Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Judge.me is a popular Shopify product reviews app. It loads review widgets on storefront pages, can set cookies and read identifiers, and collects reviewer data such as names, emails and review content while sending review request emails. As a provider operating from outside the EEA, it raises GDPR, ePrivacy and data transfer obligations.
Judge.me is a widely used product reviews application for Shopify and other e-commerce platforms. It displays star ratings, review widgets and photo reviews on storefront pages, invites customers to leave reviews by email, and stores the collected reviews. The widgets run third party JavaScript and communicate with Judge.me cloud services.
Judge.me processes reviewer names, email addresses, order references, review text, ratings and uploaded media, and it sends review request emails after purchase. The widgets may set first party or third party cookies for session handling and measurement and can read device or browser identifiers. The exact cookies depend on the widget settings you enable.
Reviewer details and review content are personal data under the GDPR, and Judge.me typically acts as your processor under a data processing agreement. Under ePrivacy, any non essential cookie or identifier the widget sets requires prior consent, and review invitation emails must rest on a valid basis. Only strictly necessary display functions are exempt from consent.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Non essential cookies and any tracking need freely given, specific and informed opt in consent before they load. Review invitation emails generally require consent or a carefully assessed legitimate interest, and you must inform reviewers and give a basis for publishing their name and content. Showing existing aggregated ratings can often run as strictly necessary.
Judge.me operates from outside the EEA and uses US and global cloud infrastructure, so personal data of EU shoppers and reviewers is transferred to a third country. This transfer must be covered by Standard Contractual Clauses, by the EU US Data Privacy Framework where the provider is certified, and by a transfer impact assessment with any supplementary measures that are needed.
Sign a data processing agreement, confirm the transfer mechanism, gate non essential cookies behind your consent platform, set a lawful basis and clear notice for review emails, define retention for reviews and personal data, and list Judge.me and its US transfers in your privacy and cookie notices. Re test after any settings change.
Websites using Judge.me must obtain user consent under GDPR regulations.
DPIA considerations
Judge.me collects reviewer identity, emails and order linkage and transfers data outside the EEA, which raises the risk profile. Assess transfer safeguards, review invitation emailing, retention of reviews and any tracking, and screen for a DPIA where processing is large scale or combined with profiling.
Sample consent text
We use the Judge.me reviews app, which may set cookies, read identifiers and process your details to show reviews and send review requests. Non essential cookies load only after you accept, and data may be processed outside the EEA under appropriate safeguards.
Third-party domains contacted
judge.mecdn.judge.mecache.judge.meCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| judgeme_session | Strictly necessary | Session | Maintains the widget session so reviews and the submission form work during a visit |
| judgeme_widget | Functional | 12 months | Remembers widget display state and reviewer interaction across storefront pages |
| _jm_token | Functional | 6 months | Links a review submission to the correct verified buyer and prevents duplicates |
| _jm_analytics | Analytics | Up to 13 months | Measures widget impressions and engagement, loaded only after consent |
Judge.me uses cookies for user preferences — inform visitors with a consent banner.
Judge.me widgets can set first party or third party cookies for session handling and measurement and may read device or browser identifiers. The exact set depends on the widget settings you enable, so audit your live storefront and classify each cookie as strictly necessary or non essential.
Yes for non essential cookies and tracking, which need prior opt in consent under ePrivacy. Review invitation emails need consent or a carefully assessed legitimate interest, and publishing reviewer names needs a valid basis. Showing aggregated ratings can often run as strictly necessary.
Displaying reviews can rely on legitimate interest, while non essential cookies and the review request emails typically rely on consent. Publishing reviewer identity needs a clear basis and notice. Record the basis for each purpose in your records of processing.
Yes. Judge.me operates from outside the EEA on US and global cloud infrastructure, so EU personal data is transferred to a third country. Cover the transfer with Standard Contractual Clauses, the EU US Data Privacy Framework where the provider is certified, and a transfer impact assessment.
Because it transfers data outside the EEA and processes reviewer identity and emails, a screening assessment is advisable. A full DPIA is more likely if you process at large scale, combine it with profiling, or handle sensitive review content. Document your decision.
Sign a data processing agreement, confirm the transfer mechanism, gate non essential cookies behind your consent platform, set a lawful basis and clear notice for review emails, define retention, and disclose Judge.me and its US transfers in your notices.
Alternatives include EEA based review providers, a self hosted review system that keeps data in your own database, or other Shopify review apps. EEA based or self hosted options reduce third country transfer obligations, but each changes the cookie and consent profile.
List the Judge.me cookies with names, purposes, durations and first or third party status, name Judge.me as a processor, disclose the US transfer and its safeguards, state the legal basis, and explain how users exercise rights and withdraw consent.