> DigiCert and GDPR: OCSP and CRL revocation checks, Smart Seal trust widget cookies, US transfers and consent requirements for European websites. > > Canonical: https://www.flowconsent.com/en/services/security/digicert Security # DigiCert Unclassified · [Official website](https://www.digicert.com/) DigiCert is a major US-based Certificate Authority that issues the SSL/TLS, code-signing, document-signing and qualified eIDAS certificates many European websites rely on. The certificates themselves are entirely server-side and raise no consent issues. However, browsers contact DigiCert's OCSP and CRL responders to verify revocation status, and websites that display the optional DigiCert Smart Seal embed a JavaScript widget that sets tracking cookies and pings DigiCert servers, which does trigger ePrivacy and transfer obligations. [Block DigiCert until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Unclassified - Prior consent Required - Documented cookies 3 - Third-party domains 6 - Servers DigiCert, Inc., Lehi, Utah, United States. Global OCSP and CRL responder network including European edges Overview ## What does DigiCert do? ## **What is DigiCert** DigiCert is one of the largest Certificate Authorities in the world, issuing SSL/TLS certificates, EV (Extended Validation) certificates, code signing certificates, document signing certificates and qualified eIDAS certificates used by enterprises across Europe. It also operates the Smart Seal trust badge that some websites display to communicate their security posture. ## **What data DigiCert processes** DigiCert processes certificate purchase data (organisation name, contact details, billing), and on issuance the certificate's subject information becomes public via Certificate Transparency logs. At runtime, the browser performs OCSP or CRL revocation checks against DigiCert's servers; these requests reveal the visitor's IP address and the certificate serial number. If the Smart Seal is embedded, it loads JavaScript that pings DigiCert, sets cookies and transmits referrer information. ## **GDPR and ePrivacy implications** OCSP and CRL checks are part of the TLS protocol and are necessary for secure HTTPS connections; they rely on legitimate interest and the legal obligation to maintain communications security. The Smart Seal is non-essential and requires prior consent under Art. 5(3) ePrivacy. DigiCert is a data processor for certificate orders and a controller for product analytics. ## **Data transfers and OCSP stapling** OCSP requests reveal browsing destinations to DigiCert, which sits in the US. Enabling OCSP stapling on your web server (Nginx, Apache, IIS) ensures that the OCSP response is fetched by the server and stapled into the TLS handshake, so the visitor's browser does not need to contact DigiCert directly. This is a simple privacy-enhancing measure that does not require user consent. ## **Smart Seal trust widget** The DigiCert Smart Seal is a JavaScript widget that displays a trust badge and validates the certificate in real time. It loads from seal.digicert.com, sets cookies and transmits visit data to DigiCert. Treat it as a non-essential marketing element and gate it behind your CMP. If you want a trust badge without the tracking, use a static image instead. ## **Practical compliance checklist** 1\. Enable OCSP stapling on your web server. 2. If you display the Smart Seal, block it behind your CMP. 3. Sign the DigiCert subscriber agreement and DPA. 4. Document DigiCert in your privacy notice as a sub-processor or processor (depending on the product). 5. For qualified eIDAS certificates, prefer EU-based Qualified Trust Service Providers (QTSPs) to keep processing in the EU. 6. Monitor Certificate Transparency logs for issued certificates referencing your domain. Compliance ## DigiCert and the GDPR DigiCert is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) and legal obligation for OCSP/CRL revocation checking that is required for HTTPS security; Consent (Art. 6(1)(a) GDPR) for the optional Smart Seal trust widget loaded on the storefront - Risk level low - Applicable regulations GDPR, ePrivacy Directive, eIDAS (for qualified certificates), CA/B Forum baseline requirements ### Impact assessment (DPIA) The core certificate issuance and revocation use of DigiCert raises minimal DPIA concerns: OCSP requests transmit the visitor's IP address and certificate serial number, which DigiCert processes for legitimate security purposes. However, the optional Smart Seal widget loads a JavaScript that sets cookies and transmits referrer and IP to DigiCert in the US for impression counting. Key considerations: (1) OCSP requests reveal browsing destinations to DigiCert; OCSP stapling can mitigate this; (2) the Smart Seal is non-essential and requires consent; (3) qualified certificates under eIDAS may involve EU-based qualified trust service providers (QTSPs) with different processing terms; (4) US transfer for Smart Seal data. A streamlined DPIA is sufficient unless the certificate is used in a high-sensitivity context like financial signing or healthcare. ### Sample text for your banner > This site uses DigiCert SSL certificates to encrypt your connection. To verify that the certificate has not been revoked, your browser may contact DigiCert's servers. If you see the DigiCert Smart Seal trust badge on this page, it sets a cookie and shares your visit data with DigiCert in the United States; we load it only after your consent. Cookies and trackers ## What DigiCert sets and contacts - Tracking method Certificate Authority (CA) issuing SSL/TLS, code signing and document signing certificates. The optional Smart Seal widget loads JavaScript from seal.digicert.com that pings DigiCert servers and may set tracking cookies - Server location DigiCert, Inc., Lehi, Utah, United States. Global OCSP and CRL responder network including European edges - Cookieless mode available Yes - Data transferred outside the EU OCSP and CRL requests (which include the visitor's IP and the certificate identifier they are validating) reach DigiCert's global network. Order data, customer details, and Smart Seal events are stored at DigiCert in the United States. Transfers covered by Standard Contractual Clauses and EU-US Data Privacy Framework certification. