Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Stamped is a reviews, ratings, loyalty and user generated content platform widely used by e-commerce stores on Shopify and other platforms. It works by loading a third party JavaScript widget into the storefront that displays reviews and may collect data such as IP address, device and browser information, and behavioural signals. Stamped sets browser cookies and may use local storage to remember visitors and link review activity. Because these technologies are not strictly necessary, the ePrivacy Directive and GDPR require prior consent before they load. Stamped is operated from the United States, so personal data is transferred outside the EEA and the UK, relying on Standard Contractual Clauses. Store operators act as data controllers and should obtain consent and document the processing. Configuring the widget to load only after consent is the recommended compliant approach.
Stamped is a reviews, ratings, loyalty and user generated content platform used by many online stores, particularly on Shopify. It helps merchants collect customer reviews, display social proof and run loyalty programmes through embedded widgets on the storefront.
Stamped provides review collection, ratings display, photo and video reviews, and loyalty and rewards tools for e-commerce brands. It integrates with storefront platforms and loads its features through a JavaScript widget served from Stamped infrastructure.
When the widget loads it can collect IP address, browser and device information, and behavioural signals about how a visitor interacts with reviews. Stamped sets browser cookies and may use local storage to remember visitors, link review submissions and support loyalty accounts. Customers who submit reviews also provide their name, email and review content.
Because the cookies and storage used by Stamped are not strictly necessary, the ePrivacy Directive requires prior consent before they are placed. Under GDPR the store acts as data controller and must have a lawful basis, provide transparency and honour data subject rights. Consent is the most appropriate basis given the marketing and profiling context.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Valid consent must be obtained before the widget loads, and the widget should be blocked until the visitor agrees. Stamped operates from the United States, so personal data leaves the EEA and the UK. These transfers rely on Standard Contractual Clauses and supplementary measures, which should be referenced in your privacy notice and processing records.
Categorise Stamped as a marketing service in your consent manager and prevent it from loading until consent is given. Sign a data processing agreement with Stamped, document the transfer safeguards, list the cookies in your cookie policy and set sensible retention periods. Test that declining consent keeps the widget fully disabled.
Websites using Stamped must obtain user consent under GDPR regulations.
DPIA considerations
A full data protection impact assessment is not usually mandatory for a standard reviews widget, but a documented assessment is recommended because Stamped processes personal data and transfers it to the United States. Consider the volume of visitor data captured, the use of behavioural signals, and any combination with loyalty profiles. Where loyalty programmes profile customers or marketing is layered on top, the risk increases and a DPIA becomes advisable. Document the legal basis, retention periods and the transfer safeguards in your records of processing.
Sample consent text
We use Stamped to show customer reviews and run our loyalty programme. This sets cookies and may share data with Stamped in the United States. Please accept to enable reviews and loyalty features, or decline to keep them disabled.
Third-party domains contacted
stamped.iocdn-stamped-io.azureedge.netapi.stamped.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _stamped_session | third party | Session | Maintains a visitor session for the reviews and loyalty widget while browsing. |
| _stamped_id | third party | Up to 1 year | Recognises returning visitors and links review and loyalty activity to a stable identifier. |
| stamped_local_storage | JS first party | Persistent until cleared | Local storage used to cache widget state and preferences in the browser. |
Stamped uses cookies for user preferences — inform visitors with a consent banner.
Stamped typically sets first party and third party cookies and may use local storage to recognise visitors, link review and loyalty activity and remember preferences. The exact names can vary by configuration and version, so audit your own storefront with browser tools to confirm what is placed. None of these are strictly necessary for the store to function.
Yes. Because the cookies and storage are not strictly necessary and support marketing and profiling, the ePrivacy Directive and GDPR require prior consent in the EEA and the UK. The Stamped widget should be blocked until the visitor accepts, and declining must keep it fully disabled.
Consent is the appropriate legal basis for the cookies and tracking, given the marketing and loyalty context. For storing submitted reviews you may also rely on consent or, in narrow cases, legitimate interest, but the non-essential storage on the visitor device still requires consent first.
Yes. Stamped is operated from the United States, so personal data is transferred outside the EEA and the UK. These transfers rely on Standard Contractual Clauses and supplementary safeguards. Reference the transfer and its safeguards in your privacy notice and records of processing.
A DPIA is not always mandatory for a basic reviews widget, but a documented assessment is recommended because Stamped processes personal data and sends it to a third country. If you combine reviews with loyalty profiling or wider marketing, a DPIA becomes advisable.
Place Stamped behind your consent manager so it loads only after the visitor agrees, classify it as marketing, sign a data processing agreement, document the transfer safeguards and list its cookies in your cookie policy. Then test that declining keeps the widget disabled.
Alternatives include other reviews and UGC platforms such as Okendo, Feefo, PowerReviews, Yotpo and Trustpilot. Most behave similarly and load third party scripts that set cookies, so the same consent and transfer considerations apply regardless of the provider you choose.
List Stamped under marketing or functional cookies in your cookie policy, describe its purpose, name the provider and country, indicate the cookies and their durations, and link to the Stamped privacy policy. Keep the entry in sync with what your consent manager actually blocks and allows.