Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Goope is a hosted website builder for small and mid sized Japanese businesses, operated by GMO Pepabo, Inc. It targets local shops, restaurants, salons and cultural venues with templates, a domain service and a basic content management interface. Hosting is in Japan, which benefits from an EU adequacy decision, but European customers must still address the cookie consent obligations for any analytics or third party scripts they enable on top of the platform.
Goope is a hosted website builder operated by GMO Pepabo, Inc., part of the GMO Internet Group. It is targeted at small and mid sized Japanese businesses such as restaurants, hair salons, dental practices and cultural venues. The product packages templates, a domain service, basic CMS, image hosting and a contact form module.
Out of the box, Goope sets functional first party cookies for the editor login (goope_session) and the language preference. Visitor IP addresses, user agents and request metadata reach the GMO data centres in Japan. The site owner can plug in Google Analytics, Yahoo! Japan ad tags, social widgets and other scripts via the custom code feature.
The base Goope cookies qualify as strictly necessary and are exempt from consent under Article 5(3) ePrivacy. Any analytics tag or third party integration added by the site owner is not exempt and triggers the consent requirement. The IP processing in Japan is personal data processing under Article 4(1) GDPR and requires a clear legal basis and transfer mechanism.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In January 2019 the European Commission adopted a mutual adequacy decision with Japan covering personal data transferred to private commercial operators that comply with the supplementary rules of the APPI. Goope is in scope as long as GMO Pepabo handles EU personal data under those rules. Standard Contractual Clauses are therefore not strictly required, but a transfer impact assessment is recommended.
A vanilla Goope site with no analytics, no embedded video and no third party fonts can in many cases run with only a privacy notice. Activating Google Analytics, Yahoo! Japan tags, Instagram embeds or Google Fonts loaded dynamically requires an opt in cookie banner. Goope does not include a built in CMP, so the site owner must inject one via the custom code feature.
Sign the GMO Pepabo Goope DPA, document Goope as a Japanese sub processor under the EU/Japan adequacy decision, mention GMO and the supplementary APPI rules in the privacy notice, prefer privacy aware embeds, install a CMP via custom code if you enable analytics, and review the site after each Goope template release for new third party scripts.
Websites using Goope must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for a Goope site that uses only the platform with strictly necessary cookies. It can become relevant if Google Analytics, Yahoo! Japan tags, embedded social widgets or password protected sections handling special categories of personal data are added.
Sample consent text
This site is built on Goope, hosted in Japan by GMO Pepabo. Functional cookies are required to keep the experience working. We also use Google Analytics for audience measurement, which sets analytics cookies. We only enable analytics after you click Accept.
Third-party domains contacted
goope.jpstatic.goope.jppepabo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| goope_session | session | Session | Strictly necessary functional cookie used to maintain the editor login session in the Goope back office. |
| goope_locale | persistent | 1 year | Stores the visitor language preference for the published Goope site. |
Goope collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Goope sets functional first party cookies for the editor session (goope_session) and the language preference. The platform itself does not set advertising cookies. Third party tracking cookies appear only if the site owner adds them via integrations or custom code.
Not for the strictly necessary functional cookies. As soon as Google Analytics, Yahoo! Japan tags, Instagram embeds or dynamic Google Fonts is enabled, prior consent under Article 5(3) ePrivacy is required.
Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies and the page delivery. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for any third party integration that drops cookies or transfers data abroad.
Yes. GMO Pepabo, Inc. is a Japanese company and hosting is in Japan. Japan benefits from the EU/Japan mutual adequacy decision, with supplementary APPI rules for personal data received from the EEA. Standard Contractual Clauses are not strictly required when the deployment is in scope.
Generally no for a small business site with only strictly necessary cookies. A DPIA can be relevant if the site enables Google Analytics at scale, embeds many third party trackers, password protects sections handling special category data or hosts editorial content with sensitive personal data.
Sign the GMO Pepabo Goope DPA, document Goope as a Japanese sub processor under the EU adequacy decision and APPI supplementary rules, write a privacy notice that names the company and the transfer, prefer privacy aware embeds and add a cookie banner only if you enable analytics or third party trackers.
For privacy first website builders in Europe, alternatives include Webflow, Framer, Cargo, Pixpa, Format, Squarespace and Shopify with EU regions. For strict EU residency, the safest path is a static site generator (Astro, Hugo) hosted on EU providers (OVHcloud, Scaleway, Hetzner).
List GMO Pepabo, Inc. as a Japanese sub processor with the purpose (website hosting and content delivery), the cookies (goope_session, goope_locale), the legal basis (legitimate interest for functional cookies, consent for any third party tracker you enable), the transfer destination (Japan) and the safeguard (EU/Japan adequacy decision plus APPI supplementary rules).