Skip to main content

Best Practice: Cookie Banner Configuration

Many customers mistakenly classify the LoyJoy integration as a "Marketing" tool within their Consent Manager. Consequently, the chat only loads after the user actively clicks "Accept All" in the cookie banner. Since the chat often serves as the primary entry point for support or lead generation, hiding it behind a consent wall results in lost interactions.

Because LoyJoy does not perform cross-site tracking and uses Local Storage primarily for technical functionality (maintaining chat context), we recommend the following configuration:

1. Classification as "Essential" / "Technically Necessary"​

We recommend assigning the LoyJoy script within your Consent Manager (e.g., Usercentrics, Cookiebot, OneTrust) to the Essential or Technically Necessary category.

Why is this justified? According to common legal interpretations (e.g., GDPR / ePrivacy Directive), no consent is required if the storage of information is strictly necessary to provide a service explicitly requested by the user.

  • Purpose: The Local Storage (max. 14 days) is used solely to save the chat history so that the conversation is not lost when the user reloads the page or navigates to a sub-page.
  • No Tracking: Unless you explicitly integrate third-party pixels (see the warning below), LoyJoy does not build advertising profiles.

To ensure the chat is always visible while maintaining correct behavior, use this combination:

  1. In your Consent Manager (Website): Set LoyJoy to Essential. This ensures the LoyJoy script (widget.js) loads immediately, making the chat button visible to the user right away.
  2. In LoyJoy Settings: Select the Smart mode (as described in the "Integrate with your Consent Manager" section).
    • LoyJoy automatically detects the presence of a cookie banner.
    • The chat listens for the consent banner signals. Even if loaded immediately, it respects the user's choice regarding cookies.
    • If a user rejects cookies, the Smart mode attempts to provide the chat functionality without persistent storage (Note: history will be lost on page reload in this specific case, but the chat remains usable).

3. Argumentation Helper for your Data Protection Officer​

You can use the following summary to discuss the integration with your internal privacy team or Data Protection Officer (DPO):

"The LoyJoy Chat is integrated as 'Technically Necessary' (Essential). No cross-site tracking takes place. The use of Local Storage serves exclusively to provide the technical chat functionality (maintaining the session context). The storage duration is limited to the necessary minimum (Standard: 14 days)."

4. Technical Implementation​

To configure LoyJoy as Essential, you must ensure your Consent Manager does not block the script from loading.

Incorrect (Script is blocked by CMP): The script tag is modified to text/plain and only executes after consent. This prevents the chat from appearing for new users.

<script type="text/plain" data-usercentrics="Marketing" src="..."></script>

Correct (Script loads, Logic handled by LoyJoy): Leave the script as a standard JavaScript tag.

<script async defer src="https://stable.loyjoy.com/widget.js?process=YOUR_ID"></script>

In your CMP dashboard, ensure the vendor "LoyJoy" is assigned to the "Essential" category so the script above is allowed to run.

Important: Third-Party Tools If you trigger Third-Party Tracking Pixels within the LoyJoy chat flow (e.g., firing a Google Analytics event or Facebook Pixel via the process modules), the "Essential" classification may no longer apply to those specific events. Please ensure that such tracking events within the chat are only fired if the corresponding marketing consent has been signaled by the host website. :::

FAQ​

Is the chat "essential" even if the website works without it?​

Yes. The term "technically necessary" (or "strictly necessary") in privacy laws (like GDPR/ePrivacy) does not mean that the entire website must fail without the tool. It means that the storage is necessary to provide a specific service explicitly requested by the user.

The Logic:

  1. When a user opens the chat or sends a message, they are explicitly requesting the "Chat Service".
  2. To fulfill this request (showing the answer, keeping the conversation history alive during navigation), the application technically needs to store the session context in the Local Storage.
  3. Without this storage, the chat would "forget" the conversation after every click, rendering the service broken.

Analogy: Think of a shopping cart in an online store. The website works perfectly fine just for browsing products without a cart. However, once a user wants to buy something, the cookie that remembers the cart items becomes "strictly necessary" to provide the shopping functionality. The same principle applies to the LoyJoy Chat history.

Deep Dive: IP Addresses and GDPR Compliance​

A common concern raised by Data Protection Officers is: "The IP address is transmitted as soon as the script loads, before the user even opens the chat. Doesn't this require consent?"

The Answer: No. Loading the script without consent is generally considered compliant if the IP address is processed strictly for technical delivery and security, not for user profiling.

Here is the legal and technical distinction you can use in your argumentation:

1. Distinction between Storage (TTDSG/ePrivacy) and Data Processing (GDPR)

  • Local Storage (Client-Side): We use Local Storage to save the chat history. This is classified as "Essential" because it is technically necessary to provide the service (keeping the conversation alive).
  • IP Address (Server-Side): The transmission of the IP address is technically unavoidable to deliver the script code to the user's browser (how the internet works).

2. Legal Basis for IP Processing: Legitimate Interest According to the GDPR, processing the IP address for the mere delivery of the content does not necessarily require Consent (Art. 6 (1) (a)). Instead, it is typically based on Legitimate Interest (Art. 6 (1) (f)):

  • Purpose: To make the contact option (Chat) technically available on the website and to ensure the security of the service (e.g., preventing DDoS attacks).
  • No Profiling: LoyJoy uses the IP address to deliver the chat widget. Unless you explicitly configure tracking integrations, LoyJoy does not use the IP address to build a cross-site marketing profile of the user.

Conclusion: You can load the LoyJoy script as "Essential". The storage is covered by the necessity exception, and the transient IP processing is covered by legitimate interest for service delivery and security.