Loom

Overview

Loom is an asynchronous video messaging platform founded in 2016 that allows users to record screen, camera, and microphone simultaneously and share recordings via a link. It is widely adopted in remote and hybrid work environments for async communication, product demos, team updates, and software documentation. Loom's embeddable player allows these recordings to be surfaced directly within websites, internal wikis, help centres, and onboarding portals without requiring the viewer to leave the page or create a Loom account.

What This Script Does

The Loom embed JavaScript loads from cdn.loom.com and renders an iframe-based video player targeting www.loom.com/embed/<video-id>. The player fetches video metadata and streaming segments from Loom's CDN infrastructure, primarily on loom.com and Cloudflare-backed delivery endpoints.

Cookies and storage:

• No persistent cookies are set on the embedding site's own domain by the Loom script.
• Within the loom.com iframe context, Loom sets a session token to manage playback state and a viewer identifier used for engagement analytics reported to the video owner.
• loom_viewer_id — Third-party cookie scoped to loom.com; persists across sessions (up to 1 year) and is used to deduplicate view counts and calculate per-viewer watch duration in the creator's analytics dashboard.

Engagement events transmitted per session:

• Play initiated, pause, seek events with timestamp offsets
• Completion percentage checkpoints (25%, 50%, 75%, 100%)
• Total watch duration and replay count
• Browser and device metadata (user agent, screen resolution, language)
• Embedding page URL (referrer passed to Loom's analytics API)

Script filename and CDN: loom-embed.js or an inline snippet loaded from cdn.loom.com/player/v1/. Video assets stream from loom-video.s3.amazonaws.com or Cloudflare-fronted delivery domains.

Engagement data is reported to the recording owner's Loom dashboard for measuring audience behaviour and optimising async communication content.

Consent & Compliance

Loom embeds are primarily functional — they deliver content that the page author has chosen to include as part of the page experience. However, the engagement tracking component (per-viewer watch analytics, viewer identification, completion metrics) has a meaningful analytics dimension. Under GDPR and the ePrivacy Directive, third-party cookies set within iframes require the same consent consideration as any other tracking cookie, particularly where a persistent viewer identifier is maintained. Since Loom's tracking is bounded to video engagement (not cross-site ad profiling), the compliance risk is lower than dedicated analytics or advertising tools, but it is not zero. Loom is a US-based service and participates in data transfer mechanisms under GDPR for EU data subjects. Site owners embedding Loom in commercial contexts should disclose it as a functional/analytics sub-processor.

Should You Block This Without Consent?

Conditional. If Loom videos are essential page content — such as product documentation, onboarding tutorials, or help articles — the embed can reasonably be treated as functional content delivered without prior consent, provided the engagement tracking is disclosed. If videos are supplementary or decorative, or if the persistent viewer identifier raises concerns in your privacy posture, blocking until functional consent is granted is the safer approach.