Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Adobe Audience Manager (AAM) is the Data Management Platform of the Adobe Experience Cloud. It collects events from your website, builds cross site behavioural segments, drops the demdex cookie on demdex.net and shares audiences with DSPs such as Adobe Advertising Cloud, The Trade Desk or Google DV360. As a profiling and ad targeting tool, it requires prior consent under the GDPR and the ePrivacy Directive.
Adobe Audience Manager (AAM) is the Data Management Platform (DMP) of the Adobe Experience Cloud. AAM collects events from websites, mobile apps and offline systems, builds behavioural segments through trait based and algorithmic models, and forwards those audiences to DSPs and ad servers for activation. The platform was officially deprecated by Adobe in mid 2023 in favour of Real Time CDP, but many enterprise stacks still embed legacy AAM tags.
AAM relies on the demdex cookie set on demdex.net (the Experience Cloud ID), the dpm cookie used by the destination publishing iFrame, and the AMCV cookie set on the first party domain by visitorAPI.js. Together they allow Adobe to identify visitors across all properties using the same Experience Cloud organisation.
The demdex cookie is a third party cookie used for cross site profiling, which is squarely within the scope of Article 5(3) of the ePrivacy Directive. The audience activation is a processing for advertising purposes and requires consent under Article 6(1)(a) GDPR. The CNIL Adtech recommendation and the EDPB guidelines on dark patterns both apply to AAM deployments.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
AAM tags must remain blocked until the visitor has accepted the marketing category. Adobe Launch and Adobe Tags expose hooks to gate visitorAPI.js, dil.js and segment forwarding behind a consent state. The Adobe Privacy Service must be wired up so that withdrawal of consent and rights of access or erasure are propagated to the underlying data layer.
Demdex IDs, segment memberships, IP addresses and trait values are sent to Adobe Inc. infrastructure, primarily in the United States, with EU and UK regional pods available. Adobe is self certified under the EU U.S. Data Privacy Framework and offers Standard Contractual Clauses with supplementary measures.
Block all AAM and Experience Cloud ID Service tags until consent. Use Adobe Tags rules conditional on the consent state, route Adobe Real Time CDP via server side forwarders when possible, and limit Customer Attributes to fields strictly needed. Document Adobe Inc. as a processor in your records of processing and update the privacy notice to mention AAM, Adobe Experience Cloud and the destination DSPs.
Websites using Adobe Audience Manager must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended because AAM creates cross site behavioural profiles, ingests CRM identifiers via Customer Attributes, triggers data transfers to the United States and feeds advertising partners. Customer Match flows and offline data onboarding deserve specific scrutiny.
Sample consent text
We use Adobe Audience Manager to build advertising audiences. With your consent, Adobe will set the demdex cookie on your device, build profiles of your interests across websites and may transfer data to Adobe Inc. in the United States and to its advertising partners. You can refuse or withdraw your consent at any time from the cookie settings.
Third-party domains contacted
demdex.netdpm.demdex.neteveresttech.netomtrdc.netadobedtm.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| demdex | third_party | 180 days | Set on demdex.net by Adobe Audience Manager to assign a unique Experience Cloud ID and synchronise audiences across Adobe properties and partner DSPs. |
| dpm | third_party | 180 days | Set by the Adobe destination publishing iFrame to forward audience segments to ad platforms and DSPs. |
| AMCV_* | first_party | 13 months | Set on the website domain by visitorAPI.js to store the Experience Cloud ID and metadata used by AAM, Adobe Analytics and Adobe Target. |
| AMCVS_* | first_party | session | Session companion of AMCV used by the Experience Cloud ID Service to track that the visitor has been initialised in the current session. |
Adobe Audience Manager places tracking cookies for advertising — comply with GDPR using FlowConsent.
AAM sets the demdex cookie on demdex.net (Experience Cloud ID), the dpm cookie used for destination publishing, and the AMCV cookie on the first party domain via visitorAPI.js. Together they identify visitors across all properties of the same Experience Cloud organisation.
Yes. AAM is a Data Management Platform that performs cross site profiling and shares behavioural audiences with advertising partners, so prior, specific and informed consent is required under Article 5(3) ePrivacy and Article 6(1)(a) GDPR.
Consent is the only suitable legal basis. Legitimate interests cannot be relied on because the processing is for cross site behavioural advertising, includes US transfers and feeds third party DSPs.
Yes. Demdex IDs, segments, IP addresses and trait values are sent to Adobe Inc., primarily in the United States, under the EU U.S. Data Privacy Framework or Standard Contractual Clauses.
A DPIA is recommended given the scale of cross site profiling, the use of CRM identifiers via Customer Attributes, the US transfers and the activation toward third party DSPs.
Block AAM and the Experience Cloud ID Service until consent, gate Adobe Tags rules on the consent state, prefer server side data ingestion via Adobe Real Time CDP and wire up the Adobe Privacy Service for rights handling.
Privacy first alternatives include first party CDPs (Adobe Real Time CDP, Tealium AudienceStream, Bloomreach Engagement) running with limited identifiers, or contextual targeting that avoids behavioural profiling altogether.
Add a section that names Adobe Audience Manager and Adobe Experience Cloud ID Service, lists the cookies (demdex, dpm, AMCV) with purpose and duration, and mentions the transfer to Adobe Inc. and the destination DSPs.