Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Olapic is a United States visual user generated content and shoppable content platform, owned by Social Native. It collects user submitted images, engagement signals, and analytics to power galleries on brand websites. Because it sets cookies and analytics identifiers, it requires consent and careful documentation under GDPR and ePrivacy.
Olapic is a visual user generated content and shoppable content platform owned by Social Native. Brands use it to gather customer photos and videos and display them in galleries that can link directly to products. It runs on brand websites through an embedded widget that loads content and measures how visitors interact with it.
Olapic collects user submitted images and the engagement they generate, along with analytics about how galleries are viewed and clicked. To do this it sets a visitor or session cookie, an analytics cookie, and an engagement tracking cookie. It also processes the content and rights information of the people who submit media.
Because Olapic stores cookies and analytics identifiers in the browser, the ePrivacy rule on terminal storage applies and these cookies require prior consent. Under the GDPR, the brand is usually the controller and Olapic acts as a processor for the gallery functionality. User generated images can also contain personal data of the people shown, so rights and permissions matter.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
A consent banner should block the Olapic analytics and engagement cookies until the visitor opts in, while strictly necessary functionality can be kept minimal. When collecting user generated content, obtain clear permission to reuse images and respect the rights of any identifiable people. Honour later withdrawal of consent for both cookies and content reuse.
Olapic processes data in the United States, so transfers from the EEA rely on Standard Contractual Clauses with supplementary measures where needed. Brands should confirm the transfer mechanism in their data processing agreement and record it in their documentation. Images that show identifiable people are personal data and fall within the same transfer safeguards.
Sign a data processing agreement, confirm United States hosting and the transfer mechanism, and deploy a consent banner that gates the Olapic cookies. Document each cookie with its purpose and duration in your cookie policy. Keep clear records of content permissions and provide a way for people to request removal of their images.
Websites using Olapic must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is worth considering because Olapic processes user generated images that can identify people and tracks engagement through analytics cookies. Key points to assess are (1) the categories of data collected, including submitted images, engagement signals, and analytics identifiers; (2) the rights and permissions obtained from people who submit or appear in content; (3) the lawful basis, which is consent for the cookies and for reuse of user content; (4) the transfer of data to the United States and the adequacy of Standard Contractual Clauses with supplementary measures; and (5) retention, access controls, and a clear process for removing images on request.
Sample consent text
We use cookies to show community photos and measure how you interact with our galleries. They load only if you accept. You can change your choice at any time.
Third-party domains contacted
olapic.comphotorank.mecontent.photorank.meCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| olapic_visitor | Functional | Session | Identifies the visitor session so galleries load and behave consistently during a visit. |
| olapic_analytics | Analytics | 1 year | Measures how galleries are viewed to help improve content presentation and performance. |
| olapic_engagement | Analytics | 1 year | Tracks clicks and interactions with user generated content to report engagement. |
Olapic places tracking cookies for advertising — comply with GDPR using FlowConsent.
Olapic typically sets a visitor or session cookie, an analytics cookie, and an engagement tracking cookie on the pages where its galleries appear. These measure how visitors view and interact with user generated content. The analytics and engagement cookies are the ones that require consent.
Yes, consent is required before the Olapic analytics and engagement cookies load, since they are not strictly necessary. When you also collect and reuse user generated images, you need permission for that reuse separately. Both the cookies and the content reuse should be gated by clear opt in.
The legal basis is consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3) for the cookies, and consent or a clear permission for reusing user submitted images. The brand is normally the controller and Olapic acts as a processor for the gallery service. Image rights from the people shown should be secured at the point of collection.
Yes, Olapic processes data in the United States, so transfers from the EEA rely on Standard Contractual Clauses with supplementary measures where appropriate. This includes both analytics data and user generated images that show identifiable people. Confirm the transfer mechanism in your data processing agreement and record it.
A DPIA is worth considering because Olapic processes user generated images that can identify people and tracks engagement with analytics cookies. The assessment should cover image rights, lawful basis, retention, and the transfer of data to the United States. It should also confirm a clear process for removing images on request.
Sign a data processing agreement, confirm United States hosting and the transfer mechanism, and gate the Olapic cookies behind a consent banner. Secure clear permissions when collecting user content and respect the rights of identifiable people. Document each cookie in your policy and provide an easy route to request image removal.
Alternatives include other visual user generated content platforms such as Bazaarvoice, Yotpo, and Stackla. Some offer EU based hosting that can simplify data transfer questions. Whichever you pick, the same duties around cookie consent, image rights, and transfers apply.
List each Olapic cookie with its name, type, duration, and purpose, separating any strictly necessary cookie from analytics and engagement ones. State that analytics and engagement cookies load only after consent and that withdrawal is possible. Mention that user generated images may show identifiable people and explain how removal can be requested.