Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
OpenWeb, formerly Spot.IM, is a US audience-engagement and conversation platform embedded on publisher sites to power comments and community features. It builds user profiles and supports advertising monetisation using cookies, local storage identifiers and behavioural profiling. Because it tracks users and transfers data to the United States for advertising, it is a high-risk integration that requires careful consent management.
OpenWeb, formerly known as Spot.IM, is a United States audience engagement platform embedded on publisher websites to power comments, conversations and community features. Alongside engagement, it builds user profiles and supports advertising monetisation. Because it loads in the visitors browser, tracks behaviour and connects to advertising systems, it is a significant processing activity that must be documented carefully.
OpenWeb typically sets a user or profile identifier cookie, a session cookie, an advertising cookie and a cookie sync cookie, and it also uses local storage identifiers. These are used to recognise users, build behavioural profiles and match identifiers with advertising partners. The profiling and advertising elements are non essential and go well beyond what is needed to display a comment box.
Under the ePrivacy Directive, the advertising, profiling and cookie sync identifiers are not strictly necessary and require prior consent. Under the GDPR, building profiles and sharing data with advertising partners is high risk processing that needs a valid legal basis, transparency and respect for user rights. OpenWeb integrates with the IAB Europe Transparency and Consent Framework, so consent signals must be captured and passed through correctly.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is the legal basis for the advertising and profiling features, and it should be collected through a TCF compatible consent management platform before any non essential identifier loads. OpenWeb processes data in the United States and may share it with advertising partners, so transfers rely on Standard Contractual Clauses and should be backed by a transfer impact assessment. Given the breadth of partners, you must be able to explain where data goes and how users can object.
Use a TCF certified consent management platform, block OpenWeb until consent is given, and ensure consent and objection signals reach OpenWeb and its partners. Sign a data processing agreement, document the Standard Contractual Clauses and supplementary measures, and conduct a DPIA because of the profiling and transfers. List every cookie and identifier in your cookie policy and re test the integration regularly to confirm that refusals are honoured.
Websites using OpenWeb must obtain user consent under GDPR regulations.
DPIA considerations
OpenWeb combines profiling, advertising and transfers to the United States, so a DPIA is strongly recommended. Assess: (1) the scale of behavioural profiling and the user identifiers built across publisher sites; (2) the sharing of data with advertising partners and cookie syncing; (3) the reliance on the IAB Europe TCF and whether consent signals are correctly captured and respected; (4) the transfer of personal data to the United States and the adequacy of Standard Contractual Clauses and supplementary measures; (5) retention periods and the difficulty for users to exercise their rights across many partners.
Sample consent text
We use OpenWeb to power comments and community features and, with your consent, to personalise content and ads. This sets cookies and identifiers and may share data with advertising partners in the United States. Nothing non essential loads until you click Accept, and you can change your choice at any time.
Third-party domains contacted
openweb.comspot.imspotim.marketlauncher.spot.imCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| openweb_uid | Advertising | Persistent (up to 1 year) | User or profile identifier used to recognise users and build behavioural profiles across publisher sites. |
| openweb_session | Functional | Session | Maintains the session for the comments and conversation interface. |
| openweb_ads | Advertising | Persistent (up to 1 year) | Supports advertising selection and measurement based on the user profile. |
| openweb_sync | Advertising | Persistent (up to 1 year) | Synchronises identifiers with advertising partners through cookie matching. |
| openweb_consent | Functional | Persistent (up to 1 year) | Stores the TCF consent state so user choices are remembered and respected. |
OpenWeb places tracking cookies for advertising — comply with GDPR using FlowConsent.
OpenWeb typically sets a user or profile identifier cookie, a session cookie, an advertising cookie and a cookie sync cookie, and it also uses local storage identifiers. These recognise users, build behavioural profiles and match identifiers with advertising partners. Only the session and core identifier handling supports the basic feature, while the advertising and sync cookies are non essential.
Yes. OpenWeb relies on profiling, advertising and cookie sync identifiers that are not strictly necessary, so prior, informed consent is required under the ePrivacy Directive and the GDPR. Consent should be collected through a TCF compatible platform and OpenWeb must be blocked until the user accepts. Refusals and objections must be passed through to OpenWeb and its partners.
The advertising and profiling features rely on consent under GDPR Art. 6(1)(a) and Art. 5(3) of the ePrivacy Directive, signalled through the IAB Europe TCF. Legitimate interest is not appropriate for this scale of profiling and ad targeting. Record the consent based purposes and ensure the consent signal genuinely controls processing.
Yes. OpenWeb processes data in the United States and may share it with advertising partners, so personal data is transferred to a third country. These transfers rely on Standard Contractual Clauses and should be supported by a transfer impact assessment and supplementary measures. You should inform users about the US transfer and the categories of recipients.
Yes, a DPIA is strongly recommended because OpenWeb combines large scale behavioural profiling, advertising data sharing and transfers to the United States. Assess the profiling, the partner ecosystem, the reliance on the TCF, the US transfers and the retention periods. The combination of these factors typically meets the threshold for a mandatory DPIA under the GDPR.
Deploy a TCF certified consent management platform, block OpenWeb until consent is given, and confirm that consent and objection signals reach OpenWeb and its advertising partners. Sign a data processing agreement, document the Standard Contractual Clauses and supplementary measures, and complete a DPIA. List every cookie and identifier in your cookie policy and test that refusing consent truly stops the profiling and advertising scripts.
Other commenting and community platforms exist, including privacy focused or EU based comment systems that avoid advertising profiling, as well as self hosted options. When comparing them, weigh whether the tool relies on advertising monetisation, where data is stored, and how transparent its partner and transfer arrangements are. A less ad driven solution can substantially reduce your consent and transfer risk.
List every OpenWeb cookie and local storage identifier with its name, type, purpose and duration, and clearly flag the advertising, profiling and sync identifiers as requiring consent. Disclose that OpenWeb profiles users, shares data with advertising partners and transfers data to the United States. Re scan your site after changes and keep the disclosure aligned with your TCF vendor information.