Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Usabilla is a voice of customer platform owned by SurveyMonkey that runs in page feedback buttons, surveys and email surveys to capture user input.
Usabilla is a voice of customer (VoC) platform founded in Amsterdam and acquired by SurveyMonkey (now Momentive, then SurveyMonkey again) in 2019. It offers a feedback button widget, in page surveys, email surveys and mobile SDKs that brands use to ask visitors for ratings, comments and screenshots of issues.
The Usabilla widget writes ubvs (visitor session), ubvt (visitor token) and ubcm (campaign exposure) cookies, plus localStorage entries. The platform receives the visitor IP, user agent, the page URL, the survey responses, an optional screenshot of the page (with annotations), the answer to NPS and CSAT questions and any custom data you push via getuserdata.
Loading the Usabilla widget reads and writes on the user device, so Article 5(3) of the ePrivacy Directive requires consent on public pages. The screenshot capture is particularly sensitive because it can include personal data visible on the page (eg an order confirmation showing a name and address). Always offer a disable screenshot option.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent before loading on public sites. Contract performance for in product surveys offered to authenticated customers as part of the service experience. Sensitive surveys (health, beliefs) require Art. 9 GDPR explicit consent. Employee feedback requires legitimate interest and works council involvement.
Usabilla data is processed at rest in Amsterdam, which is a strong EU residency. However, SurveyMonkey is US headquartered and its global support and engineering teams may access data from the US. Cover the transfer with the EU US Data Privacy Framework and Standard Contractual Clauses in the Usabilla / SurveyMonkey DPA.
Block the widget until consent. Turn off screenshot capture when not strictly necessary; mask personal data overlays when used. Limit retention of feedback to the minimum needed for product decisions. Mask IP addresses to /24 if granular geolocation is not needed. Sign the Usabilla / SurveyMonkey DPA and document the processing.
Websites using Usabilla must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Usabilla collects employee feedback in the workplace, when minors interact, when sensitive topics are surveyed, or when responses feed automated NPS based decisions.
Sample consent text
We use Usabilla to collect feedback on our pages. Usabilla writes cookies on your device and shares your IP, browser context and answers with Usabilla B.V. (a SurveyMonkey company) in Amsterdam, with possible US access. We only load the widget if you accept.
Third-party domains contacted
usabilla.comw.usabilla.comapi.usabilla.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ubvs | third_party | session | Identifies the current Usabilla visitor session |
| ubvt | third_party | 1 year | Persistent visitor token used to deduplicate feedback submissions |
| ubcm | third_party | 6 months | Records that the visitor has been exposed to a feedback campaign |
Usabilla uses cookies for user preferences — inform visitors with a consent banner.
Usabilla writes ubvs (visitor session), ubvt (visitor token) and ubcm (campaign exposure). Some templates add a screenshot cache cookie. Mobile SDKs use device storage instead of cookies.
Yes for public website widgets. The script writes to the user device, the screenshot capture may collect personal data visible on the page, and feedback responses are personal data. Authenticated in product surveys can rely on contract performance.
Consent for public widgets. Contract performance for in product NPS, CSAT and CES surveys delivered as part of the service. Sensitive surveys need Art. 9 GDPR explicit consent.
Usabilla data is stored in Amsterdam. SurveyMonkey personnel in the US can still access the system for support, so transfers may occur and rely on the EU US Data Privacy Framework and Standard Contractual Clauses.
Recommended for employee feedback, surveys about minors, sensitive topics, or when NPS scores feed automated decisions.
Block the widget until consent, disable screenshots when not needed, mask personal data on screen for sensitive forms, set short retention, mask IP addresses and sign the SurveyMonkey DPA.
LimeSurvey (Germany), Hotjar (Malta, now Contentsquare), Mopinion (Netherlands), Survicate (Poland), Tally (Belgium), Typeform with EU data residency.
List the ubvs, ubvt and ubcm cookies with purpose, duration and controller. Specify the Amsterdam data residency, the SurveyMonkey ownership and the EU US Data Privacy Framework basis for any transfer.