FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Advertising

Amazon Ads

Marketing

Amazon Ads is the advertising suite of Amazon (Sponsored Products, Sponsored Display, Amazon DSP, Amazon Marketing Cloud). Uses cross site cookies and hashed identifiers to match website visitors with Amazon shoppers for retargeting and measurement. Requires consent under GDPR.

Block Amazon Ads until consentScan my site
Overview

What does Amazon Ads do?

What Amazon Ads is

Amazon Ads is the advertising suite of Amazon: Sponsored Products and Sponsored Brands inside the Amazon marketplace, Sponsored Display across Amazon properties and third party sites, Amazon DSP for programmatic media buying, Amazon Marketing Cloud for clean room analytics, and the Amazon Advertising Pixel and Conversion API to import off Amazon events. Together they let advertisers reach and measure Amazon shoppers and lookalike audiences with deep behavioural data.

Cookies, pixels and Conversion API

The Amazon Advertising Pixel writes the ad-id cookie (13 months, advertising identifier) and ad-privacy (consent state), plus session cookies during the matching flow on amazon-adsystem.com. The Conversion API sends server side events containing hashed email, phone, IP and user agent to Amazon. The data feeds the Amazon shopper identity graph, retargeting audiences and Amazon Marketing Cloud clean room. Audience matching exposes the publisher to joint controllership under GDPR art. 26.

Consent and joint controllership

Consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) is mandatory for the Pixel cookies and for the Conversion API events containing hashed PII. The CJEU Fashion ID line of cases imposes joint controllership between the publisher and Amazon EU SARL for the audience match step. The joint controllership agreement under GDPR art. 26 must be signed and the essence published in the privacy notice. Amazon supports the IAB TCF v2.2 signal and Google Consent Mode.

International transfers

Although the storefront and pixel endpoints have European fallbacks (eu-west-1 Ireland, eu-central-1 Frankfurt), the Amazon advertising identity graph and the bid signals are processed centrally in the United States. Amazon is certified under the EU US Data Privacy Framework and uses the 2021 Standard Contractual Clauses as fallback. A Transfer Impact Assessment is required, especially because amazon-adsystem.com traffic flows freely to the US.

Implementation checklist

Load the Amazon Advertising Pixel only after marketing consent, hash all PII before sending to the Conversion API, sign the Amazon Ads joint controllership agreement, document the cooperation in the privacy notice, integrate with your CMP via TCF and Consent Mode, set up the Amazon Privacy Portal flow for data subject requests, document the legal basis for each audience activated, and reduce retention to the minimum needed for attribution.

Compliance

Amazon Ads and the GDPR

Amazon Ads is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent under GDPR art. 6(1)(a) combined with ePrivacy art. 5(3) for the Amazon Advertising Pixel (ad-id cookies) and for the Amazon Conversion API when it sends hashed personally identifiable information. The cookies feed cross site behavioural advertising and audience matching on Amazon.com; they cannot use legitimate interest in the EU. Joint controllership under GDPR art. 26 applies between the publisher and Amazon EU SARL for the audience match like the Fashion ID line of CJEU cases.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, CNIL guidance on advertising cookies, EDPB guidelines 8/2020 on targeting, Joint controllership under GDPR art. 26 (CJEU Fashion ID), Digital Services Act, EU US Data Privacy Framework

Impact assessment (DPIA)

A DPIA is required because Amazon Ads creates behavioural advertising profiles, performs identity matching with the Amazon shopper graph, transfers data to the United States and may trigger automated decisions about ad serving. The DPIA should cover the joint controllership boundary, the hashed PII flowing into the Conversion API, the retention of the audience match, the rights to access and erasure on the Amazon Privacy Portal and the integration with the IAB TCF and Amazon TCF signal.

Sample text for your banner

We use Amazon Ads to measure the impact of our advertising on Amazon and to show personalised ads. The Amazon Ads Pixel writes cookies on your device (ad-id, ad-privacy) and our server sends Amazon hashed information about purchases or page views via the Conversion API. Amazon may match this data with its own data on Amazon.com to build advertising audiences. Data may be processed in the United States under the EU US Data Privacy Framework. You can accept, refuse or withdraw at any time.
Cookies and trackers

What Amazon Ads sets and contacts

Tracking method
advertising_pixel_and_conversion_api_with_amazon_advertising_identifier
Server location
Amazon Ads runs on Amazon Web Services with regional infrastructure in the United States (us-east-1, us-west-2), Europe (eu-west-1 Ireland, eu-central-1 Frankfurt) and Asia Pacific (Tokyo, Singapore). EU customers are served from the Dublin and Frankfurt clusters, but the advertising identity graph and the bid signals are aggregated globally on the Amazon Advertising platform headquartered in the United States.
Data transferred outside the EU
Amazon.com Inc. is headquartered in Seattle, United States. Bid stream and audience graph processing for Amazon DSP, Sponsored Products, Sponsored Brands and Amazon Marketing Cloud run on AWS US East. Amazon is certified under the EU US Data Privacy Framework and signs the 2021 Standard Contractual Clauses as fallback. Amazon also has data centres in India and contractually allows access from Amazon staff in the US, India and Costa Rica.

