Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Adloox is a French ad verification, viewability and brand-safety measurement company that injects a JavaScript tag into ad creatives or publisher pages to measure impression viewability, detect invalid traffic and score brand-safety context. It processes impression-level data including IP address, user-agent, page URL and ad slot geometry. Processing is EU-based with no routine third-country transfers. Consent is required under the ePrivacy Directive because Adloox accesses the user terminal, even though the primary purpose is ad measurement rather than targeting.
Adloox is a French ad verification, viewability measurement and brand-safety company whose JavaScript tag is injected into ad creatives or publisher pages by the ad server at impression time. When an ad loads, the Adloox script (served from adlooxtracking.com or j.adlooxtracking.com) measures how long the ad unit remains in the user's viewport and what percentage of the creative is visible, producing a viewability score compliant with IAB and MRC standards. Simultaneously, the tag analyses page context for brand-safety classification (detecting whether the ad appears alongside harmful or brand-inappropriate content) and collects signals for invalid traffic (IVT) detection to identify bot, proxy and fraud-driven impressions.
Unlike behavioural advertising trackers, Adloox does not build persistent cross-site user profiles for targeting purposes. Its processing is focused on impression-level measurement: determining whether a specific ad in a specific context was seen by a real human. Adloox is a French company and processes data on EU infrastructure, which distinguishes it from US-based measurement vendors and simplifies the international transfer analysis.
Adloox processes the following data at impression level: IP address (used for geolocation and IVT detection), user-agent string (browser and OS identification for IVT scoring), page URL and referrer (for brand-safety context classification), ad slot dimensions and position in the viewport, time-in-view measurements, and a session or impression identifier. Adloox may set cookies on adlooxtracking.com to correlate measurement data across a session. These cookies do not carry cross-site behavioural profiles and are not used for personalised advertising.
The IP address processed by Adloox constitutes personal data under GDPR, meaning all Adloox processing must comply with GDPR's lawfulness, purpose limitation and data minimisation principles. The ePrivacy Directive Article 5(3) requires prior consent before storing or reading any information on the user's terminal, including the Adloox measurement cookie, unless a strictly necessary exemption applies. Ad measurement cookies are generally not considered strictly necessary for a service explicitly requested by the user, so consent or a robust legitimate interest analysis is required. The risk level is medium rather than high because Adloox does not engage in behavioural profiling for targeting.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Publishers have two practical options for the legal basis. First, they can collect consent via a TCF v2.2-certified CMP, listing Adloox as a vendor under Purpose 7 (measure ad performance). This is the safest approach and removes any ambiguity about the lawfulness of terminal access. Second, some publishers rely on a legitimate interest analysis for ad measurement tools that do not engage in behavioural profiling; however, this approach remains contested under national ePrivacy implementations and is not recommended without legal advice specific to the publisher's jurisdiction. Collecting consent is the recommended approach for all EU markets.
Adloox is a French company and processes ad verification data on EU infrastructure. There are no routine transfers of personal data outside the EEA for core viewability, brand-safety and IVT measurement processing. This distinguishes Adloox from many US-based ad technology vendors and means that the complex international transfer analysis required for services relying on SCCs or DPF is not needed for Adloox's core measurement functions. Publishers should nonetheless verify the current data processing terms with Adloox and ensure a Data Processing Agreement (DPA) is in place.
To deploy Adloox in a GDPR and ePrivacy-compliant manner, publishers should: (1) sign a Data Processing Agreement with Adloox covering the processing scope, retention periods and data subject rights; (2) collect consent via a TCF v2.2-certified CMP with Adloox listed under Purpose 7, or conduct and document a legitimate interest assessment if pursuing that route; (3) update the cookie policy to describe Adloox cookies, their purpose and the absence of cross-site targeting use; (4) conduct a privacy threshold assessment to determine whether a full DPIA is required given the scale of impressions processed; (5) implement IP address truncation or anonymisation where technically feasible; and (6) maintain ROPA entries covering Adloox as a data processor.
Websites using Adloox Ad Verification must obtain user consent under GDPR regulations.
DPIA considerations
A lightweight Data Protection Impact Assessment review is recommended before deploying Adloox, though the mandatory DPIA threshold under GDPR Article 35(3) is less clearly triggered than for behavioural advertising services. Adloox processes impression-level data (IP address, user-agent, page URL, ad slot metrics) to measure viewability and detect invalid traffic; it does not build user-level behavioural profiles for targeting. The DPIA or privacy threshold assessment must document: (1) the categories of data processed (IP address, user-agent, page URL, ad geometry), their retention periods and the absence of user-level profiling; (2) the legal basis for cookie access (ePrivacy Directive Article 5(3) and IAB TCF v2.2 Purpose 7 considerations); (3) EU data residency and the absence of third-country transfers for core processing; (4) whether any IP address processing constitutes personal data and what anonymisation or truncation measures apply; (5) data subject rights mechanisms; and (6) the contractual relationship with Adloox as a data processor under a DPA. The DPO should review and confirm whether a full DPIA is required based on the actual scale and nature of processing in the specific publisher context.
