---
title: Visitor data and analytics
description: The cookie and browser storage Luma uses, what it sends with each request, and how analytics events join the same visitor.
slug: luma/visitor-data
docKind: reference
hub: luigisbox-ai
---

## The visitor cookie

Luma identifies a browser with a first-party cookie, `_lbx_vid`: a random ID, set on your
domain for one year, `SameSite=Lax`, `Secure` on HTTPS. It holds nothing about the shopper.
Every discovery request carries it as
[`X-Lbx-Visitor-Id`](/api-basics/requests-and-responses/#identifying-the-shopper).

A `_lbx_vid` value Luma could not have written — anything other than letters, digits, `_` and
`-`, up to 64 characters — is replaced.

## Personalization and consent

Luma's discovery requests do not send `personalize`, so they are treated as
`"personalize": true` — see
[`personalize` is also your consent signal](/discovery/personalization/#personalize-is-also-your-consent-signal).
Take this into account in your consent setup: a shopper who has not consented should not
have the integration loaded, or should have it turned off in `_global/_init.ts` by
returning `false`.

## Analytics events

Luma sends the analytics events your integration's `_analytics.ts` describes — see
[Analytics](/luma/analytics/). They carry the same visitor ID as Luma's discovery requests.

Events your site sends by other means, such as purchases from your server, are described in
[Sending events](/analytics/sending-events/). Send them with the same visitor ID Luma uses, so
they are attributed to the searches and recommendations that preceded them:

```js
const visitorId = document.cookie.match(/(?:^|;\s*)_lbx_vid=([^;]+)/)?.[1];
```

The cookie exists once Luma has made its first request in that browser.

## Browser storage

Luma keeps working data in `sessionStorage` and `localStorage`, under keys starting with
`lbx:`. Among them:

| Where | Key | Holds |
|---|---|---|
| `sessionStorage` | `lbx:tok:*` | The [browser token](/authentication/browser-tokens/), shared by every widget for the session |
| `sessionStorage` | `lbx:r:*` | Listing results kept for Back, and a search fetched while typing |
| `sessionStorage` | `lbx:h:*`, `lbx:rh:*` | The heights reserved for listings and recommenders |
| `sessionStorage` | `lbx:fail:*` | Failures per kind of page, for [falling back](/luma/behaviour/#taking-over-a-listing) |
| `sessionStorage` | `lbx:ev` | [Analytics](/luma/analytics/#delivery) events not yet delivered |
| `sessionStorage` | `lbx:tiles`, `lbx:dl` | Clicks and add-to-carts on Luma's products, and dataLayer pushes, kept for the next page until analytics has read them |
| `localStorage` | `lbx:tx` | The last purchase IDs sent, so a reloaded thank-you page does not count twice |
| `localStorage` | `lbx:early` | The rules the early-hold snippet reads |
| `localStorage` | `lbx:contrast` | The visitor's choice on the high-contrast switch |

The loader also keeps a preview chosen with `?_lbx_env=` in `sessionStorage` as `_lbx_env` —
see [Previews and releases](/distribution/previews-and-releases/#previewing-a-branch).

Luma's own entries hold no personal data. `lbx:dl` holds your dataLayer pushes as your site
made them, and `lbx:tx` your order IDs. Where storage is unavailable — a private window, a full
quota — Luma works without it.

## Requests

Luma's requests go to `api.<region>.luigisbox.ai` (discovery and analytics events) and
`auth.<region>.luigisbox.ai` (the browser token), and its code loads from
`cdn.<region>.luigisbox.ai`. Results fetched ahead of a click are requests like any other,
and count as such.

## See also

- [Analytics](/luma/analytics/) — the events Luma sends
- [Personalization](/discovery/personalization/)
- [Sending events](/analytics/sending-events/)