Evolok

Evolok sets an identity or session cookie that keeps the user logged in and an entitlement cookie that records which subscriptions and content rights apply, both of which are functional and essential. It can also set an analytics cookie that tracks reading behaviour and a personalisation cookie that tailors paywalls and recommendations. The analytics and personalisation cookies are not strictly necessary and require consent.

Consent is required for the analytics and personalisation cookies, which are not strictly necessary and must only fire after the visitor accepts them. The identity and entitlement cookies are essential to deliver the account and subscription service, so they can be set without consent. A clear separation between these categories is essential to a compliant setup.

The login and entitlement processing relies on the contract legal basis under GDPR Art. 6(1)(b) because it is needed to provide the account and subscription. The behavioural analytics and personalisation cookies rely on consent under Art. 6(1)(a) and ePrivacy Art. 5(3). Applying the correct basis to each category is key to lawful use.

Yes, identity and behavioural data may be processed in the United Kingdom and the United States, so deploying Evolok can involve transfers to third countries. These transfers rely on UK or EU adequacy decisions where available, or on Standard Contractual Clauses where they are not. Confirm the applicable mechanism with Evolok and record it in your documentation.

A DPIA is advisable where the behavioural profiling that drives dynamic paywalls is significant, given the medium risk profile. The assessment should weigh the separation of essential and optional cookies, the scale of behavioural tracking, the international transfers, and the validity of consent. It should also confirm retention limits, data minimisation, and a data processing agreement with Evolok.

Map Evolok cookies into clear categories, keeping essential identity and entitlement cookies separate from optional analytics and personalisation. Gate the optional cookies behind a consent banner and verify that logging in still works when a user declines them. Sign a data processing agreement with Evolok, document the international transfers, and reflect both processing types in your privacy and cookie policies.

Alternatives include other paywall and subscription platforms such as Piano, Poool, Zephr, or Pelcro, which raise similar questions about essential versus optional processing and consent. Some publishers build identity and entitlement management in house and pair it with a separate consent and analytics stack. The right choice depends on your personalisation needs, scale, and data governance preferences.

List the essential identity, session, and entitlement cookies and explain that they keep users signed in and manage subscriptions on the contract basis. Separately list the analytics and personalisation cookies as optional cookies requiring consent, with their purposes and durations. Disclose the processing in the United Kingdom and the United States and the transfer safeguards, and keep the policy aligned with your consent banner categories.