Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Qubit is an ecommerce personalization and experimentation platform, now part of Coveo. It tracks visitor behaviour to build profiles, run A/B tests and deliver tailored content and product experiences. Because it relies on behavioural profiling and non essential cookies, it requires consent under GDPR and the ePrivacy rules.
Qubit is an ecommerce personalization and experimentation platform, now part of Coveo. It helps online businesses tailor the customer experience by tracking how visitors behave, building visitor profiles, running A/B tests and segmentation, and serving personalized content and product experiences. Its core function is behavioural profiling and real time targeting rather than simple reporting.
Qubit installs a JavaScript tag that sets cookies and persistent identifiers to recognise visitors across sessions. It captures page views, clicks, product interactions, search behaviour and which experiment variant a user was shown. This behavioural data is linked to a visitor profile, and because it is tied to persistent identifiers it constitutes personal data under the GDPR.
The cookies and identifiers used by Qubit are not strictly necessary, so Article 5(3) of the ePrivacy Directive requires consent before they are stored or read. The profiling and experimentation also need a lawful basis under the GDPR, and for personalization the appropriate basis is the consent of the individual under Article 6(1)(a). Visitors must be told clearly that their behaviour is used for personalization and testing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent must be freely given, specific, informed and unambiguous, and Qubit should only load after the visitor accepts personalization cookies. Qubit runs on global cloud infrastructure, so data may be transferred to the United States and other third countries. These transfers require safeguards such as Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a transfer risk assessment.
Block the Qubit tag until consent is captured through a consent management platform, list its cookies in your cookie policy, and offer a simple way to withdraw consent. Sign a data processing agreement, verify the processing locations and transfer safeguards, and assess whether a Data Protection Impact Assessment is required given the scale of profiling and experimentation. Keep consent records and audit the tag regularly.
Websites using Qubit must obtain user consent under GDPR regulations.
DPIA considerations
Qubit carries out systematic behavioural profiling and experimentation across website visitors to personalize experiences. A Data Protection Impact Assessment is recommended where profiling is extensive or combined with other data. Assess the scale of tracking, the use of persistent identifiers, transfers to third countries and the effect of experimentation on individuals.
Sample consent text
We use Qubit to personalize your experience and run experiments based on your browsing behaviour. This involves cookies and profiling. Do you consent to personalization powered by Qubit?
Third-party domains contacted
qubit.comstatic.goqubit.comsse.goqubit.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _qubitTracker | HTTP cookie | Persistent (up to 1 year) | Stores a persistent visitor identifier used to recognise returning visitors and build the personalization profile. |
| qb_segments | HTTP cookie | Persistent | Stores segmentation and experiment assignment so the user sees consistent personalized experiences and test variants. |
| _qubitSession | HTTP cookie | Session | Maintains session state for behavioural tracking during a single visit. |
Qubit uses cookies for user preferences — inform visitors with a consent banner.
Qubit sets cookies and persistent identifiers through its JavaScript tag to recognise visitors across sessions. They record page views, clicks, product interactions and the experiment variant shown, feeding a visitor profile used for personalization and A/B testing.
Yes. Qubit relies on non essential cookies and behavioural profiling, so under Article 5(3) ePrivacy and Article 6(1)(a) GDPR you must obtain prior, freely given and informed consent before the tag loads.
The appropriate basis is consent under Article 6(1)(a) GDPR, combined with consent for cookie storage under Article 5(3) ePrivacy. Legitimate interest is generally not adequate for this kind of personalization and experimentation.
Qubit runs on global cloud infrastructure and is part of Coveo, so data may be transferred to the United States and other third countries. Such transfers require Standard Contractual Clauses or the EU US Data Privacy Framework plus a transfer risk assessment.
A Data Protection Impact Assessment is recommended where profiling is extensive or combined with other datasets. Qubit performs systematic profiling and experimentation, so evaluate scale, identifiers and transfers to decide whether a DPIA is mandatory.
Load Qubit only after consent through a consent management platform, document its cookies in your cookie policy, sign a data processing agreement, verify processing locations and transfer safeguards, and provide an easy way to withdraw consent.
Alternatives include other personalization and experimentation platforms, A/B testing tools and first party server side approaches with reduced tracking. Any tool that profiles visitors raises the same consent and transfer questions, so check data location and minimisation.
List the Qubit cookies and identifiers, describe their personalization and experimentation purpose, state their duration, name Qubit or Coveo as a processor, and disclose transfers outside the EEA together with the safeguards used.