Does Loom require consent?

Conditionally. If Loom videos are essential page content — product documentation, tutorials, help articles — the embed may load as functional without prior consent. If supplementary, or if the persistent loom_viewer_id cross-session tracking raises concerns, gating behind functional consent is the safer approach.

What tracking does Loom embed perform?

The Loom embed sets loom_viewer_id (up to 1-year, third-party under loom.com) for viewer deduplication and watch analytics. Engagement events — play, pause, seek, completion percentages — and the embedding page URL are reported to the recording owner's Loom dashboard, with browser and device metadata included.

How does ConsentStack handle Loom embeds?

ConsentStack can classify Loom as functional, allowing it to load without explicit consent when videos are essential content. For sites requiring stricter consent, ConsentStack gates the embed behind functional consent and displays a placeholder until the visitor agrees, keeping the page compliant without breaking the content experience.

What tracker domains does Loom use?

ConsentStack has catalogued tracker domains for Loom including cdn.loom.com and loom.com. These are the network destinations Loom's scripts contact, which a consent platform blocks until a visitor agrees.

Loom (cdn.loom.com) - Async Video Embed & Privacy Consent Profile

Back to Vendor Library

Overview

Loom is an asynchronous video messaging platform founded in 2016 that allows users to record screen, camera, and microphone simultaneously and share recordings via a link. It is widely adopted in remote and hybrid work environments for async communication, product demos, team updates, and software documentation. Loom's embeddable player allows these recordings to be surfaced directly within websites, internal wikis, help centres, and onboarding portals without requiring the viewer to leave the page or create a Loom account.

What This Script Does

The Loom embed JavaScript loads from cdn.loom.com and renders an iframe-based video player targeting www.loom.com/embed/<video-id>. The player fetches video metadata and streaming segments from Loom's CDN infrastructure, primarily on loom.com and Cloudflare-backed delivery endpoints.

Cookies and storage:

No persistent cookies are set on the embedding site's own domain by the Loom script.
Within the loom.com iframe context, Loom sets a session token to manage playback state and a viewer identifier used for engagement analytics reported to the video owner.
loom_viewer_id — Third-party cookie scoped to loom.com; persists across sessions (up to 1 year) and is used to deduplicate view counts and calculate per-viewer watch duration in the creator's analytics dashboard.

Engagement events transmitted per session:

Play initiated, pause, seek events with timestamp offsets
Completion percentage checkpoints (25%, 50%, 75%, 100%)
Total watch duration and replay count
Browser and device metadata (user agent, screen resolution, language)
Embedding page URL (referrer passed to Loom's analytics API)

Script filename and CDN: loom-embed.js or an inline snippet loaded from cdn.loom.com/player/v1/. Video assets stream from loom-video.s3.amazonaws.com or Cloudflare-fronted delivery domains.

Engagement data is reported to the recording owner's Loom dashboard for measuring audience behaviour and optimising async communication content.

Consent & Compliance

Loom embeds are primarily functional — they deliver content that the page author has chosen to include as part of the page experience. However, the engagement tracking component (per-viewer watch analytics, viewer identification, completion metrics) has a meaningful analytics dimension. Under GDPR and the ePrivacy Directive, third-party cookies set within iframes require the same consent consideration as any other tracking cookie, particularly where a persistent viewer identifier is maintained. Since Loom's tracking is bounded to video engagement (not cross-site ad profiling), the compliance risk is lower than dedicated analytics or advertising tools, but it is not zero. Loom is a US-based service and participates in data transfer mechanisms under GDPR for EU data subjects. Site owners embedding Loom in commercial contexts should disclose it as a functional/analytics sub-processor.

Should You Block This Without Consent?

Conditional. If Loom videos are essential page content — such as product documentation, onboarding tutorials, or help articles — the embed can reasonably be treated as functional content delivered without prior consent, provided the engagement tracking is disclosed. If videos are supplementary or decorative, or if the persistent viewer identifier raises concerns in your privacy posture, blocking until functional consent is granted is the safer approach.

Is Loom GDPR compliant?

Loom typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Loom can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Loom, not on Loom itself.

Visit website