Privy
Privy is an ecommerce marketing tool for Shopify and other online stores. It provides website popups, signup forms and spin to win displays to capture visitor email addresses and phone numbers, then runs email and SMS marketing campaigns and automations such as abandoned cart and welcome flows. To target and measure these campaigns Privy sets cookies and tracking scripts that monitor visitor behaviour and conversions.
What does Privy do?
What Privy is
Privy is an ecommerce marketing platform used mainly by Shopify and other online stores. It lets merchants build website popups, banners, signup forms and spin to win displays to capture email addresses and phone numbers, and it runs email and SMS marketing campaigns and automations such as welcome series and abandoned cart reminders. Because it both shows targeted messages and tracks whether visitors convert, Privy places cookies and scripts on the websites that use it.
Data and cookies collected
Privy sets cookies and uses local storage to remember whether a popup has already been shown, to limit how often visitors see a campaign, to identify returning visitors, to follow cart activity and to attribute conversions. When a visitor submits a form, Privy collects their email address, phone number and the data they enter, and links this to behavioural information about their visit. This combination of device identifiers with directly identifying contact details makes the processing clearly personal data under the GDPR.
GDPR and ePrivacy implications
The cookies Privy sets for marketing and measurement are not strictly necessary to deliver the website, so under the ePrivacy Directive and national rules such as PECR they require prior consent before they are stored or read. The marketing emails and SMS messages sent through Privy are governed by the GDPR and ePrivacy rules on electronic communications, which generally require opt in consent. The store is the data controller and Privy acts as a processor.
Consent and data transfers
You must obtain freely given, specific and informed consent through a consent banner before Privy marketing cookies load, and visitors must be able to refuse and to withdraw consent easily. Privy is a US based vendor, so personal data of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Privy is certified, or on Standard Contractual Clauses backed by a transfer impact assessment.
Practical compliance steps
Sign a data processing agreement with Privy, block its scripts until consent is given through your consent management platform, and use double opt in for email and SMS where possible. List the Privy cookies in your cookie policy with their purpose and duration, document the lawful basis and the international transfer safeguards, set clear retention periods, and give subscribers an easy way to unsubscribe and to exercise their data subject rights.
Privy and the GDPR
Privy is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Article 6(1)(a) GDPR) for non essential marketing cookies and email/SMS marketing; ePrivacy consent for storing and reading information on the device.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, PECR, US state privacy laws
Impact assessment (DPIA)
A full DPIA is not usually mandatory for standard popup and email capture use, but a documented assessment is recommended. Consider the scale of visitor tracking, the combination of behavioural cookies with directly identifying contact details, SMS marketing rules under national law, and the transfer of personal data to the United States. Document the lawful basis, retention periods and the safeguards for international transfers.
Sample text for your banner
We use Privy to show marketing popups and to send you email and SMS updates. Privy sets cookies to display these messages and to measure their performance. These cookies run only after you accept marketing cookies, and you can withdraw your consent at any time.
What Privy sets and contacts
- Tracking method
- First and third party cookies plus JavaScript tracking pixels for popup display, visitor identification, cart activity and email capture
- Server location
- United States
- Data transferred outside the EU
- Privy is a US based vendor (owned by Attentive). Personal data of EU visitors is transferred to the United States, relying on the EU US Data Privacy Framework where certified and on Standard Contractual Clauses.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _privy_email | Marketing | 1 year | Stores whether the visitor has submitted their email so the same signup popup is not shown again. |
| privy_session | Functionality | Session | Maintains the visitor session and controls popup display logic during the visit. |
| _privy_dismissed | Functionality | 30 days | Records that a visitor dismissed a popup so the display frequency can be capped. |
| privy_cart | Marketing | 30 days | Tracks cart activity to support abandoned cart automations and conversion attribution. |
Third-party domains contacted (3)
privy.comwidget.privy.comassets.privy.com
Frequently asked questions about Privy
Can't find your question? Write to us, we answer fast.
What cookies does Privy set?
Privy sets first and third party cookies and uses local storage to remember whether a popup has been shown, to cap how often it appears, to identify returning visitors, to follow cart activity and to attribute conversions. These are marketing and functionality cookies rather than strictly necessary ones.
Do I need consent to use Privy?
Yes. Because the Privy cookies are used for marketing and measurement and are not strictly necessary, you need prior consent before they load. Email and SMS marketing sent through Privy also generally requires opt in consent from the recipient.
What is the legal basis for Privy?
The legal basis is consent under Article 6(1)(a) of the GDPR, combined with consent under the ePrivacy rules for storing and reading cookies and for sending electronic marketing. Legitimate interest is not appropriate for these marketing cookies.
Does Privy transfer data to the United States?
Yes. Privy is a US based vendor, so personal data of EU visitors is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Privy is certified, or on Standard Contractual Clauses with a transfer impact assessment.
Do I need a DPIA for Privy?
A full DPIA is not usually mandatory for standard popup and email capture use. A documented assessment is still recommended, especially given the combination of behavioural tracking with identifying contact details, SMS marketing and the transfer of data outside the EU.
How do I implement Privy compliantly?
Sign a data processing agreement, block Privy scripts until the visitor consents through your consent management platform, use double opt in for email and SMS where possible, list the cookies in your cookie policy and provide an easy way to unsubscribe and to exercise data subject rights.
What are the alternatives to Privy?
Alternatives include other popup and email tools such as Klaviyo, OptiMonk, Sumo, Mailchimp or Omnisend. Any alternative that sets marketing cookies or sends electronic marketing raises the same consent and transfer questions, so assess each on its data practices.
How should I update my cookie policy for Privy?
List each Privy cookie with its name, purpose and duration, classify them as marketing or functionality cookies, name Privy as the processor, mention the transfer of data to the United States and the safeguards used, and explain how visitors can manage or withdraw consent.
Gravity Forms
Gravity Forms is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Gravity Forms offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Gravity Forms empowers organizations to optimize strategy and maximize return on investment.
MailChimp for WordPress
MailChimp for WordPress is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. MailChimp for WordPress supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, MailChimp for WordPress remains a leading web.
Qualified
Qualified is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Qualified offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Qualified empowers organizations to optimize strategy and maximize return on investment.
Connectally
Connectally is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Connectally enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Connectally empowers marketing teams to achieve measurable growth.
AiTrillion
AiTrillion is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. AiTrillion enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, AiTrillion empowers marketing teams to achieve measurable growth.
Sistem
Sistem is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Sistem integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Sistem makes advanced AI accessible to all teams.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.