Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
OptinMonster is a lead generation and pop up tool that tracks visitor behaviour to trigger campaigns such as exit intent pop ups, page view targeting, and referrer based offers. A JavaScript campaign script sets first party cookies to remember which campaigns a visitor has seen and how often. The data is processed in the United States. Because the cookies are not strictly necessary, prior consent is required under the GDPR and the ePrivacy Directive.
OptinMonster is a lead generation and conversion optimisation tool that displays pop ups, floating bars, slide ins, and inline forms. A JavaScript campaign script loads on each page and watches visitor behaviour, such as exit intent, scroll depth, time on page, number of pages viewed, and the referring source, to decide when to trigger a campaign. Marketers use it to grow email lists, promote offers, and reduce cart abandonment.
The script sets first party cookies such as om-success-, omSeen-, and omViewsSince- entries that record which campaigns a visitor has seen, whether they converted, and how many pages they have viewed, with lifetimes that typically range from one to twelve months, plus a session cookie called omSessionStart. OptinMonster also processes IP addresses, device and browser information, page URLs, the referrer, and any data entered into a form, which constitute personal data under the GDPR.
Because the campaign cookies are read from and written to the visitor terminal to support marketing rather than a strictly necessary function, Article 5(3) of the ePrivacy Directive requires prior consent. The behavioural targeting and the collection of identifiable form data also qualify as personal data processing under the GDPR, so a lawful basis, a transparent privacy notice, and a record of processing activities are required, with OptinMonster acting as a processor under a data processing agreement.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The campaign script and its cookies must not load before the visitor has actively accepted the marketing category in your consent banner. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard. Where a pop up captures an email address, the sign up must be a clear, affirmative opt in, and the consent you collect must be freely given, specific, informed, and as easy to withdraw as to give.
OptinMonster processes data in the United States, so you must document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses and sign the OptinMonster data processing agreement. In practice, gate the campaign script behind your consent management platform, use affirmative opt in on pop up forms, list the OptinMonster cookies and their durations in your cookie policy, and configure retention so that behavioural data is not kept longer than necessary.
Websites using OptinMonster must obtain user consent under GDPR regulations.
DPIA considerations
OptinMonster tracks visitor behaviour such as exit intent and page views to trigger campaigns, storing persistent cookies for one to twelve months and processing data on US infrastructure. A DPIA should assess the scale of behavioural targeting, the linkage of tracking with identifiable form submissions, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, affirmative opt in, data minimisation, and shortened retention.
Sample consent text
We use OptinMonster to decide when to show you relevant offers and sign up forms based on how you browse our site. OptinMonster places cookies on your device to remember which campaigns you have already seen and whether you responded. These cookies load only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
a.optnmnstr.comapi.optinmonster.comsdk.streamline.optinmonster.comsdk.optinmonster.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| omSeen-{campaign} | marketing | 1 to 12 months | Records that a specific OptinMonster campaign has been shown to the visitor so it can be displayed at the configured frequency rather than on every page view. |
| om-success-{campaign} | marketing | 1 to 12 months | Records that the visitor has successfully converted on a campaign, for example by submitting the form, so that the campaign is not shown to them again. |
| omViewsSince-{campaign} | marketing | 1 to 12 months | Counts how many pages the visitor has viewed since a campaign was last shown, used to control page view based display rules. |
| omSessionStart | marketing | Session | Marks the start of the current browsing session so that session based campaign triggers and timing rules can be evaluated. |
| omAuthThrottle | marketing | Session | Technical cookie used to throttle and validate campaign requests sent to the OptinMonster service. |
OptinMonster collects user analytics data — you legally need a consent banner. Try FlowConsent free.
OptinMonster sets first party cookies such as om-success-, omSeen-, and omViewsSince- entries that record which campaigns a visitor has seen, whether they converted, and how many pages they have viewed, typically for one to twelve months, plus a session cookie called omSessionStart and a technical omAuthThrottle cookie.
Yes. The campaign cookies are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the campaign script loads. Where a pop up captures an email address, the sign up must also be a clear, affirmative opt in.
The storage and reading of cookies relies on consent under the ePrivacy Directive, and the behavioural targeting and form data processing rely on consent under Article 6(1)(a) of the GDPR. Legitimate interest is generally not available because consent is already required to place the cookies.
Yes. OptinMonster processes data on infrastructure in the United States. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice and cookie policy.
A full DPIA is not always mandatory, but it is recommended because OptinMonster tracks visitor behaviour to target campaigns and can link this to identifiable email sign ups while transferring data internationally. Document the purposes, data categories, retention, and safeguards, and reassess if you enable advanced behavioural targeting.
Load the campaign script only after the visitor accepts the marketing category in your consent management platform, and keep the cookies blocked until then. Use affirmative opt in on pop up forms, sign the data processing agreement, set sensible retention, and document the cookies in your cookie policy.
EU based pop up and lead generation tools such as Wisepops or Sleeknote keep data in the European Union, and some form plugins can run with reduced tracking. The right choice depends on whether you need OptinMonster specific targeting features or prefer to avoid an international transfer to the United States.
List each OptinMonster cookie, its purpose, and its duration, name OptinMonster as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed campaign cookies are reflected accurately.