Must we disclose Vercel Serverless Functions in our privacy policy?

Yes. Vercel Serverless Functions process user data and generate server logs containing request metadata and invocation details. Since data flows to Vercel Inc., a third-party processor, you must disclose this service, describe what data is collected, and explain the legal basis for processing under GDPR, CCPA, and other privacy laws.

What data does Vercel Serverless Functions collect?

Vercel Serverless Functions collect function invocation data, request logs (including IP addresses, user agents, and request metadata), and performance metrics via Vercel Analytics and Web Vitals. Functions may also process any user-submitted data passed through API calls or form submissions. You should audit function logs to identify and minimize PII collection.

Does Vercel Serverless Functions require a cookie consent banner?

No. Vercel Serverless Functions itself does not set cookies. However, if you use Vercel Analytics alongside serverless functions, it is privacy-friendly and does not require cookie consent. Always audit any additional analytics or tracking tools integrated with your functions separately.

Who processes data from Vercel Serverless Functions and where?

Vercel Inc., a United States-based company, acts as your data processor. Data is processed primarily in the U.S., though Vercel supports EU regions for certain deployments. Vercel maintains SOC 2 Type II compliance. Review Vercel's privacy policy at https://vercel.com/legal/privacy-policy and establish a Data Processing Agreement (DPA) for GDPR compliance.

Cloud & Backend

Privacy policy clauses for Vercel Serverless Functions

Vercel Serverless Functions are backend compute services that execute code on-demand without managing servers. Websites use them to handle dynamic requests, process form submissions, authenticate users, and run custom logic in response to user interactions.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Vercel Serverless Functions collects

Your privacy policy must disclose each of the following data types when you use Vercel Serverless Functions.

Function invocation data

Vercel Analytics and Web Vitals

Request logs and metadata

When does Vercel Serverless Functions trigger privacy obligations?

Installation & Data Flow

Vercel Serverless Functions begin collecting data the moment your first function executes. Function invocation triggers automatic capture of:

–Request metadata: IP address, user agent, HTTP headers, query parameters, request body content
–Function logs: Console output, error traces, execution duration
–Vercel Analytics data: Web Vitals and performance metrics (Core Web Vitals, LCP, FID, CLS)

Privacy policy clauses for Vercel Serverless Functions

What data Vercel Serverless Functions collects

When does Vercel Serverless Functions trigger privacy obligations?

Installation & Data Flow

Regulatory Triggers

Where data goes

Common compliance pitfalls

Mistake 1: Logging PII in Function Code Without Realizing It's Persisted

Mistake 2: Missing or Incomplete DPA with Vercel

Mistake 3: Misconfiguring Analytics Consent or Not Disclosing Vercel Analytics

Legal note

Sample privacy policy clause

What regulators look for

DPA and GDPR Enforcement Focus

CCPA/CPRA Audit Priorities

First Audit Flag

Frequently asked questions

Must we disclose Vercel Serverless Functions in our privacy policy?

What data does Vercel Serverless Functions collect?

Does Vercel Serverless Functions require a cookie consent banner?

Who processes data from Vercel Serverless Functions and where?

Don't ship without Bandit.