> How SparkPost (now Bird) handles personal data under GDPR: open and click tracking pixels, EU regional processing, consent and soft opt in for marketing emails. > > Canonical: https://www.flowconsent.com/en/services/marketing/sparkpost Marketing # SparkPost Analytics · [Official website](https://www.sparkpost.com/) SparkPost is an email infrastructure service used for transactional, marketing and notification emails. Since 2021 it is part of Bird (formerly MessageBird), an Amsterdam based CPaaS. SparkPost provides SMTP relay, an HTTP API, inbound email parsing and detailed analytics on opens, clicks, bounces and engagement. Open and click tracking work through pixels and URL wrapping; both have GDPR implications and need careful configuration for European compliance. [Block SparkPost until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Analytics - Prior consent Required - Documented cookies 0 - Third-party domains 5 - Servers Multiple regions. SparkPost (now Bird, formerly MessageBird since the 2021 acquisition) operates US and EU data regions. Customers can choose EU regional processing (Frankfurt, Dublin) for European messaging traffic on Enterprise plans. Overview ## What does SparkPost do? ## **What SparkPost is** SparkPost is an email infrastructure service originally developed by Message Systems, a US email deliverability specialist. It was acquired by MessageBird in 2021 (the Amsterdam based CPaaS that rebranded to Bird in 2024) and now sits in the broader Bird product family alongside Mailgun (acquired in 2023). SparkPost is used by SaaS companies, e commerce platforms and media brands to send transactional emails (password resets, order confirmations, notifications) and marketing emails at scale, with detailed analytics on deliverability and engagement. ## **How tracking works** SparkPost does not set browser cookies because it is a backend email service. Tracking happens in two places: open tracking via a 1x1 transparent image embedded at the bottom of HTML emails, which the recipient's email client downloads when the email is rendered, transmitting the IP address, user agent and timestamp to SparkPost; click tracking via URL wrapping, where each link in the email is replaced with a SparkPost redirect URL that logs the click before redirecting to the original destination. Both can be disabled per message via SubAccounts or template options. SparkPost also fires webhook events for delivery, bounce, complaint, unsubscribe and engagement metrics. ## **GDPR and ePrivacy implications** Because no information is stored on the recipient's terminal, ePrivacy Art. 5(3) does not apply to SparkPost emails. The applicable rule is ePrivacy Art. 13 (unsolicited communications) for marketing emails, which requires consent or soft opt in. Under the GDPR, transactional emails rest on contract necessity (Art. 6(1)(b)), marketing emails on consent (Art. 6(1)(a)). The open and click tracking processing rests on legitimate interest under Art. 6(1)(f) but must be disclosed in the privacy notice, and recipients should be able to disable tracking on request. ## **Data transfers and regional processing** Default SparkPost infrastructure includes US data centres alongside EU regions (Frankfurt, Dublin). European customers should explicitly enable EU regional processing where data residency commitments require it. Bird is headquartered in Amsterdam, which puts the corporate decision making within the EU, but the SparkPost product retains US infrastructure for global routing efficiency. Bird self certifies under the EU US Data Privacy Framework and offers Standard Contractual Clauses for transfers outside the DPF. ## **Apple Mail Privacy Protection and open rate inflation** Apple Mail Privacy Protection, enabled by default in iOS 15 and macOS Monterey, pre fetches all email images on Apple servers in the United States before the recipient opens the email. This breaks open tracking by inflating opens to nearly 100% for Apple Mail users, and it changes the IP and user agent visible to SparkPost (Apple's relay IPs). The data is still processed by SparkPost, but its analytical value is reduced. Operators should adjust their email metrics expectations and not draw individual user inferences from open rates of Apple Mail recipients. ## **Practical compliance steps** Distinguish clearly between transactional emails (consent free under contract necessity) and marketing emails (consent or soft opt in required). Subscribe to EU regional processing where applicable. Sign the Bird/SparkPost DPA and SCCs. Disclose open and click tracking in the privacy notice. Provide a working unsubscribe link in all marketing emails and honour suppression within 72 hours. Document the processing in the record of processing including the data categories, the legal basis, the retention period and the transfer mechanism. Compliance ## SparkPost and the GDPR SparkPost is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract necessity (GDPR Art. 6(1)(b)) for transactional emails tied to a service (password reset, order confirmation, account verification). Consent (Art. 6(1)(a)) or soft opt in for marketing emails under ePrivacy and PECR. Legitimate interest (Art. 6(1)(f)) for security and fraud notifications. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, UK PECR, German UWG, French CNIL recommendations on email marketing, US CAN SPAM Act for US recipients, EU US Data Privacy Framework, EU UK adequacy decision ### Impact assessment (DPIA) SparkPost does not set browser cookies (no website tracking) but embeds tracking pixels and wrapped URLs in outgoing emails. DPIA considerations: (1) the open tracking pixel logs the recipient's IP address, user agent and timestamp when the email is rendered; (2) the click tracking redirect logs the same data plus the original destination URL when the recipient clicks; (3) some webmail clients (Gmail, Apple Mail Privacy Protection) proxy or pre fetch the images, which inflates open rates and complicates the interpretation of the data, but does not change the GDPR analysis; (4) Bird (the parent) is headquartered in the EU (Amsterdam) but the SparkPost product still runs primarily on US infrastructure unless EU regional processing is explicitly enabled; (5) marketing emails require ePrivacy consent or soft opt in, separate from the transactional email basis. A DPIA is recommended for high volume marketing senders and for sites mixing transactional and marketing flows. ### Sample text for your banner > We use SparkPost (a Bird product, with infrastructure in \[EU regions / US regions]) to send our transactional emails (password resets, order confirmations) and our marketing emails when you have