Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Okendo is a customer reviews, ratings, user generated content and loyalty platform built primarily for Shopify stores. It loads a third party JavaScript widget that displays reviews and may collect data such as IP address, device and browser information, and behavioural signals about how visitors interact with content. Okendo sets browser cookies and may use local storage to recognise visitors and link review and loyalty activity. Because these technologies are not strictly necessary, the ePrivacy Directive and GDPR require prior consent before they load. Okendo is operated from the United States and uses sub processors including Shopify in Canada and Google and Twilio in the United States, so personal data is transferred outside the EEA and the UK under Standard Contractual Clauses. Merchants act as data controllers and should obtain consent and sign the Okendo data processing addendum.
Okendo is a customer reviews, ratings, user generated content and loyalty platform built primarily for Shopify stores. It helps brands collect reviews, display social proof and run loyalty, quizzes and referral programmes through embedded widgets on the storefront.
Okendo provides review collection, ratings display, photo and video reviews, loyalty, quizzes, surveys and referrals for e-commerce brands. It integrates closely with Shopify and loads its features through a JavaScript widget served from Okendo infrastructure.
When the widget loads it can collect IP address, browser and device information, and behavioural signals about how a visitor interacts with reviews and loyalty features. Okendo sets browser cookies and may use local storage to remember visitors and link activity. Customers who submit reviews provide their name, email and review content.
Because the cookies and storage used by Okendo are not strictly necessary, the ePrivacy Directive requires prior consent before they are placed. Under GDPR the store acts as data controller and must have a lawful basis, provide transparency and honour data subject rights. Consent is the most appropriate basis given the marketing, loyalty and profiling context.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Valid consent must be obtained before the widget loads, and it should be blocked until the visitor agrees. Okendo operates from the United States and uses sub processors in the United States and Canada, so personal data leaves the EEA and the UK. These transfers rely on Standard Contractual Clauses under the Okendo data processing addendum and should be referenced in your privacy notice.
Categorise Okendo as a marketing service in your consent manager and prevent it from loading until consent is given. Sign the Okendo data processing addendum, document the sub processors and transfer safeguards, list the cookies in your cookie policy and set sensible retention periods. Test that declining consent keeps the widget fully disabled.
Websites using Okendo must obtain user consent under GDPR regulations.
DPIA considerations
A full data protection impact assessment is not usually mandatory for a standard reviews widget, but a documented assessment is recommended because Okendo processes personal data, uses several sub processors and transfers data to the United States. Consider the behavioural signals captured, the combination of reviews with loyalty profiling, and the chain of sub processors. Document the legal basis, retention periods and the transfer safeguards. Where loyalty programmes profile customers or marketing is layered on top, the risk increases and a DPIA becomes advisable.
Sample consent text
We use Okendo to show customer reviews and run loyalty features. This sets cookies and may share data with Okendo and its providers in the United States and Canada. Please accept to enable reviews and loyalty, or decline to keep them disabled.
Third-party domains contacted
okendo.iocdn-static.okendo.ioapi.okendo.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| okendo_session | third party | Session | Maintains a visitor session for the reviews and loyalty widget while browsing. |
| okendo_id | third party | Up to 1 year | Recognises returning visitors and links review and loyalty activity to a stable identifier. |
| okendo_local_storage | JS first party | Persistent until cleared | Local storage used to cache widget state and preferences in the browser. |
Okendo uses cookies for user preferences — inform visitors with a consent banner.
Okendo typically sets first party and third party cookies and may use local storage to recognise visitors, link review and loyalty activity and remember preferences. Exact names vary by configuration and version, so audit your storefront with browser tools to confirm what is placed. None of these are strictly necessary for the store to function.
Yes. Because the cookies and storage are not strictly necessary and support marketing, loyalty and profiling, the ePrivacy Directive and GDPR require prior consent in the EEA and the UK. The Okendo widget should be blocked until the visitor accepts, and declining must keep it fully disabled.
Consent is the appropriate legal basis for the cookies and tracking, given the marketing and loyalty context. For storing submitted reviews you may also rely on consent or, in narrow cases, legitimate interest, but the non-essential storage on the visitor device still requires consent first.
Yes. Okendo is operated from the United States and uses sub processors including Shopify in Canada and Google and Twilio in the United States, so personal data is transferred outside the EEA and the UK. These transfers rely on Standard Contractual Clauses under the Okendo data processing addendum, which you should reference in your privacy notice.
A DPIA is not always mandatory for a basic reviews widget, but a documented assessment is recommended because Okendo processes personal data, uses several sub processors and sends data to a third country. If you combine reviews with loyalty profiling or wider marketing, a DPIA becomes advisable.
Place Okendo behind your consent manager so it loads only after consent, classify it as marketing, sign the Okendo data processing addendum, document the sub processors and transfer safeguards and list its cookies in your cookie policy. Then test that declining keeps the widget disabled.
Alternatives include other reviews and UGC platforms such as Stamped, Yotpo, Junip, Feefo and PowerReviews. Most behave similarly and load third party scripts that set cookies, so the same consent and transfer considerations apply regardless of provider.
List Okendo under marketing or functional cookies in your cookie policy, describe its purpose, name the provider and country, indicate the cookies and their durations, and link to the Okendo privacy policy. Keep the entry in sync with what your consent manager actually blocks and allows.