> How Okendo reviews and loyalty widgets use cookies and data, why consent is required under GDPR and ePrivacy, and how to stay compliant. > > Canonical: https://www.flowconsent.com/en/services/marketing/okendo Marketing # Okendo Preferences · [Official website](https://www.okendo.io) Okendo is a customer reviews, ratings, user generated content and loyalty platform built primarily for Shopify stores. It loads a third party JavaScript widget that displays reviews and may collect data such as IP address, device and browser information, and behavioural signals about how visitors interact with content. Okendo sets browser cookies and may use local storage to recognise visitors and link review and loyalty activity. Because these technologies are not strictly necessary, the ePrivacy Directive and GDPR require prior consent before they load. Okendo is operated from the United States and uses sub processors including Shopify in Canada and Google and Twilio in the United States, so personal data is transferred outside the EEA and the UK under Standard Contractual Clauses. Merchants act as data controllers and should obtain consent and sign the Okendo data processing addendum. [Block Okendo until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Preferences - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States (with sub processors in the United States and Canada) Overview ## What does Okendo do? Okendo is a customer reviews, ratings, user generated content and loyalty platform built primarily for Shopify stores. It helps brands collect reviews, display social proof and run loyalty, quizzes and referral programmes through embedded widgets on the storefront. ## **What Okendo is** Okendo provides review collection, ratings display, photo and video reviews, loyalty, quizzes, surveys and referrals for e-commerce brands. It integrates closely with Shopify and loads its features through a JavaScript widget served from Okendo infrastructure. ## **What data and cookies it collects** When the widget loads it can collect IP address, browser and device information, and behavioural signals about how a visitor interacts with reviews and loyalty features. Okendo sets browser cookies and may use local storage to remember visitors and link activity. Customers who submit reviews provide their name, email and review content. ## **GDPR and ePrivacy implications** Because the cookies and storage used by Okendo are not strictly necessary, the ePrivacy Directive requires prior consent before they are placed. Under GDPR the store acts as data controller and must have a lawful basis, provide transparency and honour data subject rights. Consent is the most appropriate basis given the marketing, loyalty and profiling context. ## **Consent and data transfers** Valid consent must be obtained before the widget loads, and it should be blocked until the visitor agrees. Okendo operates from the United States and uses sub processors in the United States and Canada, so personal data leaves the EEA and the UK. These transfers rely on Standard Contractual Clauses under the Okendo data processing addendum and should be referenced in your privacy notice. ## **Practical compliance steps** Categorise Okendo as a marketing service in your consent manager and prevent it from loading until consent is given. Sign the Okendo data processing addendum, document the sub processors and transfer safeguards, list the cookies in your cookie policy and set sensible retention periods. Test that declining consent keeps the widget fully disabled. Compliance ## Okendo and the GDPR Okendo is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A full data protection impact assessment is not usually mandatory for a standard reviews widget, but a documented assessment is recommended because Okendo processes personal data, uses several sub processors and transfers data to the United States. Consider the behavioural signals captured, the combination of reviews with loyalty profiling, and the chain of sub processors. Document the legal basis, retention periods and the transfer safeguards. Where loyalty programmes profile customers or marketing is layered on top, the risk increases and a DPIA becomes advisable. ### Sample text for your banner > We use Okendo to show customer reviews and run loyalty features. This sets cookies and may share data with Okendo and its providers in the United States and Canada. Please accept to enable reviews and loyalty, or decline to keep them disabled. Cookies and trackers ## What Okendo sets and contacts - Tracking method Third party JavaScript widget for reviews, ratings, UGC and loyalty that loads content, sets browser cookies, may use local storage and collects device and behavioural data - Server location United States (with sub processors in the United States and Canada) - Data transferred outside the EU Personal data is transferred to the United States and to sub processors including Shopify in Canada and Google and Twilio in the United States. Transfers from the EEA and UK rely on Standard Contractual Clauses under the Okendo data processing addendum. ### Cookies set (3) | Name | Type | Duration | Purpose | | ---------------------- | -------------- | ------------------------ | ------------------------------------------------------------------------------------------- | | okendo\_session | third party | Session | Maintains a visitor session for the reviews and loyalty widget