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------- | --------------------- | -------- | ----------------------------------------------------------------------------------------------------------------- | | DC\_VISITOR | Marketing / Analytics | 1 year | Set by the optional DigiCert Smart Seal trust badge to count widget impressions and recognise returning visitors. | | seal\_session | Functional | Session | Maintains the Smart Seal validation session during a visit. | | \_dc\_consent | Strictly necessary | 1 year | Stores the visitor's consent status for the DigiCert Smart Seal widget on this site. | ### Third-party domains contacted (6) - `digicert.com` - `seal.digicert.com` - `ocsp.digicert.com` - `crl.digicert.com` - `cacerts.digicert.com` - `ts-ocsp.ws.symantec.com` Questions ## Frequently asked questions about DigiCert Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does DigiCert set cookies on my visitors' browsers? Not directly from the certificate. Only the optional DigiCert Smart Seal widget, when embedded on the page, sets cookies such as DC\_VISITOR and seal\_session, and pings DigiCert servers from the visitor's browser. ### Do I need consent to use DigiCert SSL? No for the certificate itself: HTTPS encryption is a strictly necessary security measure. OCSP/CRL revocation checks rely on legitimate interest or legal obligation. The optional Smart Seal trust widget is non-essential and requires prior consent under ePrivacy. ### What is the legal basis for OCSP and CRL processing? Legitimate interest (Art. 6(1)(f) GDPR) and the legal obligation under Art. 32 GDPR to ensure the security of processing, combined with the CA/Browser Forum baseline requirements. OCSP stapling reduces the personal data flow. ### Is data transferred to the United States? Yes for OCSP, certificate orders and Smart Seal widget. DigiCert is headquartered in the United States. Transfers rely on the 2021 SCCs and EU-US Data Privacy Framework certification. ### Do I need a DPIA for DigiCert? A streamlined DPIA is sufficient for standard certificate use. A more detailed assessment is recommended when DigiCert qualified eIDAS certificates are used for high-trust signing (financial advice, public administration). For Smart Seal use, document the cookie placement and US transfer. ### How do I deploy DigiCert in compliance? Enable OCSP stapling, sign the subscriber agreement and DPA, mention DigiCert in your privacy notice as a processor, prefer EU-based QTSPs for eIDAS qualified certificates, gate the Smart Seal behind your CMP, and monitor Certificate Transparency logs for certificates referencing your domain. ### What are EU-based alternatives to DigiCert? EU-based or EU-friendly Certificate Authorities include Sectigo (UK / Romania), GlobalSign (originally Belgium, now Japan), Atos (France) for qualified eIDAS certificates, Buypass (Norway) and SwissSign (Switzerland with adequacy decision). Let's Encrypt (US non-profit) is free and the default for most low-trust deployments. ### How do I update my privacy and cookie policies? In your privacy notice, name DigiCert as a processor for certificate orders and a recipient for OCSP/CRL traffic; mention the US transfer and the legal basis. If the Smart Seal is embedded, add an entry in the cookie policy for DC\_VISITOR / seal\_session, describe the purpose and duration, and link to DigiCert's privacy statement. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [GeeTest](https://www.flowconsent.com/en/services/security/geetest) [GeeTest is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GeeTest supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GeeTest ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/geetest) [Essential](https://www.flowconsent.com/en/services/security/geetest) · ### [Yandex SmartCaptcha](https://www.flowconsent.com/en/services/security/yandex-smartcaptcha) [Yandex SmartCaptcha is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Yandex SmartCaptcha provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Yandex SmartCaptcha ensures optimal performance at scale.](https://www.flowconsent.com/en/services/security/yandex-smartcaptcha) [Essential](https://www.flowconsent.com/en/services/security/yandex-smartcaptcha) · ### [Norton Shopping Guarantee](https://www.flowconsent.com/en/services/security/norton-shopping-guarantee) [Norton Shopping Guarantee is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Norton Shopping Guarantee supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Norton Shopping Guarantee ensures your website delivers a smooth, uninterrupted experience to every visitor.](https://www.flowconsent.com/en/services/security/norton-shopping-guarantee) [Essential](https://www.flowconsent.com/en/services/security/norton-shopping-guarantee) · ### [Sardine](https://www.flowconsent.com/en/services/security/sardine) [Sardine is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Sardine integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Sardine makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/security/sardine) [Essential](https://www.flowconsent.com/en/services/security/sardine) · ### [Authy](https://www.flowconsent.com/en/services/security/authy) [Authy is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Authy supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Authy enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/authy) [Essential](https://www.flowconsent.com/en/services/security/authy) · ### [Qualva](https://www.flowconsent.com/en/services/security/qualva) [Qualva is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Qualva supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Qualva ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/qualva) [Essential](https://www.flowconsent.com/en/services/security/qualva) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)