> Lunio click fraud prevention: how it fingerprints visitors, why consent is required and how to deploy it compliantly. > > Canonical: https://www.flowconsent.com/en/services/security/lunio Security # Lunio Marketing · [Official website](https://lunio.ai) Lunio (formerly PPC Protect) is a UK based click fraud prevention SaaS that fingerprints visitors and analyses click patterns to block invalid traffic on paid campaigns. [Block Lunio until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United Kingdom and United States (AWS eu-west-2, us-east-1) Overview ## What does Lunio do? ## **What is Lunio?** Lunio, formerly known as PPC Protect, is a UK based click fraud prevention SaaS. It is deployed as a JavaScript snippet on the advertiser website to detect and block fraudulent, automated or low value clicks across Google Ads, Microsoft Ads, Meta and other paid channels. ## **How does Lunio process personal data?** The snippet collects IP address, user agent, device and browser fingerprint, screen resolution, time zone, click coordinates and navigation patterns. It sets first party cookies on the publisher domain to remember scoring decisions. The data is sent to Lunio servers in the UK and the US to compute a fraud score. ## **Why does Lunio require consent?** Lunio reads and writes information on the user terminal and processes personal data including IP addresses and fingerprints. Because the fingerprinting goes beyond what is strictly necessary to deliver the website requested by the user, prior consent is required under Article 5(3) of the ePrivacy Directive and the EDPB guidelines on device fingerprinting. ## **International data transfers** Lunio operates primarily from the United Kingdom, which benefits from an EU adequacy decision, but parts of the infrastructure run on AWS in the United States. Transfers to the US must be covered by Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU US Data Privacy Framework. ## **Compliance recommendations** Although Lunio is sometimes presented as a security tool, supervisory authorities in the EU treat fingerprinting based fraud detection as requiring consent. Load the script only after opt in, list Lunio in your privacy notice and DPA, and consider a privacy by design configuration that minimises the data sent. Compliance ## Lunio and the GDPR Lunio is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis consent - Risk level high - Applicable regulations GDPR, UK GDPR, ePrivacy Directive, PECR ### Impact assessment (DPIA) A DPIA is recommended due to systematic device fingerprinting, processing of IP and behavioural data for scoring, and transfers to the United States. ### Sample text for your banner > We use Lunio to detect and block fraudulent clicks on our advertising campaigns. Lunio analyses your device and browser and sets cookies. Do you accept? Cookies and trackers ## What Lunio sets and contacts - Tracking method first\_party\_cookies\_plus\_device\_fingerprinting - Server location United Kingdom and United States (AWS eu-west-2, us-east-1) - Data transferred outside the EU Although Lunio is a UK based vendor, parts of the infrastructure run on AWS in the United States. UK to US transfers are covered by the UK International Data Transfer Addendum and the EU US Data Privacy Framework where applicable. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------- | --------- | ---------- | ----------------------------------------------------------------------------------------------- | | lunio\_uid | marketing | 12 months | Persistent first party identifier used to score visitors for click fraud detection. | | lunio\_session | analytics | 30 minutes | Identifies the current browsing session for fraud scoring. | | lunio\_bot | marketing | 90 days | Stores the latest bot or human classification result for the visitor. | | lunio\_fp | marketing | 6 months | Stores a hashed device and browser fingerprint used to recognise returning fraudulent visitors. | ### Third-party domains contacted (4) - `lunio.ai` - `cdn.lunio.ai` - `api.lunio.ai` - `ppcprotect.com` Questions ## Frequently asked questions about Lunio Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Lunio set? Lunio sets first party cookies on the publisher domain to remember scoring decisions and bot or human classifications. Typical names include lunio\_uid and lunio\_session. Lifetimes range from session only to several months depending on the configuration. ### Is consent required before loading Lunio? Yes. Lunio uses device fingerprinting and sets cookies that are not strictly necessary for the service requested by the user. Prior, informed and granular consent is therefore required before the script is loaded, in line with Article 5(3) of the ePrivacy Directive and the EDPB guidelines. ### What is the legal basis for Lunio? The legal basis is the explicit consent of the data subject under Article 6(1)(a) of the GDPR. Operators sometimes invoke legitimate interest for fraud prevention, but the fingerprinting techniques used by Lunio are typically considered to require consent. ### Does Lunio transfer data outside the EU? Lunio is a UK based vendor and the United Kingdom benefits from an adequacy decision. However, some processing occurs on AWS in the United States. UK to US transfers must be covered by Standard Contractual Clauses, the UK IDTA or the EU US Data Privacy Framework. ### Is a DPIA required when using Lunio? A DPIA is recommended because Lunio performs systematic device fingerprinting, scores users based on behavioural data and transfers data to a third country. These three elements taken together usually trigger the DPIA obligation under Article 35 of the GDPR. ### How do I implement Lunio compliantly? Block the script until consent is collected via a CMP, document the legal basis in your record of processing activities, sign a Data Processing Agreement with Lunio, list the relevant cookies in your cookie policy and retain data only for the period strictly necessary to fight fraud. ### Are there privacy friendly alternatives to Lunio? Native click fraud filters from Google Ads and Microsoft Ads, server side IP and behaviour rules, or open source bot detection libraries can reduce reliance on fingerprinting. Some EU based competitors also offer click fraud protection with stricter data minimisation defaults. ### How should I update my cookie policy to mention Lunio? List Lunio (PPC Protect Limited) as a processor for click fraud prevention, describe the data collected including IP and device fingerprint, specify cookie names and durations, mention the UK and US storage locations and the safeguards in place and provide an opt out path via your CMP. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [Pulse Secure](https://www.flowconsent.com/en/services/security/pulse-secure) [Pulse Secure is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Pulse Secure integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Pulse Secure helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/pulse-secure) [Security](https://www.flowconsent.com/en/services/security/pulse-secure) · ### [NextAuth.js](https://www.flowconsent.com/en/services/security/nextauth-js) [NextAuth.js is an identity and authentication platform providing secure login, single sign-on (SSO), and multi-factor authentication for websites and applications. It supports social login, passwordless authentication, and user management with enterprise-grade security. NextAuth.js simplifies identity implementation for developers while ensuring compliance. With adaptive authentication and anomaly detection, NextAuth.js protects user accounts while maintaining a frictionless experience.](https://www.flowconsent.com/en/services/security/nextauth-js) [Essential](https://www.flowconsent.com/en/services/security/nextauth-js) · ### [ClearSale](https://www.flowconsent.com/en/services/security/clearsale) [ClearSale is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ClearSale supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ClearSale ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/clearsale) [Essential](https://www.flowconsent.com/en/services/security/clearsale) · ### [Cloudflare Turnstile](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) [Cloudflare Turnstile is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Cloudflare Turnstile supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Cloudflare Turnstile ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) [Essential](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) · ### [Regula](https://www.flowconsent.com/en/services/security/regula) [Regula is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Regula supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Regula ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/regula) [Essential](https://www.flowconsent.com/en/services/security/regula) · ### [ClickFreeze](https://www.flowconsent.com/en/services/security/clickfreeze) [ClickFreeze is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ClickFreeze enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ClickFreeze empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/security/clickfreeze) [Marketing](https://www.flowconsent.com/en/services/security/clickfreeze) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)