Do Trustpilot review widgets require visitor consent?

No. Trustpilot widgets display publicly available business review data with minimal tracking impact. No cookies are set on the host website's domain, impression data is limited to the widget URL and business ID, and Trustpilot is headquartered in the EU, eliminating international data transfer concerns under GDPR.

What does the Trustpilot widget load and track?

The TrustBox widget loads from widget.trustpilot.com and cdn.trustpilot.net, rendering star ratings and review counts inside a sandboxed iframe. It fires an impression event to api.trustpilot.com when the widget enters the viewport, recording the host page URL and business unit ID. No host-domain cookies are set.

How does ConsentStack handle Trustpilot on my site?

ConsentStack classifies Trustpilot as functional and allows it to load without a consent gate. It appears in your ConsentStack vendor audit and cookie notice disclosure so visitors are informed of its presence. Because no host-domain cookies are set and tracking is minimal, it does not require active consent management.

What tracker domains does Trustpilot use?

ConsentStack has catalogued tracker domains for Trustpilot including trustpilot.com. These are the network destinations Trustpilot's scripts contact, which a consent platform blocks until a visitor agrees.

Trustpilot - Review Widget Cookies & Consent Profile

Back to Vendor Library

Overview

Trustpilot is a consumer review platform used by over 700,000 businesses worldwide to collect and display customer ratings. Businesses embed Trustpilot widgets on product pages, homepages, and checkout flows to display aggregate star ratings and individual reviews as social proof. The widget loads live data from Trustpilot's platform. Trustpilot is headquartered in Copenhagen, Denmark, and London, UK — making it an EU-origin service with simpler data transfer considerations than US-headquartered equivalents.

What This Script Does

Widget Rendering and Content Delivery

Embeds a TrustBox widget (Trustpilot's term for its review display components) showing the business's aggregate TrustScore, star rating, total review count, and recent review excerpts
Widget assets are loaded from widget.trustpilot.com and Trustpilot's CDN at cdn.trustpilot.net
Script file: https://widget.trustpilot.com/bootstrap/<version>/tp.widget.bootstrap.min.js
The widget renders within a sandboxed iframe served from Trustpilot's domain

Impression and Interaction Tracking

Fires an impression event to Trustpilot's analytics endpoint when the widget enters the viewport (using an Intersection Observer)
Records click events when visitors click through to read the full Trustpilot business profile
Tracks widget load performance metrics

Cookies Set

No cookies are set on the host website's first-party domain by the Trustpilot widget directly
Within the Trustpilot iframe context: session identifiers may be set on trustpilot.com to track widget impressions across the Trustpilot network
_ga and _gid — if Trustpilot uses Google Analytics internally within the widget iframe; scoped to trustpilot.com

Data Collected and Transmitted

Widget impression events (page URL, business unit ID) sent to api.trustpilot.com
Click-through events with referrer URL
Visitor IP address and user agent transmitted to Trustpilot servers (hosted in EU/UK)

Business Reviews API

Live review data is fetched from api.trustpilot.com/v1/business-units/<id>/reviews on each widget load
Review data is public (published on Trustpilot.com) and does not constitute personal data processing of the site visitor

Consent & Compliance

Consent category: Functional

Trustpilot widgets display publicly available business review data. The impression tracking is minimal: it records that a widget was shown on a given URL, not persistent visitor behavior. Under GDPR, the legitimate interest basis (Article 6(1)(f)) is appropriate — displaying social proof for a commercial service is a legitimate interest that does not materially impact visitor privacy rights. The ePrivacy Directive is less clearly triggered since no cookies are set on the host domain. Under CCPA, the widget does not constitute a sale or sharing of personal information. Being EU-headquartered, Trustpilot does not trigger GDPR international transfer concerns.

Should You Block This Without Consent?

No. Trustpilot widgets display public review data as social proof with negligible tracking impact. No cookies are set on the host domain, impression data is minimal, and the service is EU-based. The widget does not require consent under a proportionate analysis, though disclosure in the site's privacy policy is recommended.

Is Trustpilot GDPR compliant?

Trustpilot typically loads analytics and functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Trustpilot can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Trustpilot, not on Trustpilot itself.

Visit website

Consent Categories

Functional

Also Known As

trustpilot widget GDPRtrustpilot cookiestrustpilot embed consentreview widget privacytrustpilot tracking

Industries

Computers Electronics and Technology

Tracked Domains (1)

Trustpilot's trackers are occasionally seen, seen on about 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

trustpilot.comAnalytics

trustpilot.com is an analytics domain operated by Trustpilot, used to measure visits, sessions, and on-site behavior. Seen on about 1% of scanned sites.