Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Varos is a benchmarking analytics platform that lets ecommerce and marketing teams compare their performance, such as ad spend, cost per acquisition and conversion rates, against anonymised peer benchmarks. It connects to advertising and analytics accounts through APIs rather than a website tag, so it does not set cookies on your visitors. The compliance focus is on the marketing data it ingests and the anonymised data it shares, processed in the United States.
Varos is a competitive benchmarking platform for ecommerce brands, agencies and marketers. It aggregates performance data from many companies and shows each one how its metrics compare with anonymised industry and peer benchmarks. Rather than tracking website visitors, it connects to platforms such as Meta Ads, Google Ads and analytics tools through authorised API access.
Varos does not place a tag on your website and does not set cookies in your visitors browsers. Instead it ingests marketing and analytics metrics from the accounts you connect, which can include campaign, spend and conversion data and, in some cases, limited personal data from those platforms. It then contributes anonymised, aggregated figures to its benchmark pool.
Because Varos does not store or read information on your visitors devices, the cookie consent rule in Article 5(3) of the ePrivacy Directive does not apply to it. The GDPR still applies to any personal data within the marketing metrics you share, so you need a lawful basis and must ensure the data is properly anonymised before it enters the benchmark pool.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Varos does not require visitor cookie consent because it sets no cookies on your site. You do need an appropriate legal basis, typically legitimate interest, for sharing the account data, and you should confirm that personal data is minimised or anonymised. Inform people in your privacy notice that you use benchmarking tools.
Varos is a United States based service, so the marketing data you connect is processed in the United States. Transfers of any personal data must rely on Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment. Prefer connecting only aggregated or anonymised metrics where possible.
Confirm that the data you connect to Varos is anonymised or contains only the minimum personal data necessary, and record your legal basis. Sign a data processing agreement, document the US transfer safeguards, and mention benchmarking tools in your privacy notice. Because there are no visitor cookies, no cookie banner entry is required.
Websites using Varos must obtain user consent under GDPR regulations.
DPIA considerations
Varos does not place a tag on your website and does not set cookies in your visitors browsers. Key DPIA considerations: (1) the absence of cookies means the rule in Article 5(3) ePrivacy does not apply; (2) the marketing metrics ingested can contain limited personal data; (3) data is processed in the United States, requiring transfer safeguards; (4) minimisation or anonymisation before sharing is essential. A full DPIA is generally not required where the data is aggregated and anonymised.
Sample consent text
We use Varos, a benchmarking tool, to compare our marketing performance against anonymised benchmarks. Varos connects to our advertising accounts through APIs and does not set cookies on your device; data is processed in the United States. You can find more details in our privacy notice.
Third-party domains contacted
varos.comapp.varos.comVaros collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Varos does not set cookies on your website. It connects to your advertising and analytics accounts through APIs rather than placing a tag in visitors browsers, so there is nothing to put in a cookie banner. The data it handles comes from the accounts you authorise.
Visitor cookie consent is not required, because Varos sets no cookies on your site. You still need a lawful basis for sharing account data, usually legitimate interest, and you should ensure personal data is minimised. Consent under ePrivacy is about cookies, which do not apply here.
For sharing marketing metrics with Varos, the usual basis is legitimate interest under Article 6(1)(f) GDPR, supported by a balancing test, provided the data is anonymised or minimised. There is no ePrivacy cookie basis to consider, because no information is stored on visitors devices.
Yes. Varos processes data on servers in the United States, so any personal data within the metrics you connect is transferred there. The transfer must rely on Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment, and you should prefer anonymised data.
A DPIA is usually not required because Varos works with aggregated, largely anonymised marketing metrics rather than tracking individuals. If the connected data contains personal data at scale, carry out a short assessment of the sharing and the US transfer to demonstrate accountability.
Connect only the accounts and metrics you need, ensure personal data is minimised or anonymised before it is shared, and sign a data processing agreement with Varos. Document your legal basis and the US transfer safeguards, and note the use of benchmarking tools in your privacy notice. No cookie banner change is needed.
Other benchmarking and marketing analytics tools include Triple Whale, Polar Analytics and Northbeam, some of which also track on site behaviour and therefore set cookies. If you specifically want a benchmarking tool that avoids visitor cookies, an API based service like Varos keeps the website footprint minimal.
You do not need a cookie policy entry because Varos sets no cookies, but you should mention in your privacy notice that you use third party benchmarking tools, describe the categories of data shared, and state that data is processed in the United States. Keep this aligned with the integrations you enable.