Sample consent text
We use Adloox, an ad verification service provided by Adloox (France), to measure whether advertisements displayed on this website are viewed by real users, to detect advertising fraud and to assess whether ad placements appear in brand-safe contexts. Adloox processes technical data including your IP address and browser information for measurement purposes only and does not use this data for personalised advertising. Adloox processes data on EU infrastructure. This processing involves accessing information on your device and is based on your consent. You can withdraw your consent at any time via our privacy settings.
Third-party domains contacted
adloox.comadlooxtracking.comj.adlooxtracking.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| adloox_sid | session | Session | Session identifier used by Adloox to correlate viewability measurement calls within a single browsing session |
| adloox_uid | persistent | 7 days | Short-lived impression correlation identifier set by Adloox on adlooxtracking.com to associate viewability and IVT signals across consecutive ad loads |
| adl_slot | session | Session | Ad slot geometry and viewport position data holder used during in-session viewability computation by the Adloox measurement script |
| adloox_bs | persistent | 30 days | Brand-safety context classification score cache stored by Adloox to avoid redundant page-context analysis on repeat visits to the same URL |
Adloox Ad Verification places tracking cookies for advertising — comply with GDPR using FlowConsent.
Adloox may set session and short-lived persistent cookies on the adlooxtracking.com and j.adlooxtracking.com domains to correlate viewability measurement data across an ad session. These cookies typically carry a session or impression identifier and do not contain cross-site behavioural profiles or targeting data. The cookies are used solely for ad verification purposes: measuring time-in-view, viewport position and correlating measurement calls within the same session. Their duration is generally short (session or a few days) compared to behavioural advertising cookies.
Yes, consent is required under the ePrivacy Directive because Adloox accesses or stores information on the user's terminal device via its measurement cookies, regardless of whether the purpose is behavioural advertising or ad measurement. The strictly necessary exemption does not cover ad verification cookies. Under GDPR, processing of the IP address (a personal data element) also requires a valid legal basis. Publishers should collect consent via a TCF v2.2-certified CMP with Adloox listed under Purpose 7 (measure ad performance).
For cookie access: ePrivacy Directive Article 5(3) requires consent or a strictly necessary exemption, and consent is recommended. For personal data processing under GDPR: consent (Article 6(1)(a)) is the safest basis; legitimate interest (Article 6(1)(f)) may be available for impression-level ad measurement that does not involve behavioural profiling, provided a documented balancing test confirms the publisher's interest outweighs the user's privacy interest. IAB TCF v2.2 Purpose 7 accommodates ad measurement and may be declared under consent or legitimate interest depending on vendor configuration.
No. Adloox is a French company and processes ad verification data on EU infrastructure. There are no routine transfers of personal data to the United States or other third countries for core viewability, brand-safety and invalid traffic detection functions. This is a key compliance advantage compared to US-based ad verification vendors. Publishers should nonetheless review Adloox's current data processing agreement to confirm this position has not changed, particularly if Adloox uses any US-based cloud infrastructure or sub-processors.
A full mandatory DPIA under GDPR Article 35 is unlikely to be triggered by Adloox alone, as it does not engage in systematic large-scale profiling for targeting purposes. However, a privacy threshold assessment is recommended to confirm this conclusion for the specific deployment context. If Adloox is one of many ad technology tools deployed alongside behavioural advertising services, the cumulative impact should be assessed in the overall DPIA for the publisher's ad stack. A Data Processing Agreement with Adloox is required regardless.
Compliant deployment requires: signing a Data Processing Agreement with Adloox; integrating a TCF v2.2-certified CMP with Adloox listed under Purpose 7 and consent collected before the Adloox tag fires; updating the privacy policy and cookie notice to describe Adloox cookies, their ad-verification purpose and the absence of cross-site targeting; implementing IP address anonymisation or truncation where feasible; conducting a privacy threshold assessment; and maintaining ROPA entries for Adloox as a data processor.
Alternative ad verification and viewability measurement providers include Integral Ad Science (IAS), DoubleVerify and Moat (Oracle), all of which are US-based and involve cross-border transfers. For publishers seeking EU-only processing, Adloox is one of the few European alternatives. Publishers can also use publisher-side viewability measurement via the IAB Viewability API (IntersectionObserver) without any third-party tag, eliminating the ePrivacy consent requirement for the measurement function entirely.
The cookie policy must include an entry for the Adloox measurement cookie describing: the domain (adlooxtracking.com), the cookie's short duration (session or a few days), its purpose (ad viewability measurement, brand-safety scoring and invalid traffic detection), the controller (Adloox, France), the fact that data is processed on EU infrastructure with no US transfers, and the user's right to withdraw consent. The entry should explicitly state that the cookie is not used for behavioural targeting or cross-site user profiling.