> How Evolok manages identity, entitlements, and paywall personalisation, the cookies it sets, data transfers, and the consent steps for GDPR compliance. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/evolok E-commerce # Evolok Marketing · [Official website](https://www.evolok.com) Evolok is a registration, paywall, subscription, and access-management platform for publishers. It manages user identity and entitlements and uses behavioural data to drive dynamic paywalls and personalisation. Login and entitlement cookies are essential, while analytics and personalisation features require consent. [Block Evolok until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers United Kingdom and United States Overview ## What does Evolok do? ## **What Evolok is** Evolok is an access-management platform that publishers use for registration, paywalls, subscriptions, and entitlement control. It manages user identity and determines what content each visitor is allowed to access based on their account and subscription. It also applies behavioural data to power dynamic paywalls and personalised experiences. ## **Data and cookies** Evolok sets identity and session cookies that keep a user logged in, along with entitlement cookies that record which subscriptions and content rights apply. These functional cookies are necessary to deliver the service the user has requested. Separately, Evolok can set analytics and personalisation cookies that track reading behaviour to tune paywalls and recommendations, and these process personal data beyond what is strictly necessary. ## **GDPR and ePrivacy** The login and entitlement cookies are essential to provide the account and subscription service, so they rely on the contract legal basis under Article 6(1)(b) of the GDPR and are exempt from consent under ePrivacy Art. 5(3). The behavioural analytics and personalisation cookies are not strictly necessary, so they require consent under Article 6(1)(a) and ePrivacy Art. 5(3). It is important to separate these categories clearly in your consent design. ## **Consent** Essential identity and entitlement cookies may be set without consent because they are needed to keep the user logged in and to honour their subscription. However, the analytics and personalisation cookies must only fire after the visitor has consented to them. Your consent banner should let users accept the optional categories independently and withdraw that consent at any time. ## **Data transfers** Identity and behavioural data may be processed in the United Kingdom and the United States, so deploying Evolok can involve transfers of personal data to third countries. These transfers rely on UK or EU adequacy decisions where available, or on Standard Contractual Clauses where they are not. Controllers should confirm the applicable mechanism with Evolok and record it in their documentation. ## **Practical steps** Map Evolok cookies into clear categories so essential identity and entitlement cookies are distinguished from optional analytics and personalisation. Gate the optional cookies behind consent and confirm that logging in still works when a user declines them. Put a data processing agreement in place with Evolok, document the international transfers, and reflect both essential and optional processing in your privacy and cookie policies. Compliance ## Evolok and the GDPR Evolok is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract for account and subscription management (GDPR Art. 6(1)(b)); consent for analytics and personalisation cookies (Art. 6(1)(a), ePrivacy Art. 5(3)) - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) Evolok carries medium risk because it combines essential identity and entitlement processing with behavioural analytics and personalisation, so a DPIA is advisable where profiling is significant. The assessment should address (1) the distinction between essential login and entitlement cookies relying on the contract basis and optional analytics and personalisation cookies relying on consent; (2) the scale and intrusiveness of behavioural tracking used to drive dynamic paywalls; (3) transfers of identity and behavioural data to the United Kingdom and the United States and the applicable adequacy decisions or Standard Contractual Clauses; (4) the validity and granularity of consent for the optional cookies and the ability to withdraw it; and (5) retention limits, data minimisation, and a data processing agreement with Evolok. ### Sample text for your banner > We use essential cookies to keep you signed in and manage your subscription. We also use optional analytics and personalisation cookies to improve our paywall and recommendations. Click Accept to allow the optional cookies or Reject to keep only the essential ones. Cookies and trackers ## What Evolok sets and contacts - Tracking method Identity and entitlement cookies plus behavioural analytics for paywall personalisation - Server location United Kingdom and United States - Data transferred outside the EU Identity and behavioural data may be processed in the United Kingdom and the United States; transfers rely on UK or EU adequacy decisions or Standard Contractual Clauses. ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------------------- | --------------- | ------------ | ----------------------------------------------------------------------------------------------------------------- | | evolok\_session | Functional | Session | Maintains the authenticated user identity and session so the visitor stays logged in across pages. | | evolok\_entitlement | Functional | Up to 1 year | Records which subscriptions and content access rights apply to the user to enforce the paywall. | | evolok\_analytics | Analytics | Up to 1 year | Tracks reading behaviour and engagement to inform dynamic paywall rules and reporting; requires consent. | | evolok\_personalisation | Personalisation | Up to 1 year | Stores preferences and behavioural signals to personalise content, offers, and recommendations; requires consent. | ### Third-party domains contacted (3) - `evolok.com` - `evolok.net` - `api.evolok.com` Questions ## Frequently asked questions about Evolok Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Evolok set? Evolok sets an identity or session cookie that keeps the user logged in and an entitlement cookie that records which subscriptions and content rights apply, both of which are functional and essential. It can also set an analytics cookie that tracks reading behaviour and a personalisation cookie that tailors paywalls and recommendations. The analytics and personalisation cookies are not strictly necessary and require consent. ### Is consent required for Evolok? Consent is required for the analytics and personalisation cookies, which are not strictly necessary and must only fire after the visitor accepts them. The identity and entitlement cookies are essential to deliver the account and subscription service, so they can be set without consent. A clear separation between these categories is essential to a compliant setup. ### What is the legal basis for Evolok? The login and entitlement processing relies on the contract legal basis under GDPR Art. 6(1)(b) because it is needed to provide the account and subscription. The behavioural analytics and personalisation cookies rely on consent under Art. 6(1)(a) and ePrivacy Art. 5(3). Applying the correct basis to each category is key to lawful use. ### Does Evolok transfer data to the United States? Yes, identity and behavioural data may be processed in the United Kingdom and the United States, so deploying Evolok can involve transfers to third countries. These transfers rely on UK or EU adequacy decisions where available, or on Standard Contractual Clauses where they are not. Confirm the applicable mechanism with Evolok and record it in your documentation. ### Do I need a DPIA for Evolok? A DPIA is advisable where the behavioural profiling that drives dynamic paywalls is significant, given the medium risk profile. The assessment should weigh the separation of essential and optional cookies, the scale of behavioural tracking, the international transfers, and the validity of consent. It should also confirm retention limits, data minimisation, and a data processing agreement with Evolok. ### How do I implement Evolok compliantly? Map Evolok cookies into clear categories, keeping essential identity and entitlement cookies separate from optional analytics and personalisation. Gate the optional cookies behind a consent banner and verify that logging in still works when a user declines them. Sign a data processing agreement with Evolok, document the international transfers, and reflect both processing types in your privacy and cookie policies. ### What are the alternatives to Evolok? Alternatives include other paywall and subscription platforms such as Piano, Poool, Zephr, or Pelcro, which raise similar questions about essential versus optional processing and consent. Some publishers build identity and entitlement management in house and pair it with a separate consent and analytics stack. The right choice depends on your personalisation needs, scale, and data governance preferences. ### How should I update my cookie policy for Evolok? List the essential identity, session, and entitlement cookies and explain that they keep users signed in and manage subscriptions on the contract basis. Separately list the analytics and personalisation cookies as optional cookies requiring consent, with their purposes and durations. Disclose the processing in the United Kingdom and the United States and the transfer safeguards, and keep the policy aligned with your consent banner categories. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Dandomain](https://www.flowconsent.com/en/services/ecommerce/dandomain) [DanDomain is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. DanDomain integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, DanDomain helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/dandomain) [Preferences](https://www.flowconsent.com/en/services/ecommerce/dandomain) · ### [Ecwid](https://www.flowconsent.com/en/services/ecommerce/ecwid) [Ecwid is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Ecwid integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Ecwid helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/ecwid) [Preferences](https://www.flowconsent.com/en/services/ecommerce/ecwid) · ### [Fitssey](https://www.flowconsent.com/en/services/ecommerce/fitssey) [Fitssey is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Fitssey supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Fitssey ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/fitssey) [Preferences](https://www.flowconsent.com/en/services/ecommerce/fitssey) · ### [Medusa](https://www.flowconsent.com/en/services/ecommerce/medusajs) [Medusajs is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Medusajs integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Medusajs helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/medusajs) [Preferences](https://www.flowconsent.com/en/services/ecommerce/medusajs) · ### [Yampi Virtual store](https://www.flowconsent.com/en/services/ecommerce/yampi-virtual-store) [Yampi Virtual store offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Yampi Virtual store integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for.](https://www.flowconsent.com/en/services/ecommerce/yampi-virtual-store) [Preferences](https://www.flowconsent.com/en/services/ecommerce/yampi-virtual-store) · ### [Zapiet](https://www.flowconsent.com/en/services/ecommerce/zapiet) [Zapiet is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Zapiet supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Zapiet ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/zapiet) [Preferences](https://www.flowconsent.com/en/services/ecommerce/zapiet) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)