Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Yotpo Loyalty and Referrals, formerly Swell, runs loyalty programs and referral campaigns for ecommerce brands. A JavaScript widget and pixel set cookies such as yotpo_pixel to track members, points, and referral clicks. Data is processed by Yotpo in the United States and Israel. Because the tracking is used for marketing attribution, prior consent is required under the GDPR and the ePrivacy Directive.
Yotpo Loyalty and Referrals, formerly known as Swell, is a loyalty and referral platform for ecommerce brands. It lets merchants run points programs, reward tiers, and referral campaigns that turn customers into advocates. A JavaScript widget and a tracking pixel load on the storefront, display the loyalty experience, and record who joins, how many points they earn, and which referral links drive new visitors. The platform connects this activity back to customer accounts and orders so that rewards and attribution can be calculated.
The platform sets cookies including yotpo_pixel, which lasts about one year and tracks activity and referral attribution, along with _yotpo_loyalty and other Swell session cookies, a yotpoLoyaltyToken, and various _swell_ identifiers. Yotpo processes the customer identifier, email address, points balance, referral source, purchase and reward history, IP address, and browser and device information. Because referral tracking links a click to a later purchase, the data supports cross visit and cross device attribution.
The pixel and cookies are used for marketing and attribution rather than a strictly necessary function, so Article 5(3) of the ePrivacy Directive requires prior consent before they load. The identifiers and purchase history are personal data under the GDPR, and combining them to profile loyalty members and attribute referrals is a form of profiling, so a lawful basis, transparency, and a record of processing activities are required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the tracking falls into the marketing category, the Yotpo widget and pixel must load only after the visitor actively accepts marketing cookies in your consent management platform. Pre ticked boxes, implied consent from continued browsing, and cookie walls do not meet the GDPR standard. Consent must be freely given, specific, informed, granular, and as easy to withdraw as to give, and members should be able to use core account functions without being forced to accept tracking.
Yotpo processes data in the United States and has operations in Israel. Israel benefits from an EU adequacy decision, while transfers to the United States rely on the Data Privacy Framework and the Standard Contractual Clauses, so document both and sign the Yotpo Data Processing Agreement. In practice, gate the widget and pixel behind your consent management platform, list the Yotpo cookies and their durations in your cookie policy, name Yotpo as a recipient, and review retention so that loyalty and referral data is not kept longer than necessary.
Websites using Yotpo Loyalty & Referrals must obtain user consent under GDPR regulations.
DPIA considerations
Yotpo Loyalty and Referrals sets a tracking and attribution cookie (yotpo_pixel) lasting about one year, links loyalty members to email addresses, points balances, and purchase history, and processes data in the United States and Israel. A DPIA should assess the profiling of loyalty members, the cross visit referral attribution, the international transfers, and retention periods, together with mitigations such as consent gating, data minimisation, and shortened retention.
Sample consent text
We use Yotpo Loyalty and Referrals to run our rewards program and to credit referrals you share with friends. Yotpo places cookies and a pixel on your device to recognise your account, track your points, and attribute referral visits. These cookies load only after you accept the marketing category, and your data may be processed in the United States and Israel. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
cdn-loyalty.yotpo.comloyalty.yotpo.comapi.yotpo.comcdn-widgetv2.yotpo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| yotpo_pixel | marketing | 1 year | Main Yotpo tracking cookie. Records loyalty and referral activity and attributes referral clicks to later purchases for campaign measurement. |
| _yotpo_loyalty | marketing | Session | Identifies the loyalty member during the visit and maintains the loyalty widget state and points context for the current session. |
| yotpoLoyaltyToken | marketing | Persistent | Stores an authentication token that links the visitor to their loyalty account so points and rewards can be retrieved and updated. |
| _swell_session | marketing | Session | Legacy Swell session identifier used by the loyalty platform to maintain the member session and connect activity to the account. |
| _swell_uid | marketing | Persistent | Persistent Swell visitor identifier used to recognise the member across visits for points tracking and referral attribution. |
Yotpo Loyalty & Referrals uses cookies for user preferences — inform visitors with a consent banner.
Yotpo sets cookies including yotpo_pixel, which lasts about one year and tracks activity and referral attribution, along with _yotpo_loyalty and other Swell session cookies, a yotpoLoyaltyToken, and various _swell_ identifiers. Together they recognise loyalty members, store points state, and attribute referral clicks to later purchases.
Yes. The pixel and cookies are used for marketing and attribution rather than a strictly necessary function, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before they load. Loading the Yotpo pixel before consent is a common cause of supervisory authority complaints.
The storage and reading of the cookies relies on consent under the ePrivacy Directive, and the subsequent processing of personal data relies on consent under Article 6(1)(a) of the GDPR. Because consent is already required to place the marketing cookies, legitimate interest is generally not available for this tracking.
Yes. Yotpo processes data in the United States and has operations in Israel. Israel benefits from an EU adequacy decision, while transfers to the United States rely on the EU US Data Privacy Framework and Standard Contractual Clauses, both of which you should reference in your privacy notice.
A full DPIA is not always mandatory, but it is recommended because Yotpo profiles loyalty members, links behaviour to email addresses and purchase history, attributes referrals across visits, and transfers data internationally. Document the purposes, data categories, retention, and safeguards, and reassess if you expand profiling or segmentation.
Load the Yotpo widget and pixel only after the visitor accepts the marketing category in your consent management platform, and keep them blocked until then. Sign the Data Processing Agreement, set sensible retention for loyalty and referral data, document the cookies in your cookie policy, and let members manage their account without forced tracking.
Alternatives include loyalty and referral tools such as LoyaltyLion, Smile.io, or Open Loyalty, some of which offer EU hosting or self hosting. They differ in features and data residency, so the right choice depends on whether you prioritise the Yotpo ecosystem or tighter control over where loyalty data is processed.
List each Yotpo cookie, its purpose, and its duration, name Yotpo as a recipient, and disclose the transfers to the United States and Israel. Keep the entries in sync with a regular cookie scan so that new or renamed Yotpo and Swell cookies are reflected accurately.