Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Lipscore is a Norwegian product and reviews ratings service embedded on e-commerce product pages. Its widget loads third party JavaScript to display star ratings and customer reviews, collect review submissions and measure performance. It can set cookies and read identifiers, which brings GDPR and ePrivacy obligations.
Lipscore is a Norwegian ratings and reviews platform used by online retailers. Its widget is embedded on product pages to show star ratings and customer reviews and to collect new reviews from verified buyers. The widget runs third party JavaScript served from Lipscore systems and exchanges data with Lipscore to render and store review content.
To attribute and moderate reviews, Lipscore processes reviewer identifiers, the review text and rating, and order or product references, and it may handle names or email addresses used to invite and verify reviewers. The widget can set first party or third party cookies for session handling, fraud prevention and performance measurement, and may read device or browser information.
Reviewer data, including names and any published identity, are personal data under the GDPR, and Lipscore generally acts as your processor. Norway is part of the EEA, so this processing stays within the European framework. Under ePrivacy, any non essential cookie or identifier set by the widget, such as analytics, requires prior consent, while strictly necessary display functions are exempt.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Showing existing ratings can often run as a strictly necessary part of the page, but analytics, performance measurement and any tracking cookies need freely given, specific and informed opt in consent. When collecting a review, also obtain clear consent or another valid basis for publishing the reviewer name and content, and inform reviewers how their submission will be used.
As a Norwegian provider operating within the EEA, Lipscore keeps core processing inside the European framework, so third country transfer risk is low. Still confirm where the content delivery network serving the widget is located, check whether any analytics sub processor routes data outside the EEA, and ensure Standard Contractual Clauses cover any such flow.
Sign a data processing agreement with Lipscore, gate non essential cookies behind your consent platform, give reviewers clear information and a basis for publication, set a retention period for reviews and personal data, and list Lipscore in your privacy and cookie notices. Re test the integration after changes so records stay accurate.
Websites using Lipscore must obtain user consent under GDPR regulations.
DPIA considerations
Review collection involves reviewer identity, order linkage and possibly published names, which is personal data. Assess fraud prevention tracking and any profiling, document retention of reviews and the controller or processor split, and screen for a DPIA if tracking is extensive.
Sample consent text
We use the Lipscore reviews widget, which may set cookies and read identifiers to show ratings, collect reviews and measure performance. Non essential cookies load only after you accept.
Third-party domains contacted
lipscore.comstatic.lipscore.comapi.lipscore.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| lipscore_session | Strictly necessary | Session | Maintains the widget session so ratings and the review form work during a visit |
| lipscore_fraud | Strictly necessary | 30 days | Helps detect duplicate or fraudulent review submissions to protect review integrity |
| lipscore_state | Functional | 6 months | Remembers widget display state and reviewer interaction across pages |
| lipscore_analytics | Analytics | Up to 13 months | Measures widget impressions and engagement, loaded only after consent |
Lipscore uses cookies for user preferences — inform visitors with a consent banner.
Lipscore can set first party or third party cookies for session handling, fraud prevention and performance measurement, and may read device or browser identifiers. The exact set depends on your configuration, so audit your live product pages and classify each cookie as strictly necessary or non essential.
Displaying existing ratings can often run as strictly necessary, but analytics and any tracking cookies are non essential and need prior opt in consent under ePrivacy. When you collect a review you also need a valid basis to publish the reviewer name and content.
Showing reviews and basic fraud prevention can rely on legitimate interest, while analytics cookies and the publication of reviewer identity typically rely on consent. Document the basis for each purpose in your records of processing.
Lipscore is Norwegian and Norway is in the EEA, so core processing stays within the European framework and US transfers are not a core feature. Confirm where the content delivery network and any analytics sub processor sit, and apply Standard Contractual Clauses for any non EEA flow.
Standard review display rarely needs a full DPIA. If you combine extensive tracking, large scale profiling or sensitive review content, run a screening assessment and document whether a full DPIA is required.
Sign a data processing agreement, gate non essential cookies behind your consent platform, give reviewers clear information and a basis for publication, set a retention period for reviews and personal data, and disclose Lipscore in your notices.
Alternatives include other review platforms, a self hosted review system that keeps data in your own database, or showing only aggregated ratings without third party tracking cookies. Each option changes the cookie and consent profile.
List the Lipscore cookies with their names, purposes, durations and first or third party status, name Lipscore as a processor, state the legal basis, and explain how reviewers and visitors exercise their rights and withdraw consent.