FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

Jotform

MarketingOfficial website

Jotform is an online form builder used to create contact forms, surveys, registrations, payment forms and approval workflows without code. Forms are embedded on websites with a script or iframe, or shared as hosted pages. Embedded forms load from Jotform's servers, may set cookies and send visitors' submissions to Jotform, which should be reflected in the site's privacy notice.

Block Jotform until consentScan my site
Overview

What does Jotform do?

Jotform, founded in 2006 by Aytekin Tank in San Francisco, is one of the largest SaaS form builders with more than 25 million users. Forms are created and hosted on jotform.com and embedded into customer websites via iframe or a lightweight JavaScript widget. Submissions are processed and stored by Jotform on behalf of the website operator.

What Jotform does

Jotform offers a drag and drop builder, more than ten thousand templates, conditional logic, payments (Stripe, PayPal, Square, Authorize.Net), e signature, file uploads, approval workflows, PDF generation and a REST API. Forms can be embedded as iframe, JavaScript widget, full page or distributed as link, QR code or kiosk. The service also includes HIPAA, GDPR, PCI DSS Level 1 and SOC 2 Type II compliance options.

Data and cookies set

The embedded widget loads JavaScript from cdn.jotfor.ms and posts to api.jotform.com. Cookies set on the jotform.com third party context include JOTFORM_SESSION, JFcid, _ga (when Jotform analytics is enabled), and __cf_bm (Cloudflare bot management). These cookies require prior consent in the EEA under Art. 5(3) ePrivacy. Submissions, the visitor IP, the user agent and the referring URL are stored on Jotform servers.

GDPR and ePrivacy implications

Jotform acts as a processor under Art. 28 GDPR. The website operator must sign the Jotform Data Processing Addendum, list Jotform as a sub processor in records of processing, and configure the European data residency option if the website serves EU users with sensitive data. Without EU residency, transfers rely on the EU US DPF (Jotform is certified) or on Standard Contractual Clauses.

Data transfers and residency options

Default Jotform plans store data in the US. The Jotform Enterprise EU data residency option stores submissions in Frankfurt (AWS eu central 1) and serves the form widgets from a European CDN. HIPAA accounts are isolated in a US healthcare environment. Document which residency you use, the corresponding transfer mechanism, and the encryption at rest and in transit.

Practical compliance steps

Block the Jotform widget behind the marketing or statistics consent category until the visitor accepts. Sign the Jotform DPA. Enable EU data residency when relevant. Set encryption on form fields with personal data. Configure a submission retention policy in Jotform. Document Jotform as a sub processor and the relevant US transfer mechanism in your records of processing and your privacy notice.

Compliance

Jotform and the GDPR

Jotform is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) for the third party cookies set by the embedded widget. Performance of a contract (Art. 6(1)(b)) for the submitted data, processed by Jotform as a processor on behalf of the website operator.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, HIPAA (US healthcare), EU US Data Privacy Framework
Cookies and trackers

What Jotform sets and contacts

Tracking method
SaaS form builder embedded via iframe or JavaScript widget. Forms are hosted on jotform.com servers; submissions are sent directly to Jotform and stored on Jotform infrastructure. The embedding website only loads the form widget and an optional CDN tracker.
Server location
Jotform Inc., San Francisco, United States. EU customers can opt for the European data residency option (Frankfurt, AWS eu central 1) for an additional fee. HIPAA customers use a separate isolated environment.
Data transferred outside the EU
By default, all form submissions and visitor metadata are stored on Jotform US servers in San Francisco. EU customers can activate the EU data residency (Frankfurt) to keep data inside the EEA. Without that option, transfers require the EU US Data Privacy Framework, Standard Contractual Clauses or other Chapter V GDPR safeguards.

Cookies set (4)

NameTypeDurationPurpose
JOTFORM_SESSIONthird_partySessionSession identifier used by the Jotform widget to keep track of the current form instance.
JFcidthird_party1 yearUnique visitor identifier used by Jotform for analytics and conversion attribution.
__cf_bmthird_party30 minutesCloudflare bot management cookie used to distinguish humans from automated traffic on jotform.com.
_gathird_party2 yearsGoogle Analytics identifier set on jotform.com when Jotform Analytics is enabled on the account.

