FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Personalization

Bloomreach Discovery

Analytics

Bloomreach Discovery is the AI driven product discovery suite of Bloomreach Inc., combining search, merchandising and recommendations for e-commerce. The platform writes the persistent _br_uid_2 cookie to identify returning visitors and feed its personalisation engine. Because the cookie supports behavioural profiling and the data flows through US infrastructure, deployments in the European Economic Area must collect consent and address Schrems II obligations.

Block Bloomreach Discovery until consentScan my site
Overview

What does Bloomreach Discovery do?

What Bloomreach Discovery is and how it works

Bloomreach Discovery is the AI driven product discovery suite published by Bloomreach Inc., a software vendor with offices in Mountain View, California, and Bratislava, Slovakia. It combines search, merchandising and recommendations for e-commerce sites and exposes a JavaScript pixel and a server side API. When a visitor searches a catalogue, clicks a product or adds an item to the basket, the pixel sends the event to the Bloomreach Discovery API, where machine learning models combine the data with the merchant catalogue to rank, filter and personalise the results.

Cookies and personal data collected

The signature cookie is _br_uid_2, a first party cookie that stores a stable visitor identifier with a lifetime of one year. Bloomreach Discovery also stores session metadata, the truncated IP address, the user agent, the page URL, the referrer and the full sequence of search queries and clicks. When the merchant pushes a logged in user identifier, Bloomreach can stitch the anonymous visitor profile to the customer record, which deepens the personalisation but also turns the data set into clearly identified personal data.

GDPR and ePrivacy implications

The _br_uid_2 cookie is not strictly necessary because behavioural profiling is not required to deliver a basic search service. Article 5(3) of the ePrivacy Directive therefore requires consent before the cookie is set. Articles 13 and 14 of GDPR require a transparent privacy notice that names Bloomreach, lists the data categories, the retention period and the data subject rights. Article 22 GDPR also applies when the recommendation engine produces decisions with legal or significant effects.

International data transfers and Schrems II

Bloomreach Inc. is a US controller subject to FISA 702 and Executive Order 14086. EU customers can request the EU pod, but US support staff retain access to the data. Transfers rely on the EU US Data Privacy Framework where Bloomreach Inc. is self certified, complemented by Standard Contractual Clauses for residual flows. European controllers must perform a Transfer Impact Assessment and document supplementary measures such as encryption with EU based keys and pseudonymisation of customer identifiers.

Compliance steps for an EU friendly Bloomreach deployment

Block the Bloomreach Discovery pixel behind your Consent Management Platform until the visitor accepts the personalisation category. Request the EU pod assignment, sign a Data Processing Agreement and Standard Contractual Clauses, document supplementary measures, run a Transfer Impact Assessment and document the retention period of the _br_uid_2 cookie. List Bloomreach Inc. in the privacy notice and offer a clear opt out mechanism even after consent has been granted.

Compliance

Bloomreach Discovery and the GDPR

Bloomreach Discovery is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive) for the Bloomreach _br_uid_2 cookie and the click and search analytics that fuel personalisation. The visitor identifier persists across sessions and is used for behavioural profiling, which is not strictly necessary to deliver a search service.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive (2002/58/EC), national ePrivacy implementations (CNIL guidelines on personalisation in France, TTDSG/TDDDG in Germany, LSSI and LOPDGDD in Spain), EDPB Guidelines 03/2022 on consent, Schrems II case law for US transfers, EU US Data Privacy Framework, EDPB Guidelines on profiling

Impact assessment (DPIA)

Bloomreach Discovery profiles visitors through their search and click behaviour to drive merchandising. Combined with US transfers and a long lived visitor identifier, the processing meets several criteria of Article 35 GDPR. A DPIA should describe the consent flow, the categories of data, the retention period of the _br_uid_2 cookie, the access of US support staff and the supplementary measures applied for Schrems II compliance.

