> Alimama by Alibaba sets advertising cookies and sends EU visitor data to China. Learn what consent, banner setup and DPIA you need to stay GDPR compliant. > > Canonical: https://www.flowconsent.com/en/services/advertising/alimama Advertising # Alimama Marketing · [Official website](https://www.alimama.com) Alimama is the marketing and advertising technology platform of Alibaba Group, used by sellers on Tmall, Taobao and AliExpress to run paid ads, retargeting and conversion measurement. It collects browsing, purchase and identity data through pixels and cookies, then ties signals across devices using Alibaba's super ID. For European websites, embedding Alimama tags transfers personal data to mainland China and triggers strict GDPR and ePrivacy obligations, including prior explicit consent and a layered cookie banner. [Block Alimama until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 7 - Third-party domains 7 - Servers China (mainland), with regional CDN nodes Overview ## What does Alimama do? ## **What is Alimama and how does it work** Alimama is the in house marketing technology platform of Alibaba Group, the company behind Tmall, Taobao and AliExpress. It powers paid search ads, display ads, retargeting and brand campaigns across the Alibaba ecosystem and partner publisher networks. When a European merchant places an Alimama tracking pixel on its website, the script captures pageviews, product interactions, add to cart events and conversions, then sends them to Alibaba servers for attribution and audience building. Alimama is best known for its cross device super ID, which links the same person across phones, tablets and computers using authenticated Alibaba accounts and probabilistic signals. That makes Alimama a powerful retargeting tool, but also a high risk processor under GDPR. ## **What data and cookies Alimama collects** On a typical e commerce site that has integrated Alimama, the tracking script sets cookies on domains such as mmstat.com, atanx.alicdn.com and tanx.com. Common identifiers include cna (visitor ID, around 13 months), isg (session ID), t (long lived tracking), tb\_token (transaction token) and miid (member ID when the visitor is logged into an Alibaba account). The pixel also collects: IP address, user agent, referrer, page URL, viewed products, search terms, cart events, purchase value, and device fingerprint signals such as screen size and language. When the visitor is signed in to Alibaba, all of this can be tied to a stable account level profile. ## **GDPR and ePrivacy implications** Alimama is a marketing and advertising tool, so the cookies it sets are not strictly necessary under Article 5(3) of the ePrivacy Directive. They require prior, freely given, specific, informed and unambiguous consent before any tag fires. Pre ticked boxes, scroll based acceptance and cookie walls have been repeatedly sanctioned by the CNIL and other European authorities. The data captured by Alimama (online identifiers, behavioural data, purchase data, sometimes account level data) qualifies as personal data under Article 4 GDPR and is processed for advertising and profiling purposes covered by Article 22. ## **Data transfers to China** Alimama servers are located in mainland China, which is not covered by an adequacy decision from the European Commission. Any deployment therefore involves an international transfer governed by Chapter V of the GDPR. Standard Contractual Clauses must be in place, complemented by a Transfer Impact Assessment as recommended by the EDPB. Beyond the contracts, organisations should account for Chinese laws (National Intelligence Law of 2017, Data Security Law of 2021, PIPL) which can compel local providers to disclose data to public authorities. Several European DPAs consider that this legal context is comparable to or stricter than the Schrems II concerns raised about US surveillance. ## **How to deploy Alimama in a compliant way** To use Alimama on a website that targets EU or UK visitors, you should: block all Alimama scripts before consent through a CMP such as FlowConsent, document a clear lawful basis (consent under Article 6(1)(a) and Article 49(1)(a) for the China transfer), update your privacy policy and cookie policy to name Alimama and the transfer, sign Standard Contractual Clauses with Alibaba, run a DPIA and Transfer Impact Assessment, and offer an easy reject all option that is as accessible as accept all. You should also configure your CMP to block Alimama domains (mmstat.com, atanx.alicdn.com, tanx.com, alimama.com) until the visitor opts in to advertising cookies, and to release that consent immediately to the Alimama tag manager so attribution still works. ## **Alternatives and risk mitigation** For brands selling on Tmall and Taobao, Alimama is essentially unavoidable on the Chinese leg of the funnel, but the tracking on the European storefront can often be replaced or limited. Server side conversion APIs, hashed first party data and aggregated reporting reduce the volume of raw personal data sent to China. Where a separate measurement stack is feasible (Matomo, Plausible, server side GA4 in EU), it is sound practice to keep the EU side measurement separate from the Alimama retargeting layer. Compliance ## Alimama and the GDPR Alimama is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior, freely given, specific, informed and unambiguous consent under Article 6(1)(a) GDPR, plus explicit consent under Article 49(1)(a) GDPR for the international transfer of personal data to China. