Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Evolok is a registration, paywall, subscription, and access-management platform for publishers. It manages user identity and entitlements and uses behavioural data to drive dynamic paywalls and personalisation. Login and entitlement cookies are essential, while analytics and personalisation features require consent.
Evolok is an access-management platform that publishers use for registration, paywalls, subscriptions, and entitlement control. It manages user identity and determines what content each visitor is allowed to access based on their account and subscription. It also applies behavioural data to power dynamic paywalls and personalised experiences.
Evolok sets identity and session cookies that keep a user logged in, along with entitlement cookies that record which subscriptions and content rights apply. These functional cookies are necessary to deliver the service the user has requested. Separately, Evolok can set analytics and personalisation cookies that track reading behaviour to tune paywalls and recommendations, and these process personal data beyond what is strictly necessary.
The login and entitlement cookies are essential to provide the account and subscription service, so they rely on the contract legal basis under Article 6(1)(b) of the GDPR and are exempt from consent under ePrivacy Art. 5(3). The behavioural analytics and personalisation cookies are not strictly necessary, so they require consent under Article 6(1)(a) and ePrivacy Art. 5(3). It is important to separate these categories clearly in your consent design.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Essential identity and entitlement cookies may be set without consent because they are needed to keep the user logged in and to honour their subscription. However, the analytics and personalisation cookies must only fire after the visitor has consented to them. Your consent banner should let users accept the optional categories independently and withdraw that consent at any time.
Identity and behavioural data may be processed in the United Kingdom and the United States, so deploying Evolok can involve transfers of personal data to third countries. These transfers rely on UK or EU adequacy decisions where available, or on Standard Contractual Clauses where they are not. Controllers should confirm the applicable mechanism with Evolok and record it in their documentation.
Map Evolok cookies into clear categories so essential identity and entitlement cookies are distinguished from optional analytics and personalisation. Gate the optional cookies behind consent and confirm that logging in still works when a user declines them. Put a data processing agreement in place with Evolok, document the international transfers, and reflect both essential and optional processing in your privacy and cookie policies.
Websites using Evolok must obtain user consent under GDPR regulations.
DPIA considerations
Evolok carries medium risk because it combines essential identity and entitlement processing with behavioural analytics and personalisation, so a DPIA is advisable where profiling is significant. The assessment should address (1) the distinction between essential login and entitlement cookies relying on the contract basis and optional analytics and personalisation cookies relying on consent; (2) the scale and intrusiveness of behavioural tracking used to drive dynamic paywalls; (3) transfers of identity and behavioural data to the United Kingdom and the United States and the applicable adequacy decisions or Standard Contractual Clauses; (4) the validity and granularity of consent for the optional cookies and the ability to withdraw it; and (5) retention limits, data minimisation, and a data processing agreement with Evolok.
Sample consent text
We use essential cookies to keep you signed in and manage your subscription. We also use optional analytics and personalisation cookies to improve our paywall and recommendations. Click Accept to allow the optional cookies or Reject to keep only the essential ones.
Third-party domains contacted
evolok.comevolok.netapi.evolok.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| evolok_session | Functional | Session | Maintains the authenticated user identity and session so the visitor stays logged in across pages. |
| evolok_entitlement | Functional | Up to 1 year | Records which subscriptions and content access rights apply to the user to enforce the paywall. |
| evolok_analytics | Analytics | Up to 1 year | Tracks reading behaviour and engagement to inform dynamic paywall rules and reporting; requires consent. |
| evolok_personalisation | Personalisation | Up to 1 year | Stores preferences and behavioural signals to personalise content, offers, and recommendations; requires consent. |
Evolok places tracking cookies for advertising — comply with GDPR using FlowConsent.
Evolok sets an identity or session cookie that keeps the user logged in and an entitlement cookie that records which subscriptions and content rights apply, both of which are functional and essential. It can also set an analytics cookie that tracks reading behaviour and a personalisation cookie that tailors paywalls and recommendations. The analytics and personalisation cookies are not strictly necessary and require consent.
Consent is required for the analytics and personalisation cookies, which are not strictly necessary and must only fire after the visitor accepts them. The identity and entitlement cookies are essential to deliver the account and subscription service, so they can be set without consent. A clear separation between these categories is essential to a compliant setup.
The login and entitlement processing relies on the contract legal basis under GDPR Art. 6(1)(b) because it is needed to provide the account and subscription. The behavioural analytics and personalisation cookies rely on consent under Art. 6(1)(a) and ePrivacy Art. 5(3). Applying the correct basis to each category is key to lawful use.
Yes, identity and behavioural data may be processed in the United Kingdom and the United States, so deploying Evolok can involve transfers to third countries. These transfers rely on UK or EU adequacy decisions where available, or on Standard Contractual Clauses where they are not. Confirm the applicable mechanism with Evolok and record it in your documentation.
A DPIA is advisable where the behavioural profiling that drives dynamic paywalls is significant, given the medium risk profile. The assessment should weigh the separation of essential and optional cookies, the scale of behavioural tracking, the international transfers, and the validity of consent. It should also confirm retention limits, data minimisation, and a data processing agreement with Evolok.
Map Evolok cookies into clear categories, keeping essential identity and entitlement cookies separate from optional analytics and personalisation. Gate the optional cookies behind a consent banner and verify that logging in still works when a user declines them. Sign a data processing agreement with Evolok, document the international transfers, and reflect both processing types in your privacy and cookie policies.
Alternatives include other paywall and subscription platforms such as Piano, Poool, Zephr, or Pelcro, which raise similar questions about essential versus optional processing and consent. Some publishers build identity and entitlement management in house and pair it with a separate consent and analytics stack. The right choice depends on your personalisation needs, scale, and data governance preferences.
List the essential identity, session, and entitlement cookies and explain that they keep users signed in and manage subscriptions on the contract basis. Separately list the analytics and personalisation cookies as optional cookies requiring consent, with their purposes and durations. Disclose the processing in the United Kingdom and the United States and the transfer safeguards, and keep the policy aligned with your consent banner categories.