Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Privy is an ecommerce marketing tool for Shopify and other online stores. It provides website popups, signup forms and spin to win displays to capture visitor email addresses and phone numbers, then runs email and SMS marketing campaigns and automations such as abandoned cart and welcome flows. To target and measure these campaigns Privy sets cookies and tracking scripts that monitor visitor behaviour and conversions.
Privy is an ecommerce marketing platform used mainly by Shopify and other online stores. It lets merchants build website popups, banners, signup forms and spin to win displays to capture email addresses and phone numbers, and it runs email and SMS marketing campaigns and automations such as welcome series and abandoned cart reminders. Because it both shows targeted messages and tracks whether visitors convert, Privy places cookies and scripts on the websites that use it.
Privy sets cookies and uses local storage to remember whether a popup has already been shown, to limit how often visitors see a campaign, to identify returning visitors, to follow cart activity and to attribute conversions. When a visitor submits a form, Privy collects their email address, phone number and the data they enter, and links this to behavioural information about their visit. This combination of device identifiers with directly identifying contact details makes the processing clearly personal data under the GDPR.
The cookies Privy sets for marketing and measurement are not strictly necessary to deliver the website, so under the ePrivacy Directive and national rules such as PECR they require prior consent before they are stored or read. The marketing emails and SMS messages sent through Privy are governed by the GDPR and ePrivacy rules on electronic communications, which generally require opt in consent. The store is the data controller and Privy acts as a processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain freely given, specific and informed consent through a consent banner before Privy marketing cookies load, and visitors must be able to refuse and to withdraw consent easily. Privy is a US based vendor, so personal data of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Privy is certified, or on Standard Contractual Clauses backed by a transfer impact assessment.
Sign a data processing agreement with Privy, block its scripts until consent is given through your consent management platform, and use double opt in for email and SMS where possible. List the Privy cookies in your cookie policy with their purpose and duration, document the lawful basis and the international transfer safeguards, set clear retention periods, and give subscribers an easy way to unsubscribe and to exercise their data subject rights.
Websites using Privy must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is not usually mandatory for standard popup and email capture use, but a documented assessment is recommended. Consider the scale of visitor tracking, the combination of behavioural cookies with directly identifying contact details, SMS marketing rules under national law, and the transfer of personal data to the United States. Document the lawful basis, retention periods and the safeguards for international transfers.
Sample consent text
We use Privy to show marketing popups and to send you email and SMS updates. Privy sets cookies to display these messages and to measure their performance. These cookies run only after you accept marketing cookies, and you can withdraw your consent at any time.
Third-party domains contacted
privy.comwidget.privy.comassets.privy.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _privy_email | Marketing | 1 year | Stores whether the visitor has submitted their email so the same signup popup is not shown again. |
| privy_session | Functionality | Session | Maintains the visitor session and controls popup display logic during the visit. |
| _privy_dismissed | Functionality | 30 days | Records that a visitor dismissed a popup so the display frequency can be capped. |
| privy_cart | Marketing | 30 days | Tracks cart activity to support abandoned cart automations and conversion attribution. |
Privy places tracking cookies for advertising — comply with GDPR using FlowConsent.
Privy sets first and third party cookies and uses local storage to remember whether a popup has been shown, to cap how often it appears, to identify returning visitors, to follow cart activity and to attribute conversions. These are marketing and functionality cookies rather than strictly necessary ones.
Yes. Because the Privy cookies are used for marketing and measurement and are not strictly necessary, you need prior consent before they load. Email and SMS marketing sent through Privy also generally requires opt in consent from the recipient.
The legal basis is consent under Article 6(1)(a) of the GDPR, combined with consent under the ePrivacy rules for storing and reading cookies and for sending electronic marketing. Legitimate interest is not appropriate for these marketing cookies.
Yes. Privy is a US based vendor, so personal data of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Privy is certified, or on Standard Contractual Clauses with a transfer impact assessment.
A full DPIA is not usually mandatory for standard popup and email capture use. A documented assessment is still recommended, especially given the combination of behavioural tracking with identifying contact details, SMS marketing and the transfer of data outside the EU.
Sign a data processing agreement, block Privy scripts until the visitor consents through your consent management platform, use double opt in for email and SMS where possible, list the cookies in your cookie policy and provide an easy way to unsubscribe and to exercise data subject rights.
Alternatives include other popup and email tools such as Klaviyo, OptiMonk, Sumo, Mailchimp or Omnisend. Any alternative that sets marketing cookies or sends electronic marketing raises the same consent and transfer questions, so assess each on its data practices.
List each Privy cookie with its name, purpose and duration, classify them as marketing or functionality cookies, name Privy as the processor, mention the transfer of data to the United States and the safeguards used, and explain how visitors can manage or withdraw consent.