How cookieless tracking works

LoopLab measures paid traffic without writing anything to your visitors’ devices. No cookies, no local storage, no fingerprinting. This page explains exactly how, so you can describe it accurately in your own privacy notice.

The click ID

When someone lands — through a LoopLab tracking link, on a page LoopLab hosts, or on your own page with the LoopLab script — the server creates a random click ID for that single visit. It travels in the page URL (?clickid=…) and in the requests the tracker sends while the page is open. When the tab closes, nothing remains on the device.

Your checkout or CRM can send the click ID back to LoopLab with a server-to-server postback, so revenue is attributed to the exact campaign, ad and page version — without a cookie ever being involved.

What LoopLab records for a visit

• Landing page and version, campaign parameters (UTMs, ad-platform click IDs such as gclid or fbclid) and the referrer.
• Device class, browser family and operating system (derived from the user agent, which is not stored), viewport width, and country (from Cloudflare’s header; the IP address itself is never stored).
• Which sections were seen and for how long, scroll depth, clicks with their position inside a section, rage and dead clicks, and form field focus order.
• Form submissions you configure as conversions, with the fields the visitor typed into that form.
• If session replay is enabled: the page’s DOM changes and pointer movements, with every input masked by default.

What LoopLab never records

• IP addresses, full user-agent strings, or any device identifier.
• Keystrokes in form fields during replay (inputs are masked before they leave the browser).
• Anything across different sites or across separate visits of the same person.

What this means for consent

Because nothing is stored on or read from the visitor’s device, the ePrivacy cookie-consent requirement for storage access does not apply to LoopLab’s tracking. GDPR still applies: visits, behaviour events, replays and lead data are personal data when they relate to an identifiable person. You remain the controller; LoopLab acts as your processor under the Data Processing Agreement. Most customers rely on legitimate interest for aggregate analytics and attribution, and should assess replays and lead forms separately. Your lawyer should confirm the basis for your situation.

The LoopLab app itself

When you are signed in to LoopLab, we use one strictly necessary session cookie (ll_session) and a non-identifying hint (ll_in) so the website can show “Open app”. Visitors to your pages never receive either.