Does a Yelp review widget require visitor consent?

Conditionally. The core review display serves a functional purpose and can load without consent under legitimate interest. If Yelp uses widget impression data for audience modeling in its ad platform, that requires ePrivacy consent. Sites under strict GDPR enforcement should gate the widget behind functional consent to be safe.

What does the Yelp for Business widget track?

The widget fires an impression pixel on load, recording the host page URL, business ID, and timestamp to Yelp's analytics. Click events are logged when visitors navigate to the full Yelp profile. Yelp session cookies including yelp_tracking_id and ab_sampling may be set in the yelp.com context when widget resources load.

How does ConsentStack handle the Yelp widget?

ConsentStack classifies Yelp for Business as functional with a conditional consent note. It can be configured to load freely as functional social proof, or gated behind functional consent for stricter compliance postures. Either way, ConsentStack surfaces the vendor in your cookie notice so visitors are informed of its presence and data practices.

What tracker domains does Yelp for Business use?

ConsentStack has catalogued tracker domains for Yelp for Business including yelp.com. These are the network destinations Yelp for Business's scripts contact, which a consent platform blocks until a visitor agrees.

Yelp for Business (yelp.com) - Review Widget Consent

Back to Vendor Library

Overview

Yelp for Business provides embeddable review widgets that allow businesses to showcase their Yelp ratings, review counts, and customer testimonials directly on their own websites. These widgets pull live data from Yelp's platform and are typically embedded on restaurant sites, local service provider pages, and retail storefronts. Yelp operates one of the largest local business review networks in the US and has significant presence in Canada, the UK, and Australia.

What This Script Does

Widget Rendering and Data Fetching

Loads a Yelp review badge or widget via JavaScript from yelp.com domains
Fetches the business's current Yelp rating, review count, and recent review excerpts from the Yelp API
Renders a styled embed component showing star rating, review count, and a "Read our reviews on Yelp" call-to-action
Widget assets (JavaScript, CSS) served from Yelp's CDN infrastructure

Script Files

Badge embed: https://www.yelp.com/staticmap/v2/widget/assets/js/Yelp_widget.js or equivalent badge script
API requests to api.yelp.com for live business data
Some implementations use the Yelp Fusion API with a server-side key, avoiding client-side scripts entirely

Cookies and Tracking

_ga, _gid — if Yelp's widget loads Google Analytics within its context; third-party, standard GA durations
Yelp session cookies (yelp_tracking_id, ab_sampling) — Yelp's own tracking identifiers that persist in the yelp.com cookie jar when widget resources are loaded; these may be accessible to Yelp's advertising and analytics systems
Impression tracking pixels fire when the widget loads, recording the host URL and business ID to Yelp's analytics

Data Collected and Transmitted

Widget load event: host page URL, business ID, timestamp
Click events when visitors click through to the full Yelp profile
Visitor IP address transmitted to Yelp servers (US-based)
Referrer URL passed when the visitor navigates to yelp.com

Yelp Advertising Ecosystem

Yelp runs a local advertising network where businesses can purchase sponsored placements
Impression data collected through widget loads may inform Yelp's audience modeling for its ad products
Businesses that advertise on Yelp benefit from cross-referencing widget impression data with ad campaign attribution

Consent & Compliance

Consent category: Functional

Yelp for Business widgets primarily display publicly available review content. The core widget function — rendering a business's review score — serves a legitimate business interest. Under GDPR Article 6(1)(f), displaying social proof for a local business is unlikely to override visitor privacy interests when the tracking is limited to impression events. However, if Yelp uses widget impression data for its advertising platform (audience modeling, ad attribution), this goes beyond the functional purpose and would require consent under the ePrivacy Directive. Under CCPA, widget interaction data shared with Yelp for advertising purposes could constitute "sharing" of personal information for cross-context behavioral advertising, requiring disclosure and opt-out rights.

Should You Block This Without Consent?

Conditional. The core review display is functional, but Yelp may collect impression and interaction data that feeds into its advertising ecosystem. Sites under strict GDPR enforcement should consider gating the widget behind functional consent. Under a permissive interpretation, the widget can load without consent as a functional review display, provided its presence is disclosed in the cookie notice.

Is Yelp for Business GDPR compliant?

Yelp for Business typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Yelp for Business can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Yelp for Business, not on Yelp for Business itself.

Visit website