opted in. SparkPost places a small invisible image and wraps links in our emails to measure deliverability and engagement. Your IP address is logged when the email is rendered. For marketing emails you can unsubscribe at any time using the link in the email or by contacting us. Cookies and trackers ## What SparkPost sets and contacts - Tracking method Email delivery and infrastructure service. SparkPost provides SMTP relay, HTTP API and inbound email parsing for transactional, marketing and notification emails. Tracking is embedded in outgoing messages: a 1x1 transparent open tracking pixel and click tracking via URL wrapping (sparkpost-tracked URLs that redirect to the original destination). The service produces webhook events for each send, delivery, open, click, bounce, complaint and unsubscribe. - Server location Multiple regions. SparkPost (now Bird, formerly MessageBird since the 2021 acquisition) operates US and EU data regions. Customers can choose EU regional processing (Frankfurt, Dublin) for European messaging traffic on Enterprise plans. - Cookieless mode available Yes - Data transferred outside the EU SparkPost is part of Bird (MessageBird), headquartered in Amsterdam with a strong US operation following the 2021 acquisition of Message Systems. EU regional processing is available for European customers, but default infrastructure routes through US data centres unless explicitly configured. Bird self certifies under the EU US Data Privacy Framework and offers Standard Contractual Clauses. ### Third-party domains contacted (5) - `sparkpost.com` - `eu.sparkpost.com` - `sparkpostmail.com` - `api.sparkpost.com` - `bird.com` Questions ## Frequently asked questions about SparkPost Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does SparkPost set any cookies? No browser cookies. SparkPost is a backend email service and does not run JavaScript on a website. Tracking happens inside the emails: a 1x1 open tracking pixel and click tracking redirect URLs. Both can be disabled per message. ### Is consent required for SparkPost? Not for transactional emails (they rest on contract necessity). Marketing emails require consent or soft opt in under ePrivacy Art. 13 and PECR. The open and click tracking processing rests on legitimate interest but must be disclosed in the privacy notice and visitors should be able to refuse on request. ### What is the legal basis for SparkPost processing? Contract necessity (Art. 6(1)(b)) for transactional emails. Consent (Art. 6(1)(a)) for marketing emails. Legitimate interest (Art. 6(1)(f)) for security alerts and for the open/click tracking metrics. ### Does SparkPost transfer data to the United States? By default, yes. EU regional processing is available on Enterprise plans. Bird (the parent) is headquartered in Amsterdam, but the SparkPost product still uses US infrastructure for global routing unless EU residency is explicitly configured. Bird self certifies under the EU US Data Privacy Framework and offers SCCs. ### Do I need a DPIA for SparkPost? A DPIA is recommended for high volume marketing senders or for sites mixing transactional and marketing flows where the data combines into rich user profiles. For pure transactional email under contract necessity, a DPIA may not be required but documentation in the record of processing remains mandatory. ### How do I implement SparkPost compliantly? Separate transactional from marketing flows clearly. Collect explicit consent or rely on soft opt in for marketing. Subscribe to EU regional processing where applicable. Sign the Bird/SparkPost DPA and SCCs. Disclose open and click tracking in the privacy notice. Honour unsubscribe requests within 72 hours and propagate to all linked systems. ### What alternatives to SparkPost exist? Other email infrastructure providers include Mailgun (also Bird), Postmark (US), SendGrid (Twilio, US), Amazon SES (US), Brevo (formerly Sendinblue, France, EU residency), Mailjet (France/Sinch, EU residency), and self hosted Postfix or Postal. EU based options like Brevo and Mailjet avoid the default US transfer. ### How should I update my cookie or privacy policy? SparkPost does not need to appear on a cookie banner. In the privacy notice, name Bird/SparkPost as a processor, describe the open and click tracking, state the legal basis for transactional vs marketing emails, declare the data residency choice (EU or US) and the transfer mechanism. Provide a working unsubscribe link in every marketing email. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Qomon](https://www.flowconsent.com/en/services/marketing/qomon) [Qomon is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Qomon provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Qomon helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/qomon) [Marketing](https://www.flowconsent.com/en/services/marketing/qomon) · ### [Web3Forms](https://www.flowconsent.com/en/services/marketing/web3forms) [Web3Forms is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Web3Forms integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Web3Forms helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/web3forms) [Marketing](https://www.flowconsent.com/en/services/marketing/web3forms) · ### [VYVE+](https://www.flowconsent.com/en/services/marketing/vyve) [Vyve+ is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Vyve+ integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Vyve+ makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/vyve) [Marketing](https://www.flowconsent.com/en/services/marketing/vyve) · ### [Yext](https://www.flowconsent.com/en/services/marketing/yext) [Yext is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Yext offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Yext empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/yext) [Analytics](https://www.flowconsent.com/en/services/marketing/yext) · ### [TITANPush](https://www.flowconsent.com/en/services/marketing/titanpush) [TITANPush is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. TITANPush provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, TITANPush helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/titanpush) [Marketing](https://www.flowconsent.com/en/services/marketing/titanpush) · ### [Alchemer Mobile](https://www.flowconsent.com/en/services/marketing/alchemer-mobile) [Alchemer Mobile is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Alchemer Mobile supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Alchemer Mobile ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/alchemer-mobile) [Preferences](https://www.flowconsent.com/en/services/marketing/alchemer-mobile) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)