Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
GetYourGuide is a Berlin based online marketplace for tours, activities and attraction tickets. Its embeddable booking widgets and affiliate links set cookies for session handling, conversion attribution and analytics, and load third party scripts. Under the GDPR and the ePrivacy Directive, prior consent is required before these non essential cookies and trackers are activated.
GetYourGuide is an online travel marketplace founded in 2009 and headquartered in Berlin. It connects travellers with tours, activities, excursions and skip the line attraction tickets worldwide. Many websites integrate GetYourGuide through embeddable booking widgets or affiliate links so visitors can search and book experiences without leaving the page, while the publisher earns a commission.
When the booking widget or affiliate script loads, GetYourGuide sets cookies and reads device information such as IP address, browser type, language and screen size. It uses persistent identifiers to attribute bookings to the referring website, remember search context and support remarketing. Depending on the configuration it also loads partner tags for analytics and advertising.
The identifiers stored and read by the widget qualify as personal data under the GDPR, and storing them on the user device is governed by Article 5(3) of the ePrivacy Directive. Because these cookies are used for attribution, analytics and advertising rather than strict necessity, they require freely given, specific, informed and unambiguous consent before they are set.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must block the GetYourGuide widget and its partner scripts until the visitor has accepted the relevant cookie categories in a Consent Management Platform. The booking iframe should load only after consent, and consent records must be logged so you can demonstrate compliance. Visitors must be able to refuse as easily as they accept and to withdraw consent later.
GetYourGuide and its advertising partners may process personal data outside the European Economic Area, including in the United States. These transfers must be covered by an appropriate safeguard such as Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment that considers access by foreign authorities.
List every GetYourGuide cookie and partner domain in your cookie policy, classify them correctly and gate them behind consent. Use a CMP that defers the widget until opt in, document your legal basis and data transfer safeguards, and review the integration periodically as GetYourGuide updates its tags. Provide a clear way for users to manage and revoke their choices.
Websites using GetYourGuide must obtain user consent under GDPR regulations.
DPIA considerations
GetYourGuide widgets process IP addresses, device and browser data, booking details and persistent identifiers used for affiliate attribution and remarketing. Key DPIA considerations: (1) third party scripts from analytics and advertising partners can read or set identifiers used for cross site tracking; (2) attribution cookies enable profiling of booking intent over time; (3) data may be transferred to the United States, requiring a Transfer Impact Assessment; (4) embedding the widget loads content before consent unless deferred. A DPIA is advisable when the widget is used at scale or combined with your own marketing tags.
Sample consent text
We use GetYourGuide to let you browse and book tours and activities directly on our site. The GetYourGuide widget sets cookies and may share data with analytics and advertising partners, including transfers to the United States, to measure bookings and personalise offers. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
getyourguide.comwidget.getyourguide.comcdn.getyourguide.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gyg_visitor_id | Attribution / Analytics | 1 year | Assigns a unique visitor identifier used to attribute bookings to the referring website and to recognise returning visitors. |
| __gyg_csrf | Functional | Session | Security token that protects the booking widget against cross site request forgery during a session. |
| _ga | Analytics | 2 years | Set by an integrated Google Analytics tag to measure traffic and interactions with the booking widget. |
| _fbp | Advertising | 3 months | Set by an integrated Meta pixel to support conversion measurement and remarketing for booking campaigns. |
GetYourGuide uses cookies for user preferences — inform visitors with a consent banner.
The widget sets cookies for session handling, search context, conversion attribution and, depending on setup, analytics and advertising. These are persistent identifiers that let GetYourGuide and the referring site link a booking to a visit. Because they are not strictly necessary, they require consent.
Yes. The booking widget and affiliate scripts set non essential cookies and may share data with advertising partners, so under the GDPR and the ePrivacy Directive you must obtain prior consent. The widget should not load until the visitor has accepted the relevant categories.
For the analytics and advertising functions the appropriate legal basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) of the ePrivacy Directive for storing cookies. Legitimate interest is not sufficient for tracking that supports advertising and cross site attribution.
It can. GetYourGuide works with analytics and advertising partners that operate globally, so personal data may be transferred to the United States. Such transfers must rely on Standard Contractual Clauses or the EU US Data Privacy Framework, backed by a Transfer Impact Assessment.
A full DPIA is not always mandatory, but it is recommended when the widget is deployed at scale or combined with your own marketing tags. The combination of persistent identifiers, attribution and possible international transfers raises the risk profile enough to justify documenting the processing.
Load the widget through a Consent Management Platform that blocks it until the visitor opts in, disclose all cookies and partner domains in your cookie policy, and keep consent logs. Configure the integration to avoid loading partner tags before consent and review it after GetYourGuide updates.
Other activity booking and affiliate platforms include Viator, Tiqets, Civitatis and Klook, and each carries similar cookie and transfer considerations. There is no fully cookieless equivalent for live booking widgets, so the compliance focus should be on consent gating rather than switching provider.
Add an entry describing the GetYourGuide cookies, their purpose and duration, name the third party domains involved and state that data may be transferred outside the EEA. Keep the list in sync with the widget current behaviour and link to GetYourGuide own privacy information.