Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Loom is an asynchronous video messaging tool, owned by Atlassian, that lets people record their screen and camera and share the result through a link or an embedded player. When a Loom video is embedded on a website, the player can set cookies and record view analytics such as plays and watch time, along with the IP address and device information. On European sites these analytics cookies require prior consent.
Loom is an asynchronous video messaging tool now owned by Atlassian. People record their screen, camera, or both and share the recording through a link or an embedded player. It is widely used for product walkthroughs, support, and internal communication, and its videos often appear embedded on public websites.
When a Loom video is embedded, the player can set cookies and use analytics tooling to record views, watch time, and engagement, and it processes the IP address and device and browser information. For viewers who are logged into Loom, activity can be linked to their account. These cookies support analytics rather than the core ability to play the video.
The identifiers and view analytics are personal data under the GDPR, and setting cookies on the device falls under the ePrivacy Directive. A cookie that is strictly necessary to play a video the visitor requested may be exempt, but the analytics and engagement tracking are not, so they require prior consent and clear information.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Where the Loom embed sets analytics cookies, request consent first. The simplest compliant pattern is to load the embed only after the visitor accepts, for example behind a placeholder that explains a third party video will load. Consent must be freely given, specific, informed, and easy to withdraw.
Loom and its parent Atlassian process data in the United States, so transfers rely on the EU US Data Privacy Framework or on Standard Contractual Clauses. Review the Atlassian data processing terms and understand which sub processors are involved in delivering and measuring the video.
Use a consent gated placeholder for Loom embeds, sign or accept the data processing terms, and document the processing. Set expectations in your privacy notice, list the Loom cookies in your cookie policy, and review embeds periodically so the policy stays accurate.
Websites using Loom must obtain user consent under GDPR regulations.
DPIA considerations
Assess what the embedded Loom player collects, whether viewers can be recognised across sessions, the view analytics retained, and the transfers to the United States. A targeted review helps when Loom embeds appear on many pages.
Sample consent text
We embed Loom videos to share recordings with you. The Loom player may set cookies and record viewing statistics such as watch time. These run only after you accept the relevant cookies.
Third-party domains contacted
loom.comwww.loom.comcdn.loom.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| connect.sid | Functional | Session | Maintains the Loom session for signed in users during the visit. |
| ajs_anonymous_id | Analytics | 1 year | Anonymous analytics identifier used to measure video engagement. |
| loom_anon_id | Analytics | 1 year | Identifies a viewer so that view analytics can be recorded for the embedded video. |
Loom uses cookies for user preferences — inform visitors with a consent banner.
An embedded Loom player can set a session cookie and analytics identifiers used to measure views and engagement. The analytics cookies are not strictly necessary to play the video, so they belong in the analytics category of your consent banner.
Yes, where the embed sets analytics cookies. A cookie strictly necessary to play a video the visitor requested can be exempt, but the view analytics require prior consent under the ePrivacy Directive and the GDPR.
Consent under Article 6(1)(a) of the GDPR is the basis for the analytics that Loom embeds set. A strictly necessary playback cookie can rely on the ePrivacy exemption.
Yes. Loom is owned by Atlassian and processes data in the United States, so transfers rely on the EU US Data Privacy Framework or Standard Contractual Clauses.
A full DPIA is rarely required for occasional embeds, but a short review is wise when Loom appears across many pages or audiences. Document the analytics, retention, and transfers.
Load the Loom embed only after consent, ideally behind a placeholder that explains a third party video will load. Accept the Atlassian processing terms and describe the cookies in your policy.
Alternatives include Vimeo, YouTube privacy enhanced mode, and self hosted players. A privacy first embed or a static thumbnail that links out can avoid setting analytics cookies until clicked.
List the Loom cookies with their purpose and duration, label the analytics ones accordingly, name Loom and Atlassian as recipients, and mention the United States transfer. Update it when you add or remove embeds.