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, French Data Protection Act, CNIL cookie guidelines, EDPB recommendations on transfers to third countries, PIPL (Chinese counterpart) ### Impact assessment (DPIA) A Data Protection Impact Assessment is strongly recommended before deploying Alimama tags on a European site. Key risks: large scale profiling and cross device tracking, transfer of personal data to mainland China without an adequacy decision, exposure to Chinese surveillance laws, and combination with Alibaba marketplace identifiers that can re identify EU users. Document the lawful basis (consent), the necessity test, the transfer impact assessment under EDPB Recommendations 01/2020, and the technical and organisational safeguards in place. ### Sample text for your banner > We use Alimama, the advertising platform of Alibaba Group, to measure the performance of our campaigns and to show you relevant ads on Tmall, Taobao, AliExpress and partner sites. This involves storing cookies and similar identifiers on your device and transferring your personal data to Alibaba servers in mainland China, a country without an EU adequacy decision. You can accept, refuse or customise these cookies and you can withdraw your consent at any time from our cookie preferences page. Cookies and trackers ## What Alimama sets and contacts - Tracking method JavaScript pixel and tracking beacons (mmstat.com, log.mmstat.com), first-party and third-party cookies, cross-device identity stitching via Alibaba super ID, retargeting and conversion measurement, integration with Tmall, Taobao and AliExpress audiences - Server location China (mainland), with regional CDN nodes - Data transferred outside the EU Personal data is transferred to Alibaba Group servers located in mainland China, a country without an adequacy decision under Article 45 GDPR. Transfers rely on Standard Contractual Clauses and supplementary measures, but European authorities have repeatedly flagged risks linked to Chinese national security and intelligence laws, including the National Intelligence Law (2017) and the Data Security Law (2021), which can compel local providers to hand over data to authorities. ### Cookies set (7) | Name | Type | Duration | Purpose | | --------- | ------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | cna | third\_party | 13 months | Persistent visitor identifier set on mmstat.com, used for cross site tracking, attribution and audience building across the Alibaba advertising network | | isg | third\_party | session | Session level identifier used to keep tracking continuity within a single browsing session and to detect automated traffic | | t | third\_party | 1 year | Long lived tracking cookie used by Alimama and Tanx for retargeting and frequency capping | | tb\_token | third\_party | session | Transaction and security token used when the visitor authenticates with an Alibaba account or interacts with a marketplace widget | | miid | third\_party | 1 year | Alibaba member identifier set when the visitor is logged in to Tmall, Taobao or AliExpress, used to tie behaviour to an account level profile | | xlly\_s | third\_party | session | Load balancing and routing cookie set by Alibaba edge infrastructure to keep the user on the same server during a session | | cookie2 | third\_party | 1 year | Authentication cookie used by Alibaba properties, may be sent to Alimama tags when the visitor is signed in to an Alibaba account | ### Third-party domains contacted (7) - `alimama.com` - `mmstat.com` - `log.mmstat.com` - `atanx.alicdn.com` - `tanx.com` - `simba.taobao.com` - `alicdn.com` Questions ## Frequently asked questions about Alimama Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Alimama set on my website? Alimama and its sister advertising domains set first and third party cookies such as cna (visitor identifier, around 13 months), isg (session identifier), t (long lived tracking), tb\_token (transaction token) and miid (Alibaba member identifier). They are deposited from domains like mmstat.com, atanx.alicdn.com, tanx.com and alimama.com. ### Do I need user consent before loading Alimama? Yes. Alimama is an advertising and profiling tool, so its cookies and pixels are not strictly necessary. Under Article 5(3) of the ePrivacy Directive and the GDPR, you must collect prior, freely given, specific, informed and unambiguous consent before any Alimama tag fires. The reject all option must be as easy to use as the accept all option. ### What