Firebase: DPA, subprocessors and data location

Where to find the Firebase DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: app backend, database and authentication. The table is the short version; the sections below add detail.

Firebase at a glance

Notes on Firebase

The current Firebase Data Processing and Security Terms show "Terms last modified: August 21, 2024" and link to previous versions. They apply to Firebase Services whose agreement specifically references them, and take effect on the date you accepted.

You get 30 days' notice of a new subprocessor and 90 days to object by terminating the Agreement (section 11.4). The subprocessor page lists four entities but is dated September 23, 2021, and points to Google Cloud Platform subprocessors for the rest.

Section 10.1 allows processing in any country where Google or its subprocessors have facilities, subject to location commitments in the Agreement. Firebase's docs say the location for default Google Cloud resources is immutable once set.

Firebase DPA: where to find it and how it is accepted

Read the DPA on firebase.google.com. The Firebase Data Processing and Security Terms are incorporated into your agreement for Firebase Services that specifically reference them. They take effect on the date you accepted or the parties otherwise agreed. The page shows Terms last modified: August 21, 2024, with a Previous versions link..

Not stated in the source we checked (2026-10-17).

The terms apply to Firebase Services described at firebase.google.com/terms whose agreement specifically references them. The page does not list plans or which individual services are included.

Firebase subprocessors: the list and how change notices reach you

Firebase's subprocessor list (4 entries on the check date).

The page lists four third-party subprocessors: Accenture, EPAM Systems, Fastly and Firebase, Inc. (a Google affiliate). It says Google Cloud Platform subprocessors may also be used for limited activities and links to that list. The page shows Last modified: September 23, 2021.

How changes are announced: Notice from Google of each new subprocessor (section 11.4); delivery method not specified.

Notice before a new subprocessor starts: 30 days.

Section 11.4: at least 30 days before a new subprocessor starts processing Customer Data, Google notifies you of the engagement, including its name, location and activities.

You can object within 90 days. Terminate the Agreement for convenience by notifying Google, within 90 days of the notification (section 11.4).

Section 11.4: within 90 days after being notified of a new subprocessor, you can object by immediately terminating the Agreement for convenience.

Where Firebase stores data

• Any country where Google or its subprocessors maintain facilities, subject to data location commitments in the Agreement

You can choose the region.

Section 10.1: Customer Data may be processed in any country where Google or its subprocessors have facilities, subject to Google's data location commitments in the Agreement (if applicable). Firebase's project locations docs describe a location for default Google Cloud resources (default Firestore database, default Cloud Storage bucket) that you set and that is an immutable setting. Realtime Database instances and some other resources do not depend on it.

How Firebase moves data outside the EU and UK

• DPF (including UK Extension and Swiss-US DPF)
• SCCs (if no Data Transfer Solution is available)

Section 10.2: Google has adopted a Data Transfer Solution for restricted transfers, and the SCCs apply only if one is not available (the SCCs are linked on firebase.google.com). Section 10.6 says Google participates in the Data Privacy Framework for itself and certain wholly-owned US subsidiaries and points to dataprivacyframework.gov.

Is Firebase a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 5.1.1: Google is a processor of Customer Personal Data under the Terms.

Is Firebase GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Firebase's own documents say:

• A DPA is published: The Firebase Data Processing and Security Terms are incorporated into your agreement for Firebase Services that specifically reference them. They take effect on the date you accepted or the parties otherwise agreed. The page shows Terms last modified: August 21, 2024, with a Previous versions link.
• A subprocessor list is published.
• Notice of new subprocessors: 30 days. Section 11.4: at least 30 days before a new subprocessor starts processing Customer Data, Google notifies you of the engagement, including its name, location and activities.
• Transfer mechanisms named: DPF (including UK Extension and Swiss-US DPF), SCCs (if no Data Transfer Solution is available).
• Data locations named: Any country where Google or its subprocessors maintain facilities, subject to data location commitments in the Agreement.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Firebase to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Firebase, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Firebase | App backend, database and authentication | Any country where Google or its subprocessors maintain facilities, subject to data location commitments in the Agreement | DPF (including UK Extension and Swiss-US DPF); SCCs (if no Data Transfer Solution is available) | [DPA](https://firebase.google.com/terms/data-processing-terms) | [Subprocessors](https://firebase.google.com/terms/subprocessors) |

Add to my list

If you add or replace Firebase: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

Firebase states 30 days of notice before it adds a subprocessor. Section 11.4: at least 30 days before a new subprocessor starts processing Customer Data, Google notifies you of the engagement, including its name, location and activities. If your own customers were promised a longer notice, you have a gap to plan for.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from the Firebase Data Processing and Security Terms (last modified August 21, 2024), the Firebase subprocessor page (last modified September 23, 2021) and the project locations docs.

Related vendors

• Databases and backend
• Authentication
• Supabase Database hosting and authentication
• Clerk (clerk.com) User authentication and management
• Convex Backend database and realtime sync
• Auth0 Authentication and user identity
• All vendors

Sources and method

• https://firebase.google.com/terms/data-processing-terms checked 2026-10-17
• https://firebase.google.com/terms/subprocessors checked 2026-10-17

Facts come from Firebase's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: firebase.google.com.