FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Personalization

Nosto

Analytics

Nosto is an ecommerce personalization and product recommendation engine. It tracks shopper behaviour such as product views, searches, cart actions and purchases to build individual profiles, then delivers tailored recommendations, content and offers. Because it relies on behavioural profiling and non essential cookies, it requires consent under GDPR and the ePrivacy rules.

Block Nosto until consentScan my site
Overview

What does Nosto do?

What Nosto is

Nosto is an ecommerce personalization and product recommendation engine used by online retailers. It observes how each visitor interacts with a store, including the products they view, the searches they run, the items they add to the cart and the purchases they complete. From these signals it builds individual shopper profiles and uses them to display tailored product recommendations, personalized content, pop ups and offers. It is not a generic web analytics tool, its core purpose is real time behavioural profiling for personalization.

Data and cookies collected

Nosto deploys a JavaScript tag that sets first party cookies and identifiers such as 2c.cId and nosto related cookies. These persist a visitor identifier and capture browsing history, product views, cart contents and purchase behaviour. This information is linked to a profile that can recognise the same shopper across sessions. Because the data describes individual behaviour and is tied to persistent identifiers, it constitutes personal data under the GDPR.

GDPR and ePrivacy implications

The cookies and identifiers Nosto uses are not strictly necessary to deliver the website, so Article 5(3) of the ePrivacy Directive requires consent before they are stored or read. The profiling activity also needs a lawful basis under the GDPR, and for this kind of personalization the appropriate basis is the consent of the individual under Article 6(1)(a). Profiling carries transparency obligations, and shoppers must be informed clearly about how their behaviour is used.

Consent and data transfers

Consent must be freely given, specific, informed and unambiguous, and Nosto should only load after the visitor has accepted personalization cookies. Depending on the hosting region and integrations, data may be transferred outside the European Economic Area, including to the United States. Such transfers require safeguards such as Standard Contractual Clauses or reliance on the EU US Data Privacy Framework, together with a transfer risk assessment.

Practical compliance steps

Block the Nosto tag until consent is captured through a compliant consent management platform, document the cookies and their purposes in your cookie policy, and provide an easy way to withdraw consent. Sign a data processing agreement with Nosto, verify the hosting region, review the transfer safeguards, and assess whether a Data Protection Impact Assessment is needed given the scale of profiling. Keep records of consent and regularly audit what the tag actually loads.

Compliance

Nosto and the GDPR

Nosto is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under Article 6(1)(a) GDPR combined with Article 5(3) ePrivacy Directive for storing and reading non essential cookies and for behavioural profiling.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), national ePrivacy implementations

Impact assessment (DPIA)

Nosto performs systematic behavioural profiling of online shoppers to personalize content and recommendations. A Data Protection Impact Assessment is recommended where profiling is extensive or combined with other data sources. Assess the scale of profiling, the use of unique identifiers, possible transfers to third countries, and the impact on individuals who cannot easily avoid the processing.

Sample text for your banner

We use Nosto to personalize product recommendations and content based on your browsing and purchase behaviour. This involves cookies and profiling. Do you consent to personalization powered by Nosto?
Cookies and trackers

What Nosto sets and contacts

Tracking method
First party JavaScript tag plus cookies and a backend recommendation engine. Captures page views, product views, search queries, cart actions and purchase events to build individual shopper profiles used for personalization and product recommendations.
Server location
European Union (primary processing) with possible processing in the United States and other regions depending on configuration and integrations.
Data transferred outside the EU
Data may be transferred outside the EEA, including to the United States, depending on hosting region and integrations. Transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework.

Cookies set (3)

NameTypeDurationPurpose
2c.cIdHTTP cookiePersistent (up to 1 year)Stores a unique visitor identifier used to build the shopper profile and serve personalized recommendations.
nostoTabHTTP cookieSessionCoordinates Nosto behaviour across browser tabs during a visit.
2c.tsHTTP cookiePersistentRecords timestamp and session information for behavioural tracking and personalization.

Third-party domains contacted (3)

  • nosto.com
  • connect.nosto.com
  • api.nosto.com
Questions

Frequently asked questions about Nosto

Can't find your question? Write to us, we answer fast.

What cookies does Nosto set?

Nosto sets first party cookies and identifiers such as 2c.cId and other nosto related cookies. They store a visitor identifier and record browsing history, product views, cart contents and purchases so the engine can build a shopper profile and serve personalized recommendations.

Is consent required to use Nosto?

Yes. The cookies and profiling Nosto relies on are not strictly necessary, so under Article 5(3) ePrivacy and Article 6(1)(a) GDPR you must obtain prior, freely given and informed consent before the tag loads.

What is the legal basis for Nosto?

The appropriate legal basis is consent under Article 6(1)(a) GDPR, combined with consent for cookie storage under Article 5(3) of the ePrivacy Directive. Legitimate interest is generally not sufficient for this kind of behavioural personalization.

Does Nosto transfer data to the United States?

Depending on the hosting region and integrations, data may be transferred outside the EEA, including to the United States. Such transfers require Standard Contractual Clauses or reliance on the EU US Data Privacy Framework, plus a transfer risk assessment.

Do I need a DPIA for Nosto?

A Data Protection Impact Assessment is recommended where the profiling is extensive or combined with other datasets. Nosto carries out systematic behavioural profiling, so assess scale, identifiers and transfers to decide whether a DPIA is mandatory.

How do I implement Nosto compliantly?

Load Nosto only after consent through a consent management platform, document its cookies in your cookie policy, sign a data processing agreement, verify hosting and transfer safeguards, and provide an easy way to withdraw consent.

What are the alternatives to Nosto?

Alternatives include other ecommerce personalization engines and recommendation tools, or first party server side approaches with reduced tracking. Any alternative that profiles shoppers raises the same consent and transfer questions, so evaluate data location and minimisation.

How should I update my cookie policy for Nosto?

List the Nosto cookies and identifiers, describe their personalization and profiling purpose, state their duration, name Nosto as a processor, and disclose possible transfers outside the EEA together with the safeguards used.

Same category

More services: Personalization

See the whole category

Varify

Varify is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Varify supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Varify enables informed decisions that improve experience and drive results.

Analytics

Bloomreach Discovery

Bloomreach Discovery is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Bloomreach Discovery supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Bloomreach Discovery enables informed decisions that improve experience.

Analytics

PersonaClick

PersonaClick is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. PersonaClick enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, PersonaClick empowers marketing teams to achieve measurable growth.

Preferences

Segmentify

Segmentify is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Segmentify supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Segmentify enables informed decisions that improve experience and drive results.

Analytics

CloudEngage

CloudEngage is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CloudEngage enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CloudEngage empowers marketing teams to achieve measurable growth.

Preferences

Split

Split is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Split supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Split enables informed decisions that improve experience and drive results.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site