Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Hello Bar is a website popup, notification bar and lead capture tool. It displays bars, modals and slide ins to announce offers, grow email lists and drive clicks. To decide when and how often to show these messages and to measure conversions, Hello Bar sets cookies and runs scripts that track visitor behaviour, so it is not strictly necessary for the website to function.
Hello Bar is a website conversion tool that displays notification bars, popups, modals and slide ins. Site owners use it to announce promotions, grow email lists, drive clicks to key pages and capture leads. To decide when and how often to show a message and to measure whether visitors act on it, Hello Bar loads a script that sets cookies and tracks visitor behaviour on the pages where it runs.
Hello Bar sets cookies and uses local storage to remember which bars a visitor has already seen, to cap how often they appear, to record dismissals and clicks and to attribute conversions. It also processes IP addresses and device or browser information. When a visitor submits a form, Hello Bar collects the email address and any other data entered. Combined with online identifiers, this is personal data under the GDPR.
The cookies Hello Bar sets to control display frequency, track behaviour and measure conversions are not strictly necessary to deliver the website, so under the ePrivacy Directive and national rules such as PECR they require prior consent before they are stored or read. The website owner is the data controller and Hello Bar acts as a processor for the data it handles on the owner''s behalf.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain freely given, specific and informed consent through a consent banner before the Hello Bar script and its cookies load, and visitors must be able to refuse and to withdraw consent easily. Hello Bar is a US based vendor, so personal data of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Hello Bar is certified, or on Standard Contractual Clauses backed by a transfer impact assessment.
Sign a data processing agreement with Hello Bar, block its script until consent is given through your consent management platform, and tie any email sign ups to a clear privacy notice. List the Hello Bar cookies in your cookie policy with their purpose and duration, document the lawful basis and the international transfer safeguards, set retention periods, and give visitors an easy way to withdraw consent and to exercise their data subject rights.
Websites using Hello Bar must obtain user consent under GDPR regulations.
DPIA considerations
A full DPIA is not usually mandatory for standard notification bars and lead capture, but a documented assessment is recommended. Consider the scale of visitor tracking, the capture of email addresses, the use of behavioural data to target messages and the transfer of personal data to the United States. Document the lawful basis, retention periods and transfer safeguards.
Sample consent text
We use Hello Bar to show notification bars and popups and to capture sign ups. Hello Bar sets cookies to control how often you see these messages and to measure their performance. These cookies run only after you accept marketing cookies, and you can withdraw your consent at any time.
Third-party domains contacted
hellobar.commy.hellobar.comhb-stack.s3.amazonaws.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| hellobar | Functionality | 1 year | Stores which Hello Bar messages a visitor has seen and dismissed to control display frequency. |
| hb_insights | Marketing | 1 year | Tracks visitor interactions and clicks on bars to measure conversions and performance. |
| _hb_session | Functionality | Session | Maintains session state for the Hello Bar widget during the visit. |
Hello Bar places tracking cookies for advertising — comply with GDPR using FlowConsent.
Hello Bar sets first and third party cookies and uses local storage to remember which bars a visitor has seen, to cap how often they appear, to record dismissals and clicks and to attribute conversions. These are functionality and marketing cookies rather than strictly necessary ones.
Yes. The cookies Hello Bar uses for display control, behaviour tracking and conversion measurement are not strictly necessary, so you need prior consent before its script and cookies load on a visitor's device.
The legal basis is consent under Article 6(1)(a) of the GDPR, combined with ePrivacy consent for storing and reading information on the device. Legitimate interest is not appropriate for these non essential cookies.
Yes. Hello Bar is a US based vendor, so personal data such as IP addresses and identifiers of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Hello Bar is certified, or on Standard Contractual Clauses with a transfer impact assessment.
A full DPIA is not usually mandatory for standard notification bars and lead capture. A documented assessment is recommended, particularly where behavioural data is used to target messages, email addresses are collected and data is transferred outside the EU.
Sign a data processing agreement, block the Hello Bar script until the visitor consents through your consent management platform, attach a clear privacy notice to email sign ups, list the cookies in your cookie policy and give visitors an easy way to withdraw consent.
Alternatives include other popup and notification bar tools such as OptiMonk, Sumo, Privy, Sleeknote or OptinMonster. Any alternative that sets non essential cookies or captures leads raises the same consent and transfer questions, so assess each on its data practices.
List each Hello Bar cookie with its name, purpose and duration, classify them as functionality or marketing cookies, name Hello Bar as the processor, mention the transfer of data to the United States and the safeguards used, and explain how visitors can manage or withdraw consent.