> How SheerID verifies eligibility for student, teacher or military discounts, which personal data it processes and what US transfers mean under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/security/sheerid Security # SheerID Essential · [Official website](https://www.sheerid.com/) SheerID is a US based identity verification provider that lets retailers offer gated discounts to specific consumer segments (students, teachers, military, healthcare workers, first responders, age verified shoppers). The SheerID verification form is embedded in the checkout flow and confirms eligibility by checking authoritative databases. SheerID processes substantial personal data (full name, date of birth, school or employer name, professional ID) and is a critical GDPR processor with high risk level. [Block SheerID until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Required - Documented cookies 0 - Servers United States (SheerID Inc.) with EU sub-processors Overview ## What does SheerID do? ## **What SheerID is and how it works** SheerID is an identity verification platform that lets brands offer gated promotions to specific consumer segments. Common segments include students, teachers, military, healthcare workers, first responders, seniors, age verified adults and recent movers. The verification form is embedded in the checkout or signup flow; the consumer provides their details, SheerID checks authoritative databases (university registrars, employer directories, government records) and returns an eligibility verdict. The brand applies the discount only to verified consumers. ## **What data SheerID processes** Depending on the verification type, SheerID collects full name, date of birth, address, email, phone number, employer or school name, professional or student identification number, and sometimes documentary evidence (uploaded photo ID, pay stub, enrolment certificate, transcript). Some verifications imply special categories of data under Art. 9 GDPR (healthcare profession status indicates health context, religious organisation membership reveals religion). The platform sets cookies on the verification form domain to support session state. ## **GDPR implications** SheerID is a processor of consumer personal data under GDPR. The retailer is the controller and must sign the SheerID DPA, document the processing in its record of processing activities, run a DPIA (mandatory given the scope of data) and inform consumers. For special categories of data (Art. 9), explicit consent is needed or another Art. 9 lawful condition. For verifications that affect access to a service (e.g. military discount), Art. 22 GDPR considerations on automated decision making apply. ## **Consent and disclosure requirements** Before opening the verification form, disclose to the consumer that SheerID will process their data on US servers, what data will be collected, the legal basis (consent or contract), the purpose (verifying eligibility for a discount), the retention, and that the consumer can refuse and pay full price instead. The form itself collects the personal data only after the consumer has clicked through, and SheerID provides standard consent language that can be customised. ## **Data transfers and sub-processors** SheerID is US headquartered and processes data primarily in the United States, with EU sub-processors for some specific data sources (university registrars in the EU, EU based military identity systems). Transfers to the US rely on SCCs and the EU, US Data Privacy Framework. A Transfer Impact Assessment is required and should be substantive given the categories involved. ## **Practical compliance steps** Sign the SheerID DPA, run a DPIA before launch (mandatory), inform consumers clearly in your checkout flow about the data transfer and verification process, present an alternative way to access the price (no discount but no data sharing), avoid using SheerID for special categories without explicit consent, set short retention for verification outcomes (the verdict needs to be retained only as long as the discount is valid), and audit Art. 22 GDPR safeguards (human review for refused verifications). Compliance ## SheerID and the GDPR SheerID is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for identity verification disclosures; contract performance (Art. 6(1)(b)) where verification is required to access a discount or service - Risk level high - Applicable regulations GDPR, GDPR Art. 9 for any sensitive category verification, eIDAS for identity, AML where financial services apply ### Impact assessment (DPIA) SheerID processes substantial personal data: full name, date of birth, residential address, email address, phone number, employer or school name, professional or student ID number, sometimes supporting documents (uploaded ID, pay stub, enrolment certificate). For some verifications, sensitive data (health profession, military status) is processed under Art. 9 GDPR. Key DPIA considerations: (1) the data category is substantial and includes some sensitive categories; (2) authoritative database lookups happen across multiple jurisdictions, creating additional flows; (3) US hosting and processing requires SCCs and TIA; (4) document upload for manual verification raises stronger security obligations; (5) verification outcomes can affect access to discounts, raising fairness considerations under Art. 22 GDPR. A DPIA is mandatory. ### Sample text for your banner > We use SheerID to verify your eligibility for special pricing. SheerID processes your full name, date of birth, professional or student status, and may transfer this data to SheerID Inc. in the United States. Your data is used only for the verification and is not shared for marketing. You can refuse verification, but in that case the discount will not apply. Cookies and trackers ## What SheerID sets and contacts - Tracking method JavaScript verification form (sheerid.js) embedded on the publisher website - Server location United States (SheerID Inc.) with EU sub-processors - Data transferred outside the EU SheerID is a US headquartered identity verification provider. Hosting is primarily in the United States with regional processing in the EU for some data sources. Transfers rely on Standard Contractual Clauses and the EU, US Data Privacy Framework. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [DataDome](https://www.flowconsent.com/en/services/security/datadome) [DataDome is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. DataDome integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, DataDome helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/datadome) [Essential](https://www.flowconsent.com/en/services/security/datadome) · ### [Feroot](https://www.flowconsent.com/en/services/security/feroot) [Feroot is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Feroot integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Feroot helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/feroot) [Essential](https://www.flowconsent.com/en/services/security/feroot) · ### [ClickFreeze](https://www.flowconsent.com/en/services/security/clickfreeze) [ClickFreeze is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ClickFreeze enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ClickFreeze empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/security/clickfreeze) [Marketing](https://www.flowconsent.com/en/services/security/clickfreeze) · ### [Apple Sign-in](https://www.flowconsent.com/en/services/security/apple-sign-in) [Apple Sign-in is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Apple Sign-in offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Apple Sign-in empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/security/apple-sign-in) [Essential](https://www.flowconsent.com/en/services/security/apple-sign-in) · ### [Drata](https://www.flowconsent.com/en/services/security/drata) [Drata is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Drata supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Drata ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/drata) [Essential](https://www.flowconsent.com/en/services/security/drata) · ### [Geobytes](https://www.flowconsent.com/en/services/security/geobytes) [Geobytes is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Geobytes supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Geobytes ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/geobytes) [Essential](https://www.flowconsent.com/en/services/security/geobytes) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)