Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Lumit is an analytics and advertising tool embedded on websites to measure traffic and support marketing. In a standard deployment it sets analytics and advertising cookies and may use device identifiers and tracking pixels to build audiences. Because these are non essential technologies, prior consent and careful handling of any third country transfers are central to compliant use.
Lumit is an analytics and advertising tool that website operators embed to measure how visitors use their site and to support marketing activities. In a standard deployment it loads a tag or script that collects usage data and may help build audiences for advertising. Tools in this category are deployed by adding a snippet of code to the pages of a website.
Typically the tool sets analytics and advertising cookies and may rely on device identifiers, pixels and similar technologies. It commonly processes data such as IP address, device and browser information, pages viewed and interaction events, and in advertising scenarios it may combine this with audience or conversion signals. These are non essential technologies rather than functions needed to display the site.
Reading or writing analytics and advertising cookies on a user device requires consent under Article 5(3) of the ePrivacy Directive, and the data collected is personal data under the GDPR. The website operator is the controller and must define the lawful basis, inform users clearly and ensure that data subject rights can be exercised, including in respect of any profiling.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the cookies are non essential, prior, informed and freely given consent must be collected before the tag fires, and it must be as easy to withdraw as to give. The tool should be blocked by a consent management platform until the visitor agrees, and analytics or advertising must not run by default on the basis of legitimate interest.
Analytics and advertising vendors frequently process data outside the EEA, including in the United States. Where that happens, a valid transfer mechanism is required, namely reliance on the EU US Data Privacy Framework where the vendor is certified, or Standard Contractual Clauses supported by a transfer impact assessment and supplementary measures. Confirm with the vendor where data is stored and who acts as subprocessor.
Inventory every cookie and identifier the tag sets, gate it behind a consent banner, sign a data processing agreement, confirm and document the transfer safeguards and update your privacy and cookie notices. Consider data minimisation options such as IP truncation or shorter retention, and review the configuration whenever the vendor changes its features.
Websites using Lumit must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable where the tool is used for advertising, audience building or cross site tracking, since this can amount to large scale monitoring and profiling. Assess the data categories and identifiers collected, any combination with other sources, the third country transfer risk and the measures available to limit data and retention.
Sample consent text
With your consent we use analytics and advertising cookies from Lumit to understand how our site is used and to support our marketing. These are not essential and may involve transfers outside the European Economic Area. You can accept, reject or manage them at any time.
Third-party domains contacted
lumit.iocdn.lumit.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| lumit_id | Analytics | Up to 1 year | Assigns a pseudonymous identifier to measure visits and usage, set only after consent |
| lumit_session | Analytics | Session | Groups page views into a single visit for measurement, set only after consent |
| lumit_ads | Marketing | Up to 1 year | Supports audience building and advertising measurement, set only after consent |
Lumit uses cookies for user preferences — inform visitors with a consent banner.
In a standard deployment it sets analytics cookies to measure visits and usage and, where advertising is enabled, marketing cookies for audience building. These are non essential and may be accompanied by device identifiers or pixels, all of which should load only after consent.
Yes. As an analytics and advertising tool its cookies and identifiers are non essential, so prior consent is required under Article 5(3) of the ePrivacy Directive before the tag fires.
Consent is the appropriate legal basis under the GDPR and the ePrivacy Directive for analytics and advertising cookies. Legitimate interest is not a valid basis for storing or reading these non essential cookies on a device.
It may. Analytics and advertising vendors often process data outside the EEA, including in the United States, which requires the EU US Data Privacy Framework or Standard Contractual Clauses with a transfer impact assessment. Confirm the data location with the vendor.
A DPIA is advisable where the tool supports advertising, audience building or cross site tracking, since this can amount to large scale monitoring and profiling of website visitors.
Block the tag with a consent management platform until consent is given, inventory its cookies and identifiers, sign a data processing agreement, document the transfer safeguards and update your privacy and cookie notices.
Privacy focused or EEA hosted analytics tools, and cookieless or aggregated measurement solutions, can reduce both the consent burden and third country transfer exposure.
List each Lumit cookie and identifier with its purpose and duration, classify them as analytics or marketing, describe any transfer outside the EEA and keep the entries aligned with what your consent banner controls.