Cookies set (5)

NameTypeDurationPurpose
ad-idThird party (amazon-adsystem.com)13 monthsAmazon advertising identifier used to track the visitor across the open web for retargeting, audience matching and conversion attribution
ad-privacyThird party (amazon-adsystem.com)5 yearsStores the visitor advertising consent state communicated to Amazon Ads
_aaxscThird party (amazon-adsystem.com)90 daysSession continuity identifier used by Sponsored Display retargeting
_abvThird party (amazon-adsystem.com)90 daysBehavioural identifier used by Sponsored Display to build retargeting and lookalike audiences
session-idThird party (amazon.com)Up to 14 yearsAmazon shopper session identifier used in the audience match step on amazon.com

Third-party domains contacted (7)

  • amazon-adsystem.com
  • s.amazon-adsystem.com
  • aax.amazon-adsystem.com
  • aax-eu.amazon-adsystem.com
  • fls-eu.amazon.com
  • assoc-amazon.com
  • advertising.amazon.com
Questions

Frequently asked questions about Amazon Ads

Can't find your question? Write to us, we answer fast.

What cookies does Amazon Ads set?

The Amazon Advertising Pixel sets ad-id (13 months, advertising identifier), ad-privacy (consent state), various session cookies on amazon-adsystem.com during matching, plus the Amazon Marketing Cloud identifier when AMC is active. The Sponsored Display retargeting tag sets _aaxsc and _abv (90 days, behavioural identifier).

Is consent required for Amazon Ads?

Yes, mandatory. The pixel cookies and the Conversion API events that send hashed PII are subject to ePrivacy art. 5(3) and GDPR art. 6(1)(a). Legitimate interest cannot be used because Amazon Ads performs behavioural advertising and identity matching.

What is the legal basis for Amazon Ads?

Consent (GDPR art. 6(1)(a)) for the cookies and matching events. Joint controllership (art. 26) between the publisher and Amazon EU SARL for the audience match per the CJEU Fashion ID case law. Both must be signed and the joint controllership essence published.

Are data transferred to the United States?

Yes. The Amazon advertising identity graph and the bid signals run on AWS US East. Amazon is certified under the EU US Data Privacy Framework. The 2021 SCCs are used as a fallback. A Transfer Impact Assessment must accompany the deployment.

Do I need a DPIA for Amazon Ads?

Yes. Profiling for advertising, identity matching with the Amazon shopper graph, transfers to the US and potential automated decisions on ad delivery meet several DPIA criteria in the EDPB list. Document scope, hashing, retention and the rights to access and erasure.

How do I implement Amazon Ads compliantly?

Load the Pixel after marketing consent, hash all PII before Conversion API calls, integrate with your CMP via IAB TCF v2.2 and Google Consent Mode v2, sign the joint controllership agreement, surface it in the privacy notice, route data subject requests via the Amazon Privacy Portal, and configure the strictest data minimisation in Amazon Marketing Cloud.

What are the alternatives to Amazon Ads?

Other retail media networks: Criteo Retail Media (EU based), Walmart Connect, Carrefour Links (France), Tesco Media (UK), Ahold Delhaize Media. For general programmatic without Amazon dependency: The Trade Desk, Xandr (Microsoft), Google DV360, Adform (Denmark), StackAdapt. None remove the consent obligation under EU law.

How do I update my cookie policy after adding Amazon Ads?

List Amazon Ads as a joint controller, declare the ad-id and ad-privacy cookies with retention, mention the Conversion API server side flow and the hashing, disclose the US transfers under the Data Privacy Framework, link to the Amazon Privacy Portal and provide an easy way to withdraw consent.

Related guide

Our guides on Amazon Ads

Amazon Consent Signal (ACS): the guide for Amazon Ads in Europe

What the Amazon Consent Signal is, who must send it to Amazon Ads, how it relates to IAB TCF, and how to pass amzn_ad_storage and amzn_user_data from your consent banner.

Read the guide
Same category

More services: Advertising

See the whole category

Bidmatic

Bidmatic is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bidmatic enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bidmatic empowers marketing teams to achieve measurable growth.

Marketing

VDX.tv

VDX.tv is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. VDX.tv enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, VDX.tv empowers marketing teams to achieve measurable growth.

Marketing

Google Call Conversion Tracking

Google Call Conversion Tracking is a conversion rate optimization (CRO) platform that helps businesses increase the percentage of website visitors who take desired actions. It combines A/B testing, user behavior analysis, and personalization tools to identify and remove conversion barriers. Google Call Conversion Tracking provides actionable insights through heatmaps, funnel analysis, and session recordings, enabling teams to implement data-driven improvements that boost revenue without increasing traffic costs.

Marketing

ContextBar

ContextBar is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ContextBar integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ContextBar helps organizations maintain robust websites that meet user expectations and technical requirements.

Marketing

A8.net

A8.net is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. A8.net supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, A8.net ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Innervate

Innervate is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Innervate provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Innervate helps deliver the right message to the right audience at the right time.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site