Visitor data and analytics

The visitor cookie

Luma identifies a browser with a first-party cookie, _lbx_vid: a random ID, set on your domain for one year, SameSite=Lax, Secure on HTTPS. It holds nothing about the shopper. Every discovery request carries it as X-Lbx-Visitor-Id.

A _lbx_vid value Luma could not have written — anything other than letters, digits, _ and -, up to 64 characters — is replaced.

Personalization and consent

Luma’s discovery requests do not send personalize, so they are treated as "personalize": true — see personalize is also your consent signal. Take this into account in your consent setup: a shopper who has not consented should not have the integration loaded, or should have it turned off in _global/_init.ts by returning false.

Analytics events

Luma sends the analytics events your integration’s _analytics.ts describes — see Analytics. They carry the same visitor ID as Luma’s discovery requests.

Events your site sends by other means, such as purchases from your server, are described in Sending events. Send them with the same visitor ID Luma uses, so they are attributed to the searches and recommendations that preceded them:

const visitorId = document.cookie.match(/(?:^|;\s*)_lbx_vid=([^;]+)/)?.[1];

The cookie exists once Luma has made its first request in that browser.

Browser storage

Luma keeps working data in sessionStorage and localStorage, under keys starting with lbx:. Among them:

Where	Key	Holds
sessionStorage	lbx:tok:*	The browser token, shared by every widget for the session
sessionStorage	lbx:r:*	Listing results kept for Back, and a search fetched while typing
sessionStorage	lbx:h:*, lbx:rh:*	The heights reserved for listings and recommenders
sessionStorage	lbx:fail:*	Failures per kind of page, for falling back
sessionStorage	lbx:ev	Analytics events not yet delivered
sessionStorage	lbx:tiles, lbx:dl	Clicks and add-to-carts on Luma’s products, and dataLayer pushes, kept for the next page until analytics has read them
localStorage	lbx:tx	The last purchase IDs sent, so a reloaded thank-you page does not count twice
localStorage	lbx:early	The rules the early-hold snippet reads
localStorage	lbx:contrast	The visitor’s choice on the high-contrast switch

The loader also keeps a preview chosen with ?_lbx_env= in sessionStorage as _lbx_env — see Previews and releases.

Luma’s own entries hold no personal data. lbx:dl holds your dataLayer pushes as your site made them, and lbx:tx your order IDs. Where storage is unavailable — a private window, a full quota — Luma works without it.

Requests

Luma’s requests go to api.<region>.luigisbox.ai (discovery and analytics events) and auth.<region>.luigisbox.ai (the browser token), and its code loads from cdn.<region>.luigisbox.ai. Results fetched ahead of a click are requests like any other, and count as such.

See also

• Analytics — the events Luma sends
• Personalization
• Sending events