Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Reviews.io is an ecommerce reviews and ratings platform that collects verified company and product reviews and displays them on your store through embeddable widgets.
Reviews.io is a UK based customer reviews and ratings platform used by ecommerce stores to collect verified company and product reviews. After a purchase, the merchant shares order and customer details so that Reviews.io can send automated review invitation emails, then gathers the responses and displays them through embeddable widgets. It is also a Google Licensed Review Partner, which means star ratings can flow into Google Search, Google Ads and Google Shopping.
To request and publish reviews, Reviews.io processes reviewer names, email addresses, order identifiers and purchase information, plus any photos or text a customer submits. When the widget loads on your storefront it executes JavaScript from the Reviews.io content delivery network and may set functional and session cookies that remember widget state and protect against abuse. Personal review data is typically retained for a limited period before deletion, in line with the platform retention policy.
Reviews.io acts as your data processor for the order data you send, while becoming a controller for published review content. Under the ePrivacy Directive, any non essential cookies the widget sets require prior consent, and under the GDPR you need a lawful basis for sending invitation emails and a signed data processing agreement. Publishing user generated content also raises fairness and transparency duties toward the reviewers themselves.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the widget loads third party scripts and can set cookies, deploy it behind your consent banner so it only fires after the visitor accepts the relevant category. For review invitations, rely on consent or a clearly documented legitimate interest with an easy opt out. Keep an audit trail of how and when consent was captured so you can demonstrate compliance to a regulator.
Although the core service is hosted in the United Kingdom, syndicating ratings to Google means review data can be transferred to servers in the United States. Some sub processors and content delivery nodes may also sit outside the EEA. These transfers should be covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Sign the Reviews.io data processing agreement, list it in your record of processing, and gate the widget behind consent. Document the legal basis for invitation emails, set retention aligned with the supplier policy, and update your cookie and privacy notices to name Reviews.io and Google as recipients. Review the transfer mechanisms annually and confirm reviewers can exercise access and erasure rights.
Websites using REVIEWS.io must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable because Reviews.io processes customer contact and purchase data to solicit reviews and publishes user generated content. Assess the lawful basis for review invitation emails, the retention of reviewer data, and the onward syndication of ratings to Google in the United States.
Sample consent text
We use Reviews.io to collect and display customer reviews. With your consent, the Reviews.io widget may set cookies and load content from its servers. You can accept or decline in our cookie settings.
Third-party domains contacted
reviews.ioreviews.iowidget.reviews.iowidget.reviews.ioassets.reviews.ioassets.reviews.iogoogle.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| RICHSNIPPETS_SESSION | session | Session | Keeps the review widget state during a single browsing session. |
| ri_session | Functional | Session | Maintains the Reviews.io widget session state while a visitor browses and interacts with reviews. |
| rio_visitor | persistent | 1 year | Identifies a returning visitor so review prompts and widget behaviour stay consistent. |
| ri_visitor | Functional | 1 year | Recognises a returning visitor so the widget can avoid duplicate review prompts and remember interactions. |
| __cf_bm | Security | 30 minutes | Cloudflare bot management cookie that protects the review widget endpoints from automated abuse. |
| rio_attribution | third-party | 1 year | Links a visit to a later review or invitation for marketing and attribution purposes. |
| widget_prefs | persistent | 6 months | Stores widget display preferences such as language and layout. |
REVIEWS.io uses cookies for user preferences — inform visitors with a consent banner.
REVIEWS.io typically sets functional cookies that keep its review widgets working and marketing or attribution cookies that link a visit to a later review or invitation. The exact names and number depend on which widgets you enable, so confirm the list in your own deployment. Treat the marketing and attribution cookies as non essential.
Yes, consent is required before the marketing and widget cookies are set, because they are not strictly necessary under the ePrivacy rules. The review components should stay blocked until the visitor accepts the relevant cookie category. Aggregated star ratings that involve no visitor personal data may be shown more freely, but the widget itself should remain consent gated.
The main legal basis is consent under Article 6(1)(a) GDPR for the marketing and widget cookies. Legitimate interest may support purely aggregated display where no personal data of the visitor is processed. You should document the chosen basis and reflect it in your records of processing.
Processing is primarily based in the UK and EU, so this is not a US first service. Some static widget assets may be delivered through a global CDN that can use edge nodes outside the EU. Where any such transfer occurs, confirm that standard contractual clauses or an adequacy decision are in place.
A full DPIA is usually not mandatory for standard review collection, but a documented risk assessment is recommended. Pay particular attention when photo and video reviews, buyer invitation lists, or attribution cookies are used. Record the data volume, the cookie footprint, and your mitigations.
Load the widget only after consent for marketing cookies through your consent management platform, and block it by default. List the service and its cookies in your cookie policy and sign an appropriate data processing agreement. Make sure withdrawing consent stops the widget and clears its cookies.
Other customer review platforms exist, and some can be configured for lighter cookie use or stricter EU data residency. Whichever provider you pick, the same consent and transparency duties apply because review widgets generally involve third party cookies. Evaluate alternatives on data location, cookie footprint, and contractual terms.
Add REVIEWS.io as a named third party in your cookie and privacy notices, describe the functional and marketing cookies it sets, and state the purposes and retention. Reference its domains such as reviews.io and widget.reviews.io and link to its own policy. Review the entry whenever you change the widget configuration.