is the legal basis for using Alimama under GDPR? The lawful basis is consent under Article 6(1)(a) of the GDPR for the processing itself. Because the data is sent to mainland China, you also need explicit consent under Article 49(1)(a) for the international transfer, unless you can rely on Standard Contractual Clauses combined with appropriate supplementary measures and a documented Transfer Impact Assessment. ### Does Alimama transfer data outside the EU? Yes. Alimama is operated by Alibaba Group and stores data on servers located in mainland China, which has no adequacy decision from the European Commission. Any deployment on a website targeting EU or UK visitors triggers the Chapter V transfer rules of the GDPR and requires SCCs plus a Transfer Impact Assessment that takes into account Chinese surveillance laws. ### Do I need a DPIA before deploying Alimama? A Data Protection Impact Assessment is strongly recommended and, in most cases, required. Alimama combines large scale profiling, cross device identification, and a transfer to a non adequate country, three criteria that the EDPB lists as triggers for a mandatory DPIA. The DPIA should cover purposes, data flows, the lawful basis, the Transfer Impact Assessment, the technical safeguards and the rights of data subjects. ### How do I make my Alimama integration GDPR compliant? Block the Alimama scripts before consent through a Consent Management Platform such as FlowConsent, classify the cookies as advertising in your cookie policy, name Alimama and the China transfer in your privacy notice, sign Standard Contractual Clauses with Alibaba, run a DPIA and a Transfer Impact Assessment, and offer a clear reject all option in the banner. Test that your tags only fire after explicit opt in for advertising cookies. ### Are there alternatives to Alimama for European audiences? For sites that mainly target European customers, you can decouple measurement from retargeting: keep a privacy friendly analytics layer (Matomo, Plausible or server side GA4 hosted in the EU) for performance reporting, and use Alimama only on the leg of the funnel that genuinely targets Chinese marketplaces. Server side conversion APIs and aggregated reporting also reduce the volume of personal data sent to China. ### How do I update my cookie policy for Alimama? List Alimama and its tracking domains (mmstat.com, atanx.alicdn.com, tanx.com, alimama.com) in your cookie policy under the advertising or marketing category. Specify the cookie names, their purpose, their duration, the controller (Alibaba Group), and the fact that the data is transferred to mainland China. Link to Alibaba's privacy policy and to your CMP preferences page so visitors can withdraw consent at any time. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Fohr](https://www.flowconsent.com/en/services/advertising/fohr) [Fohr is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Fohr enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Fohr empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/fohr) [Marketing](https://www.flowconsent.com/en/services/advertising/fohr) · ### [Wunderkind](https://www.flowconsent.com/en/services/advertising/wunderkind) [Wunderkind is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Wunderkind provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Wunderkind helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/wunderkind) [Marketing](https://www.flowconsent.com/en/services/advertising/wunderkind) · ### [Systems Accel](https://www.flowconsent.com/en/services/advertising/systems-accel) [Systems Accel is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Systems Accel enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Systems Accel empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/systems-accel) [Marketing](https://www.flowconsent.com/en/services/advertising/systems-accel) · ### [Sharethrough](https://www.flowconsent.com/en/services/advertising/sharethrough) [Sharethrough is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Sharethrough provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Sharethrough helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/sharethrough) [Marketing](https://www.flowconsent.com/en/services/advertising/sharethrough) · ### [Aimerce](https://www.flowconsent.com/en/services/advertising/aimerce) [Aimerce is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Aimerce integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Aimerce makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/advertising/aimerce) [Marketing](https://www.flowconsent.com/en/services/advertising/aimerce) · ### [Niice](https://www.flowconsent.com/en/services/advertising/niice) [Niice is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Niice provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Niice helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/niice) [Marketing](https://www.flowconsent.com/en/services/advertising/niice) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)