Yupop

What is Yupop?

Yupop is a free online store builder launched by Wallapop, the Barcelona based second hand marketplace, to help small shops and freelancers start selling online. Merchants could create a store without a monthly fee, connect a custom domain or use a free subdomain, configure SEO texts and connect the shop to sales channels such as Instagram, Facebook and Google Shopping. Yupop took a commission on each sale instead of a subscription.

The yupop.com website now displays an important notice: Yupop will no longer be available from 13 August 2026. If you searched for yupop because you run or used a Yupop store, the main privacy questions are now about migrating your shop, exporting customer and order data, and making sure the data left on the platform is properly deleted.

Data and cookies on Yupop stores

Because Yupop was a hosted platform, the storefront, cart and checkout ran on Yupop infrastructure. Stores relied on first party cookies to keep the session and the content of the cart, which are strictly necessary. Customer accounts and orders contained names, email and postal addresses, phone numbers and purchase history, processed by Wallapop on behalf of the merchant. Exact store cookie names were not documented publicly.

The integrations added more processing: connecting the store to Facebook and Instagram or Google Shopping typically adds the Meta Pixel and Google tags, which set advertising cookies such as _fbp or _ga. The yupop.com marketing site itself uses CookieYes (cookieyes-consent cookie), Google Tag Manager, VWO for A/B testing, PostHog analytics hosted in the EU, and Cloudflare, which sets the _cfuvid cookie. Its cookie policy states that non essential cookies are only installed after acceptance.

GDPR and LSSI CE implications

For store data, the merchant is the data controller and Wallapop acts as processor, so the merchant must inform customers, answer their rights requests and rely on a processing agreement with the platform. Under LSSI CE art. 22.2, ePrivacy art. 5(3), the AEPD guide, the CNIL guidelines and German TDDDG § 25, only cookies strictly needed for the cart, login and checkout can be used without consent. Analytics and advertising cookies need prior, informed and specific consent.

When is consent required?

Consent is not needed for session, cart, security and checkout cookies. It is required before the Meta Pixel, Google Analytics, Google Ads or any A/B testing tool loads. A banner must offer accept and refuse options with equal prominence, and refusing must not block the purchase. On the yupop.com site, CookieYes manages this choice.

Data transfers outside the EEA

Wallapop is a Spanish company, but several tools involved are based in the United States or elsewhere: Google, Meta, Cloudflare and Webflow in the US, and VWO run by Wingify in India. Transfers to certified US companies can rely on the EU US Data Privacy Framework; others need SCC 2021/914 and a transfer impact assessment following Schrems II. The detailed list of store subprocessors was not published, so check Wallapop's privacy documentation.

Practical steps for Yupop merchants

Before the shutdown, export your product catalogue, customer list and order history, and move them to a new platform under a processing agreement; EU based options include PrestaShop, a self hosted WooCommerce store on an EU host, or Shopware. Inform customers about the change of platform in your privacy notice and do not reuse their data for new purposes without a legal basis.

On the new store, deploy a consent management platform such as FlowConsent, block Meta and Google tags until consent, enable Google Consent Mode v2, and update your cookie policy. Finally, ask Wallapop to confirm deletion of your store data and keep that confirmation as part of your accountability file.