Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Loox is a product reviews and user generated content app for online stores, widely used on Shopify. It collects photo and text reviews from customers and displays review widgets on product pages, and it sends automated emails to request reviews after purchase. The storefront widget can set cookies and process the visitor IP and device information, while the review collection handles customer personal data, so consent and clear information are needed on European stores.
Loox is a reviews and user generated content app for online stores, most commonly installed on Shopify. It gathers photo and video reviews from customers, displays them in widgets on product pages, and automates the request for reviews by email after a purchase, helping merchants build social proof.
On the storefront, the Loox widget can set cookies and process the visitor IP and device information to display and measure reviews. On the collection side, Loox processes customer personal data, including names, email addresses, order details, and the photos and text customers submit, which is more sensitive than the storefront widget alone.
The widget cookies fall under the ePrivacy Directive, and the customer data and review photos are personal data under the GDPR. Sending review request emails is a processing activity that needs a lawful basis, and photos can reveal more than expected, so transparency and a clear basis are important.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Non essential widget cookies should wait for consent. Review request emails to existing customers can sometimes rely on legitimate interest or the soft opt in, but you must offer an easy way to object, and reviewers should understand that their name and photo may be published. Configure the widget so tracking cookies are not set before consent.
Loox is based in Israel, which has an EU adequacy decision, and uses cloud infrastructure that can include the United States. United States processing relies on the EU US Data Privacy Framework or on Standard Contractual Clauses. Confirm where review data and photos are stored.
Gate non essential widget cookies behind consent, set a lawful basis for review request emails with an opt out, and sign a data processing agreement with Loox. Tell reviewers how their content will be used, set retention for review data, and describe Loox in your cookie policy and privacy notice.
Websites using Loox must obtain user consent under GDPR regulations.
DPIA considerations
Loox processes customer names, emails, photos, and review content, and its widget can track storefront visitors. Assess the lawful basis for review request emails, the handling of photos, the widget cookies, and the transfers outside the EEA.
Sample consent text
We use Loox to show customer reviews and photos. The Loox widget may set cookies to display and measure reviews. Non essential cookies run only after you accept them.
Third-party domains contacted
loox.ioloox.appcdn.loox.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __loox | Analytics | 1 year | Identifies a visitor so that review widgets can be displayed and their interaction measured. |
| loox_session | Functional | Session | Maintains the review widget state during the visit. |
| loox_uid | Analytics | 1 year | Stores an identifier used to attribute review interactions and referrals. |
Loox uses cookies for user preferences — inform visitors with a consent banner.
The Loox storefront widget can set a visitor identifier and analytics cookies to display review widgets and measure interaction, plus a session value. The analytics cookies are not strictly necessary, so they belong in the analytics category of your banner.
You need consent for the non essential widget cookies. The review collection itself, including emails and photos, is processed under a separate lawful basis, but tracking cookies on the storefront require prior consent under the ePrivacy Directive.
Consent under Article 6(1)(a) of the GDPR covers the tracking cookies. Review request emails to existing customers may rely on legitimate interest or the soft opt in, and publishing a review relies on the basis you set out to the reviewer.
Loox is based in Israel, which has an EU adequacy decision, and may use cloud infrastructure in the United States. United States processing relies on the EU US Data Privacy Framework or Standard Contractual Clauses.
A targeted assessment is useful because Loox handles customer photos and contact details. Document the review data collected, how photos are used and stored, the retention, and the transfers.
Gate the widget tracking cookies behind consent, set a lawful basis and opt out for review request emails, sign a data processing agreement, and tell reviewers how their content will appear. Disclose Loox in your privacy notice and cookie policy.
Alternatives include Judge.me, Okendo, Yotpo, and Stamped. Some offer EU hosting or lighter tracking, so compare their data handling and transfer arrangements.
List the Loox cookies with their purpose and duration, label the analytics ones accordingly, name Loox as the recipient, and describe where review data is stored and any transfers. Update it when you change the widget settings.