-drop builder, conditional logic, file uploads, and payment collection. Formrun integrates with CRM, email marketing, and productivity tools to automate workflows triggered by submissions. With responsive designs and spam protection, Formrun helps capture leads and collect data securely.](https://www.flowconsent.com/en/services/marketing/formrun) [Marketing](https://www.flowconsent.com/en/services/marketing/formrun) · ### [Vouchley](https://www.flowconsent.com/en/services/marketing/vouchley) [Vouchley is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Vouchley supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Vouchley ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/vouchley) [Preferences](https://www.flowconsent.com/en/services/marketing/vouchley) · ### [eTrigue](https://www.flowconsent.com/en/services/marketing/etrigue) [eTrigue is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. eTrigue enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, eTrigue empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/etrigue) [Marketing](https://www.flowconsent.com/en/services/marketing/etrigue) · ### [Custobar](https://www.flowconsent.com/en/services/marketing/custobar) [Custobar is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Custobar offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Custobar empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/custobar) [Marketing](https://www.flowconsent.com/en/services/marketing/custobar) · ### [Submit Express](https://www.flowconsent.com/en/services/marketing/submit-express) [Submit Express is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Submit Express offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Submit Express empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/submit-express) [Analytics](https://www.flowconsent.com/en/services/marketing/submit-express) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)