while browsing. | | okendo\_id | third party | Up to 1 year | Recognises returning visitors and links review and loyalty activity to a stable identifier. | | okendo\_local\_storage | JS first party | Persistent until cleared | Local storage used to cache widget state and preferences in the browser. | ### Third-party domains contacted (3) - `okendo.io` - `cdn-static.okendo.io` - `api.okendo.io` Questions ## Frequently asked questions about Okendo Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Okendo set? Okendo typically sets first party and third party cookies and may use local storage to recognise visitors, link review and loyalty activity and remember preferences. Exact names vary by configuration and version, so audit your storefront with browser tools to confirm what is placed. None of these are strictly necessary for the store to function. ### Is consent required to use Okendo? Yes. Because the cookies and storage are not strictly necessary and support marketing, loyalty and profiling, the ePrivacy Directive and GDPR require prior consent in the EEA and the UK. The Okendo widget should be blocked until the visitor accepts, and declining must keep it fully disabled. ### What is the legal basis for processing? Consent is the appropriate legal basis for the cookies and tracking, given the marketing and loyalty context. For storing submitted reviews you may also rely on consent or, in narrow cases, legitimate interest, but the non-essential storage on the visitor device still requires consent first. ### Does Okendo transfer data to the United States? Yes. Okendo is operated from the United States and uses sub processors including Shopify in Canada and Google and Twilio in the United States, so personal data is transferred outside the EEA and the UK. These transfers rely on Standard Contractual Clauses under the Okendo data processing addendum, which you should reference in your privacy notice. ### Do I need a DPIA for Okendo? A DPIA is not always mandatory for a basic reviews widget, but a documented assessment is recommended because Okendo processes personal data, uses several sub processors and sends data to a third country. If you combine reviews with loyalty profiling or wider marketing, a DPIA becomes advisable. ### How do I implement Okendo compliantly? Place Okendo behind your consent manager so it loads only after consent, classify it as marketing, sign the Okendo data processing addendum, document the sub processors and transfer safeguards and list its cookies in your cookie policy. Then test that declining keeps the widget disabled. ### What are the alternatives to Okendo? Alternatives include other reviews and UGC platforms such as Stamped, Yotpo, Junip, Feefo and PowerReviews. Most behave similarly and load third party scripts that set cookies, so the same consent and transfer considerations apply regardless of provider. ### How do I update my cookie policy for Okendo? List Okendo under marketing or functional cookies in your cookie policy, describe its purpose, name the provider and country, indicate the cookies and their durations, and link to the Okendo privacy policy. Keep the entry in sync with what your consent manager actually blocks and allows. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [BTOLEAD](https://www.flowconsent.com/en/services/marketing/btolead) [BTOLEAD is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. BTOLEAD provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, BTOLEAD helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/btolead) [Marketing](https://www.flowconsent.com/en/services/marketing/btolead) · ### [Enkod](https://www.flowconsent.com/en/services/marketing/enkod) [Enkod is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Enkod enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Enkod empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/enkod) [Marketing](https://www.flowconsent.com/en/services/marketing/enkod) · ### [Topline Pro](https://www.flowconsent.com/en/services/marketing/topline-pro) [Topline Pro is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Topline Pro provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Topline Pro helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/topline-pro) [Marketing](https://www.flowconsent.com/en/services/marketing/topline-pro) · ### [SoTellUs](https://www.flowconsent.com/en/services/marketing/sotellus) [SoTellUs is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SoTellUs supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SoTellUs ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/sotellus) [Preferences](https://www.flowconsent.com/en/services/marketing/sotellus) · ### [Pushouse](https://www.flowconsent.com/en/services/marketing/pushouse) [Pushouse is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Pushouse provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Pushouse helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/pushouse) [Marketing](https://www.flowconsent.com/en/services/marketing/pushouse) · ### [Ometria](https://www.flowconsent.com/en/services/marketing/ometria) [Ometria is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Ometria enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Ometria empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/ometria) [Marketing](https://www.flowconsent.com/en/services/marketing/ometria) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)