Trustpilot

Overview

Trustpilot is a consumer review platform used by over 700,000 businesses worldwide to collect and display customer ratings. Businesses embed Trustpilot widgets on product pages, homepages, and checkout flows to display aggregate star ratings and individual reviews as social proof. The widget loads live data from Trustpilot's platform. Trustpilot is headquartered in Copenhagen, Denmark, and London, UK — making it an EU-origin service with simpler data transfer considerations than US-headquartered equivalents.

What This Script Does

Widget Rendering and Content Delivery

• Embeds a TrustBox widget (Trustpilot's term for its review display components) showing the business's aggregate TrustScore, star rating, total review count, and recent review excerpts
• Widget assets are loaded from widget.trustpilot.com and Trustpilot's CDN at cdn.trustpilot.net
• Script file: https://widget.trustpilot.com/bootstrap/<version>/tp.widget.bootstrap.min.js
• The widget renders within a sandboxed iframe served from Trustpilot's domain

Impression and Interaction Tracking

• Fires an impression event to Trustpilot's analytics endpoint when the widget enters the viewport (using an Intersection Observer)
• Records click events when visitors click through to read the full Trustpilot business profile
• Tracks widget load performance metrics

Cookies Set

• No cookies are set on the host website's first-party domain by the Trustpilot widget directly
• Within the Trustpilot iframe context: session identifiers may be set on trustpilot.com to track widget impressions across the Trustpilot network
• _ga and _gid — if Trustpilot uses Google Analytics internally within the widget iframe; scoped to trustpilot.com

Data Collected and Transmitted

• Widget impression events (page URL, business unit ID) sent to api.trustpilot.com
• Click-through events with referrer URL
• Visitor IP address and user agent transmitted to Trustpilot servers (hosted in EU/UK)

Business Reviews API

• Live review data is fetched from api.trustpilot.com/v1/business-units/<id>/reviews on each widget load
• Review data is public (published on Trustpilot.com) and does not constitute personal data processing of the site visitor

Consent & Compliance

Consent category: Functional

Trustpilot widgets display publicly available business review data. The impression tracking is minimal: it records that a widget was shown on a given URL, not persistent visitor behavior. Under GDPR, the legitimate interest basis (Article 6(1)(f)) is appropriate — displaying social proof for a commercial service is a legitimate interest that does not materially impact visitor privacy rights. The ePrivacy Directive is less clearly triggered since no cookies are set on the host domain. Under CCPA, the widget does not constitute a sale or sharing of personal information. Being EU-headquartered, Trustpilot does not trigger GDPR international transfer concerns.

Should You Block This Without Consent?

No. Trustpilot widgets display public review data as social proof with negligible tracking impact. No cookies are set on the host domain, impression data is minimal, and the service is EU-based. The widget does not require consent under a proportionate analysis, though disclosure in the site's privacy policy is recommended.