Third-party domains contacted (6)

  • jotform.com
  • jotfor.ms
  • cdn.jotfor.ms
  • api.jotform.com
  • submit.jotform.com
  • eu.jotform.com
Questions

Frequently asked questions about Jotform

Can't find your question? Write to us, we answer fast.

Which cookies does Jotform set?

In the third party context jotform.com the widget sets JOTFORM_SESSION (session), JFcid (visitor identifier, one year), _ga and _gid (if Jotform Analytics is on) and __cf_bm (Cloudflare bot management, 30 minutes). All require prior consent in the EEA except __cf_bm which is sometimes claimed as strictly necessary.

Is consent required to use Jotform?

Yes. The Jotform widget loads third party JavaScript and sets third party cookies, so prior consent is required under Art. 5(3) ePrivacy. Submission data itself is processed under Art. 6(1)(b) GDPR (pre contractual) plus consent for marketing fields.

What is the legal basis for processing Jotform data?

For the form submission, Art. 6(1)(b) GDPR (pre contractual). For the third party cookies and the embedded widget, Art. 6(1)(a) consent. Sensitive data (Art. 9) requires explicit consent and an additional contractual safeguard (e.g., HIPAA BAA for healthcare).

Is data transferred to the United States?

By default, yes: Jotform stores forms and submissions in the US. Enable EU Data Residency on Jotform Enterprise to store data in Frankfurt. Without EU residency, transfers rely on the EU US DPF (Jotform is certified) or on SCCs plus Transfer Impact Assessment.

Do I need a DPIA for Jotform?

A DPIA is recommended when Jotform is used to collect special categories of data (health, biometrics, financial), in recruitment with automated screening, or at large scale. The DPIA covers the residency choice, the transfer mechanism, the embedded cookies and the retention policy.

How do I implement Jotform correctly?

Block the widget until consent. Sign the Jotform DPA. Activate EU residency if relevant. Encrypt sensitive fields. Set a submission retention rule. Add an opt in checkbox to marketing fields. Use Jotform anti spam and reCAPTCHA alternatives such as Cloudflare Turnstile. Document Jotform as a sub processor.

Which alternatives to Jotform should I consider?

EU first SaaS: Tally (Belgium), Typeform (Spain), Formbricks (open source, EU hosting). US SaaS: SurveyMonkey, Wufoo, Google Forms, Microsoft Forms. Self hosted WordPress: Gravity Forms, WPForms, Ninja Forms, Fluent Forms, Contact Form 7.

How do I update the cookie policy when Jotform changes?

Track the Jotform sub processor list and certification status (EU US DPF). When Jotform updates its DPA, residency offering or sub processors, update your cookie table, privacy notice and records of processing, and bump the consent banner version.

Same category

More services: Marketing

See the whole category

Create Demand

Create Demand is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Create Demand integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Create Demand makes advanced AI accessible to all teams.

Marketing

Impressure

Impressure is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Impressure supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Impressure enables informed decisions that improve experience and drive results.

Analytics

Lead Generated

Lead Generated is a lead generation platform designed to help businesses capture, qualify, and convert website visitors into sales-ready leads. It offers smart forms, interactive content, and behavioral tracking to identify high-intent prospects. Lead Generated integrates with CRM and marketing automation tools to streamline lead nurturing. With scoring models and analytics, Lead Generated helps teams focus on the most promising opportunities, improving pipeline quality and revenue growth.

Marketing

Profit Lifter

Profit Lifter is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Profit Lifter provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Profit Lifter helps deliver the right message to the right audience at the right time.

Marketing

SharpSpring

SharpSpring is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. SharpSpring enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, SharpSpring empowers marketing teams to achieve measurable growth.

Marketing

Bigin

Bigin is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bigin enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bigin empowers marketing teams to achieve measurable growth.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site