> Gleam competitions and giveaways: how gleam.js tracks entries, which cookies and social plugins it loads and why GDPR and ePrivacy require prior consent. > > Canonical: https://www.flowconsent.com/en/services/marketing/gleam Marketing # Gleam Marketing · [Official website](https://gleam.io) Gleam is a marketing app suite (Competitions, Rewards, Galleries, Capture) embedded as a JavaScript widget on a publisher site. It collects participant entries, connects to social networks (Facebook, Twitter, Instagram, TikTok) to verify actions, and stores the data on Gleam.io servers in Australia. As a third party widget loading social plugins, it requires prior consent under the GDPR and the ePrivacy Directive. [Block Gleam until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Australia (primary) and United States (CDN), with regional CloudFlare edges. Overview ## What does Gleam do? ## **What is Gleam?** Gleam.io is an Australian SaaS that powers giveaways, competitions, sweepstakes, rewards programmes and user generated galleries. Its widgets are embedded as a JavaScript snippet on the publisher site and orchestrate the entry workflow, verifying actions via integrations with Facebook, Twitter, Instagram, TikTok, YouTube, Discord and dozens of other platforms. Gleam is widely used by ecommerce, gaming and media publishers in Europe. ## **Cookies and identifiers** The Gleam widget sets first party cookies (gleam\_session, gleam\_anon\_id) to deduplicate entries and remember the participant's state inside a campaign. When a user connects a social account, Gleam stores the OAuth token and a hashed user ID on its servers. Embedded social plugins can in turn drop their own third party cookies. ## **GDPR and ePrivacy implications** Loading the gleam.js widget triggers cookie storage and the loading of third party social plugins, which both fall under Article 5(3) ePrivacy and require prior consent. The processing of participant data, social IDs and email addresses for promotional purposes additionally requires a clear legal basis under the GDPR, typically consent or contract performance for the giveaway terms. ## **Consent and social plugin handling** Block the Gleam widget through your CMP until the visitor accepts the marketing category. Use the click to consent pattern for social plugins inside the widget so that no Facebook, Twitter or Instagram cookie is dropped before the user explicitly chooses to connect. Document the giveaway terms and the data retention separately for participants who win and those who do not. ## **Data transfers** Gleam.io Pty Ltd is established in Melbourne, Australia, and runs infrastructure in Australia, the United States and Cloudflare edges worldwide. The EU Commission has not adopted an adequacy decision for Australia, so the transfer must rely on Standard Contractual Clauses with supplementary measures, plus an EU U.S. Data Privacy Framework certification for any US subprocessor. ## **Implementing Gleam compliantly** Gate the widget on a CMP signal, sign the Gleam Data Processing Addendum, document Gleam.io Pty Ltd in your records of processing as a processor in Australia, define a retention policy for entries and OAuth tokens, and provide entrants with a clear privacy notice for the giveaway. Compliance ## Gleam and the GDPR Gleam is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy: the widget loads third party JavaScript, sets cookies and integrates social plugins (Facebook, Twitter, Instagram) that profile the user. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, Standard Contractual Clauses (Australia transfer) ### Impact assessment (DPIA) A DPIA should be considered when Gleam campaigns process large volumes of personal data, when special categories are collected (preferences, location), or when integrations send data to social platforms with their own targeting beyond verification. ### Sample text for your banner > We use Gleam.io to run giveaways and competitions on this site. With your consent, Gleam will set cookies on your device, load social plugins (Facebook, Twitter, Instagram) and transfer your entry data to Gleam.io Pty Ltd in Australia. You can refuse or withdraw your consent at any time from the cookie settings. Cookies and trackers ## What Gleam sets and contacts - Tracking method JavaScript widget (gleam.js loaded from gleam.io and assets.gleam.io) embedded on the publisher site that hosts giveaway, competition, reward and gallery campaigns, sets first party cookies for entry deduplication and forwards entries plus connected social accounts to Gleam servers. - Server location Australia (primary) and United States (CDN), with regional CloudFlare edges. - Data transferred outside the EU Entries, IP addresses and connected social account data are transferred to Gleam.io Pty Ltd in Australia (the EU Commission has not adopted an adequacy decision for Australia) and to its US based subprocessors, requiring Standard Contractual Clauses. ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | ------------ | ---------- | ----------------------------------------------------------------------------------------------------------------------- | | gleam\_session | first\_party | session | Stores the participant's session state inside a Gleam campaign and enables anti fraud checks during the entry workflow. | | gleam\_anon\_id | first\_party | 6 months | Anonymous identifier used by Gleam to deduplicate entries and recognise returning participants across sessions. | | \_\_cf\_bm | third\_party | 30 minutes | Cloudflare bot management cookie set on gleam.io to mitigate automated traffic and protect the giveaway from cheating. | ### Third-party domains contacted (4) - `gleam.io` - `assets.gleam.io` - `widget.gleam.io` - `cdn.gleam.io` Questions ## Frequently asked questions about Gleam Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Gleam set? The Gleam widget sets first party cookies (gleam\_session, gleam\_anon\_id) to deduplicate entries and remember the participant's state. Connecting a social account causes Gleam and the social plugin to drop additional third party cookies. ### Does Gleam require consent? Yes. The widget loads third party JavaScript and writes cookies that are not strictly necessary, so prior consent is required under Article 5(3) of the ePrivacy Directive. The processing of participant data also requires a clear GDPR legal basis. ### What is the legal basis? For voluntary actions like email submissions, consent is the appropriate basis. For mandatory entry conditions (filling in a participant form), contract performance for the giveaway terms can apply, but cookie storage still needs consent. ### Are data transferred outside the EU? Yes. Gleam.io Pty Ltd is based in Australia and uses US sub processors. Australia is not covered by an EU adequacy decision, so the transfer relies on Standard Contractual Clauses with supplementary measures. ### Do I need a DPIA for Gleam? A DPIA is recommended when Gleam is used to collect large volumes of personal data, when sensitive categories are processed, or when the data is shared with third party platforms beyond mere verification. ### How do I deploy Gleam compliantly? Block the widget through your CMP until consent, use click to consent for social plugins, sign the Gleam DPA, define a retention policy for entries and OAuth tokens, and publish a clear giveaway privacy notice. ### Are there alternatives to Gleam? EU hosted alternatives include Drimify, Qualifio (Belgium) or Easypromos (Spain), all of which offer giveaway and contest mechanics with EU data residency. ### How do I update my cookie policy? Add a section that names Gleam.io, lists the cookies (gleam\_session, gleam\_anon\_id) with purpose and duration, mentions the embedded social plugins (Facebook, Twitter, Instagram, etc.) and discloses the transfer to Gleam.io Pty Ltd in Australia. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Zotabox](https://www.flowconsent.com/en/services/marketing/zotabox) [Zotabox is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Zotabox provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Zotabox helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/zotabox) [Marketing](https://www.flowconsent.com/en/services/marketing/zotabox) · ### [Outfunnel](https://www.flowconsent.com/en/services/marketing/outfunnel) [Outfunnel is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Outfunnel enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Outfunnel empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/outfunnel) [Marketing](https://www.flowconsent.com/en/services/marketing/outfunnel) · ### [EverWondr](https://www.flowconsent.com/en/services/marketing/everwondr) [EverWondr is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. EverWondr supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, EverWondr ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/everwondr) [Marketing](https://www.flowconsent.com/en/services/marketing/everwondr) · ### [WPForms](https://www.flowconsent.com/en/services/marketing/wpforms) [WPForms is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. WPForms offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, WPForms empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/wpforms) [Marketing](https://www.flowconsent.com/en/services/marketing/wpforms) · ### [Dataships](https://www.flowconsent.com/en/services/marketing/dataships) [Dataships is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Dataships integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Dataships helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/dataships) [Essential](https://www.flowconsent.com/en/services/marketing/dataships) · ### [Flipping Pro CRM](https://www.flowconsent.com/en/services/marketing/flipping-pro-crm) [Flipping Pro CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Flipping Pro CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Flipping Pro CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/flipping-pro-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/flipping-pro-crm) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)