Sample text for your banner

We use Bloomreach Discovery to personalise the products and search results displayed on this site. With your consent, your searches, clicks and product views are sent to Bloomreach Inc. on infrastructure in the European Union or the United States to power AI driven recommendations. You can withdraw your consent at any time from the cookie preferences link.
Cookies and trackers

What Bloomreach Discovery sets and contacts

Tracking method
JavaScript pixel and server side API. Bloomreach Discovery captures clicks, search queries, product views, add to cart and conversion events to feed its AI driven search, merchandising and recommendations.
Server location
United States (primary) and European Union (secondary), Bloomreach Inc. operates regional pods including a US pod and an EU pod hosted on Amazon Web Services. EU customers can request an EU pod assignment.
Data transferred outside the EU
Bloomreach Inc. is incorporated in California and operates support and engineering teams in the United States. Even when the customer is provisioned on the EU pod, US support staff may access the data on a need to know basis. Transfers rely on the EU US Data Privacy Framework where Bloomreach is self certified, complemented by Standard Contractual Clauses for residual flows.

Cookies set (3)

NameTypeDurationPurpose
_br_uid_2first_party1 yearStores the persistent visitor identifier used by Bloomreach Discovery to deliver search relevance and AI personalisation.
_br_sessionfirst_partySessionStores the session identifier used to correlate search queries, clicks and conversions during a single visit.
_br_consentfirst_party1 yearStores the visitor consent state for the Bloomreach Discovery analytics and personalisation cookies.

Third-party domains contacted (4)

  • bloomreach.com
  • br-data.com
  • bltcdn.com
  • bloomreach.co
Questions

Frequently asked questions about Bloomreach Discovery

Can't find your question? Write to us, we answer fast.

Which cookies does Bloomreach Discovery write?

The signature cookie is _br_uid_2, a first party cookie with a one year lifetime that stores a stable visitor identifier. Bloomreach Discovery also stores a session cookie and uses local storage to keep the search history and the personalisation context.

Do I need consent before the Bloomreach Discovery pixel loads?

Yes. The _br_uid_2 cookie is not strictly necessary because behavioural profiling is not required to deliver a basic search service. Article 5(3) of the ePrivacy Directive requires a freely given, specific, informed and unambiguous consent before the pixel can load.

What is the legal basis for processing data through Bloomreach Discovery?

The legal basis is consent under Article 6(1)(a) GDPR for the personalisation engine. Article 22 GDPR also applies when the recommendations produce decisions with legal or significant effects, in which case the controller must put in place safeguards such as human review and the right to obtain an explanation.

Are data transferred to the United States?

Yes. Bloomreach Inc. is a US controller and even when the customer is provisioned on the EU pod, US support staff retain access to the data. Transfers rely on the EU US Data Privacy Framework where Bloomreach is self certified, complemented by Standard Contractual Clauses for residual flows.

Do I need a DPIA for Bloomreach Discovery?

A DPIA is recommended because the platform combines large scale behavioural profiling, US transfers and a long lived visitor identifier. Cover the consent flow, the categories of data, the retention period of the _br_uid_2 cookie, the access of US support staff and the supplementary measures applied for Schrems II compliance.

How do I implement Bloomreach Discovery in a fully compliant way?

Block the pixel behind a Consent Management Platform such as FlowConsent until the visitor accepts the personalisation category. Request the EU pod assignment, sign a Data Processing Agreement and Standard Contractual Clauses, document supplementary measures, run a Transfer Impact Assessment and provide an opt out link in the privacy notice.

What are the alternatives to Bloomreach Discovery?

Common alternatives include Algolia, Klevu, Coveo, Lucidworks Fusion, Constructor.io, Searchspring, Doofinder, Sitecore Personalize and self hosted Elasticsearch with custom personalisation. Each has different feature sets, pricing and hosting regions, so map your use case before switching.

How should I update my cookie policy when I deploy Bloomreach Discovery?

List _br_uid_2 with its purpose and one year duration, document Bloomreach Inc. as a processor with a US headquarters, reference the EU US Data Privacy Framework and Standard Contractual Clauses, link to the Bloomreach privacy notice and provide a clear consent management link with a working revocation flow.

Same category

More services: Personalization

See the whole category

Target2Sell

Target2Sell is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Target2Sell provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Target2Sell helps deliver the right message to the right audience at the right time.

Preferences

Pickzen

Pickzen is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Pickzen supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Pickzen enables informed decisions that improve experience and drive results.

Analytics

Epoq

Epoq is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Epoq enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Epoq empowers marketing teams to achieve measurable growth.

Preferences

CustomFit

CustomFit is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. CustomFit integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, CustomFit makes advanced AI accessible to all teams.

Preferences

Crobox

Crobox is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Crobox supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Crobox ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

ABLyft

ABLyft is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. ABLyft offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, ABLyft empowers organizations to optimize strategy and maximize return on investment.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site