No public evidenceShutterstock and GDPR
CertReports found no public GDPR evidence for Shutterstock as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 9 Nov 2016
- Expires or valid through
- 31 Oct 2026
- Scope
- Shutterstock processes personal data to provide products and services to provide digital asset management software as a service and operate a content licensing marketplace. From our customers, we may collect Contact information such as name, phone and fax numbers, address and email address; Billing information such as the number, expiration date, card type and billing address of your credit card; and Demographic information such as your job title, job description and company name and company type. From contributors submitting content for licensing, we collect: Contact information (such as name, phone number, primary address, and email address) and Shutterstock will verify this information by requesting: a) a scan of a government issued ID (which will be stored on our servers); or b) a credit card number, to be used solely for the purpose of verifying your name and address and not stored; Payment and contributor information including, but not limited to, payout method, payout email, display name). Shutterstock uses one or more outside credit card processing companies to bill customers for goods and services. To the best of our knowledge, these companies do not retain, share, store or use personally identifiable information for any other purpose. We also share Personal Information with certain companies that perform services on our behalf. We only share the Personal Information which is necessary for them to perform those services. We require any company with which we may share Personal Information to protect that data in a manner consistent with this policy and to limit the use of such Personal Information to the performance of services for Shutterstock. We do not sell or otherwise provide Personal Information to other companies for the marketing of their own products or services.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Shutterstock, Inc.: Active: UK Extension Certification, SW-US Certification, EU-US Certification | Live pagesha256 bbb1239f34 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Shutterstock GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Media and content category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Media and content vendor has GDPR evidence in the index yet.