Lucky Orange
Lucky Orange is a US conversion optimisation tool with session recordings, dynamic heatmaps, conversion funnels, polls and a chat widget.
What does Lucky Orange do?
What is Lucky Orange?
Lucky Orange is a conversion rate optimisation platform operated by Lucky Orange LLC in Overland Park, Kansas. It combines full session recordings, dynamic heatmaps that update on every interaction, scrollmaps, conversion funnels, form analytics, on site polls, surveys and a built in live chat widget. Lucky Orange is positioned as a Hotjar and Crazy Egg alternative for SMB and e-commerce websites.
What data and cookies does Lucky Orange collect?
Lucky Orange drops third party cookies on luckyorange.com (__lo_uid_*, __lotr, __lossid, __lo_persist, __lo_logged_in). The script captures mouse moves, clicks, scroll depth, form interactions (input field values are masked unless explicitly enabled), URL, referrer, user agent, viewport size, IP address and any custom variable passed to the API (email, customer ID, plan). Session recordings reconstruct the full visit as a video and can include keyboard input if masking is not configured.
GDPR and ePrivacy implications
Lucky Orange is not strictly necessary. Article 5(3) ePrivacy requires prior consent. Article 6 GDPR requires consent because session recordings produce a video of the user behaviour that goes far beyond simple analytics. European regulators (CNIL, Garante, ICO) have explicitly stated that session recording tools fall under the consent regime and that legitimate interest cannot justify their deployment.
Consent management and PII masking with Lucky Orange
Block the Lucky Orange snippet behind your CMP until consent is granted for Analytics or Performance. Enable form field masking (default in Lucky Orange settings) and add CSS class lo-block on any element containing personal data. Exclude sensitive URLs (account, billing, password reset) from recording. Pair Lucky Orange with a clear privacy notice and provide an opt out link.
Data transfers and US safeguards
Lucky Orange LLC processes data on AWS in the United States. EU personal data is transferred outside the EEA. Transfers rely on the Lucky Orange DPA, EU SCCs and the EU US Data Privacy Framework when Lucky Orange is certified. Document the mechanism in your records of processing activities and inform users in your privacy notice.
Practical compliance checklist
Sign the Lucky Orange DPA with EU SCCs. Block the snippet behind your CMP. Enable input masking and lo-block CSS classes. Exclude sensitive URLs. Limit recording retention to 30 to 90 days. Categorise __lo_* cookies as Analytics. Identify Lucky Orange LLC as processor with US transfer disclosure. Provide a clear opt out link.
Lucky Orange and the GDPR
Lucky Orange is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (article 6(1)(a) GDPR) combined with article 5(3) ePrivacy. Session recordings and heatmaps go far beyond what is strictly necessary.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, TTDSG, LOPDGDD, French Data Protection Act, UK GDPR and PECR, CCPA and CPRA
Impact assessment (DPIA)
A DPIA is recommended when Lucky Orange records authenticated areas, when recordings can capture personal data, when retention exceeds 90 days, when the site is in a sensitive vertical (health, finance, minors), or when the chat widget collects identifiers.
Sample text for your banner
We use Lucky Orange to record anonymous sessions and produce heatmaps of how visitors interact with our website. Lucky Orange drops cookies on your device and sends data to its US infrastructure. Without your consent, no recording is started.
What Lucky Orange sets and contacts
- Tracking method
- JavaScript snippet with third party cookies, session recordings, heatmaps, dynamic heatmaps, conversion funnels, chat widget and polls
- Server location
- United States (Lucky Orange LLC, Overland Park Kansas, AWS US)
- Data transferred outside the EU
- Lucky Orange LLC is based in Overland Park, Kansas and processes data on AWS infrastructure in the United States. EU personal data is transferred outside the EEA. Transfers rely on EU SCCs and on the EU US Data Privacy Framework when Lucky Orange is certified.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __lo_uid_* | Analytics | 1 year | Persistent Lucky Orange unique visitor identifier (account specific) used to recognise returning visitors across sessions. |
| __lotr | Analytics | 30 days | Stores the Lucky Orange recording state for the current visitor and avoids double recording. |
| __lossid | Analytics | Session | Lucky Orange session identifier used to bind events to the same visit. |
| __lo_persist | Analytics | 1 year | Persistent Lucky Orange state cookie used to remember the visitor settings (chat opened, polls dismissed). |
| __lo_logged_in | Analytics | Session | Indicates whether the Lucky Orange account user is logged into the dashboard. Set on luckyorange.com. |
Third-party domains contacted (5)
luckyorange.comluckyorange.netsettings.luckyorange.netcs.luckyorange.netupload.luckyorange.net
Frequently asked questions about Lucky Orange
Can't find your question? Write to us, we answer fast.
What cookies does Lucky Orange set?
Lucky Orange drops third party cookies on luckyorange.com: __lo_uid_* (unique visitor), __lotr (recording state), __lossid (session ID), __lo_persist (persistent state), __lo_logged_in (account state). The exact list depends on which Lucky Orange features are enabled.
Is consent required for Lucky Orange?
Yes. Session recordings and heatmaps are not strictly necessary. Article 5(3) ePrivacy and article 6 GDPR require prior, opt in consent before the script executes.
What is the legal basis for Lucky Orange?
Consent (article 6(1)(a) GDPR). Legitimate interest is rejected by EU regulators for session recording tools.
What about transfers to the United States?
Lucky Orange LLC processes data on AWS US. Transfers rely on the Lucky Orange DPA, EU SCCs and the EU US Data Privacy Framework when Lucky Orange is certified.
Do I need a DPIA for Lucky Orange?
A DPIA is recommended whenever recordings cover authenticated areas, can capture personal data, retention exceeds 90 days, or the site is in a sensitive vertical.
How do I implement Lucky Orange compliantly?
Block the snippet behind your CMP. Enable input masking by default. Add lo-block classes on sensitive fields. Exclude sensitive URLs. Limit retention. Sign the Lucky Orange DPA with EU SCCs.
What are the alternatives to Lucky Orange in Europe?
Hotjar (US with EU hosting option), Contentsquare (Paris, EU), Mouseflow (Denmark), Smartlook (Czech), Plerdy (Ukraine), Microsoft Clarity (US, free) or self hosted rrweb.
How do I document Lucky Orange in my cookie policy?
List __lo_uid_*, __lotr, __lossid, __lo_persist, __lo_logged_in with domain, duration and purpose. Identify Lucky Orange LLC as processor with the US transfer disclosure. Link to the Lucky Orange privacy policy and opt out page.
Tealium AudienceStream
Tealium AudienceStream is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tealium AudienceStream supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tealium AudienceStream ensures your website delivers a smooth, uninterrupted experience to every visitor and.
AvidTrak
AvidTrak is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. AvidTrak supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, AvidTrak enables informed decisions that improve experience and drive results.
BlueConic
BlueConic is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. BlueConic offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, BlueConic empowers organizations to optimize strategy and maximize return on investment.
LeadBoxer
LeadBoxer is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. LeadBoxer supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, LeadBoxer enables informed decisions that improve experience and drive results.
Repro
Repro is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Repro offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Repro empowers organizations to optimize strategy and maximize return on investment.
Elevar
Elevar is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Elevar supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Elevar enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.