Vidora
Machine learning personalisation and recommendation platform acquired by Twilio that uses a JavaScript SDK to set a first party visitor cookie and collect behavioural events.
What does Vidora do?
What is Vidora
Vidora is a machine learning driven personalisation and recommendation platform that was acquired by Twilio. It ships a JavaScript SDK that publishers and ecommerce sites embed to collect behavioural events such as page views, clicks, scroll depth and purchases. These events feed predictive models that decide which content, product or promotion should be shown to each individual visitor.
Cookies and data collected
The SDK writes a first party cookie named _vidora_visitor that contains a persistent identifier. Vidora also receives the visitor IP address, user agent, referrer, URL, custom event attributes and any user identifier you decide to pass. Combined these data points let Vidora build a behavioural profile that qualifies as personal data under the GDPR.
GDPR and ePrivacy implications
Because Vidora reads and writes identifiers on the visitor terminal for personalisation and marketing purposes, Article 5(3) of the ePrivacy Directive requires prior consent. The downstream processing of behavioural data and machine learning profiling falls under Article 6(1)(a) of the GDPR. Automated decisions that significantly affect the visitor may also trigger Article 22 rights.
Data transfers
Vidora is hosted on AWS in the United States and Twilio is a US controller, so behavioural events are systematically transferred to the United States. EU customers must rely on the EU US Data Privacy Framework or Standard Contractual Clauses, complete a Transfer Impact Assessment and ensure that data minimisation is properly configured in the SDK.
How to implement compliance
Block the Vidora SDK until the visitor opts in through your consent management platform, expose a granular toggle for marketing or personalisation, document Vidora as a recipient in your privacy notice and configure the SDK to send only the events that are strictly required for the use case. Provide an effective opt out and document the Data Privacy Framework status of Twilio.
Vidora and the GDPR
Vidora is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (GDPR Art. 6(1)(a)) and ePrivacy Directive Art. 5(3) for cookie storage
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, TTDSG, LIL, LOPDGDD
Impact assessment (DPIA)
A DPIA is required because Vidora performs systematic behavioural profiling with machine learning, transfers data to the United States and may drive automated decisions affecting the visitor. Document the lawful basis, the EU US Data Privacy Framework status of Twilio and the safeguards put in place.
Sample text for your banner
We use Vidora, a Twilio owned personalisation engine, to recommend content tailored to you. It stores a cookie on your device and sends behavioural data to servers in the United States. Click Accept to enable Vidora or Reject to keep a non personalised experience.
What Vidora sets and contacts
- Tracking method
- JavaScript SDK that fires asynchronously, sets first party cookies for visitor identification and streams behavioural events to Vidora servers for ML personalisation
- Server location
- United States (AWS us-east-1; Vidora was acquired by Twilio Inc., headquartered in the US)
- Data transferred outside the EU
- Visitor identifiers and behavioural events are transmitted to Vidora and Twilio infrastructure hosted on AWS in the United States.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _vidora_visitor | marketing | 1 year | Persistent first party visitor identifier that links every behavioural event captured by the Vidora SDK to a single profile used by the machine learning models. |
| _vidora_session | marketing | 30 minutes | Short lived session identifier used to group events belonging to the same browsing session for the recommendation engine. |
| _vidora_test | functional | 90 days | Stores the AB testing variant a visitor has been allocated to so the same experience is shown across visits. |
| _vidora_consent | preferences | 6 months | Memorises whether the visitor has accepted or rejected Vidora to avoid loading the SDK after a negative answer. |
Third-party domains contacted (5)
vidora.comcdn.vidora.comapi.vidora.comevents.vidora.comtwilio.com
Frequently asked questions about Vidora
Can't find your question? Write to us, we answer fast.
What cookies does Vidora set?
Vidora sets a first party cookie named _vidora_visitor that stores a persistent visitor identifier used to link behavioural events into a single profile. Depending on integration choices, the SDK can also write helper cookies for AB testing variants and to remember whether the visitor has already opted in.
Is user consent required before loading Vidora?
Yes. The SDK writes identifiers on the visitor terminal and collects behavioural data for personalisation and marketing, which falls under Article 5(3) of the ePrivacy Directive. Prior, informed and freely given consent is required before the SDK runs.
What is the legal basis for processing personal data via Vidora?
The legal basis is consent under Article 6(1)(a) of the GDPR. Vidora performs behavioural profiling and personalisation that goes beyond what a visitor would reasonably expect under legitimate interest, so an opt in is the appropriate ground.
Does Vidora transfer data outside the EU, especially to the US?
Yes. Vidora is hosted on AWS in the United States and Twilio is a US controller, so visitor identifiers and behavioural events are systematically transferred to the US. You must rely on the EU US Data Privacy Framework or Standard Contractual Clauses and run a Transfer Impact Assessment.
Is a DPIA required when using Vidora?
Yes. The combination of large scale behavioural profiling, machine learning, automated decisions and international transfers meets the criteria of Article 35 of the GDPR. A DPIA must be performed before deployment.
How do I correctly implement Vidora in a GDPR compliant way?
Load the SDK only after consent is obtained, send only the events strictly required by your use case, sign Twilios data processing agreement, document the EU US Data Privacy Framework status and provide a one click opt out that disables both the cookie and event collection.
Are there privacy friendly alternatives to Vidora?
You can use EU based personalisation platforms such as Mautic, Frosmo EU or Crownpeak EU, or build a server side recommender on top of EU hosted data warehouses. They can keep personal data inside the EEA and limit international transfers.
How should I update my cookie policy to mention Vidora?
Add a dedicated Vidora entry under the personalisation or marketing category, list the _vidora_visitor cookie, describe the events collected, identify Twilio as the controller in the United States, indicate the retention period and link to the Twilio privacy notice.
Oracle Maxymiser
Oracle Maxymiser is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Oracle Maxymiser supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Oracle Maxymiser enables informed decisions that improve experience and drive results.
Peerius
Peerius is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Peerius enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Peerius empowers marketing teams to achieve measurable growth.
Bold Brain
Bold Brain is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Bold Brain supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Bold Brain ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Nosto
Nosto is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Nosto offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Nosto empowers organizations to optimize strategy and maximize return on investment.
Geo Targetly
Geo Targetly is a mapping and geolocation service that enables websites and applications to integrate interactive maps, location search, and geographic data. It provides customizable displays, geocoding, route planning, and location-based services. Geo Targetly supports real-time tracking, store locators, and geographic analytics. With scalable APIs and extensive documentation, Geo Targetly powers location features for digital projects of any size and complexity.
RichRelevance
RichRelevance is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. RichRelevance enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, RichRelevance empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.