Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Promo AI is a US AI driven advertising and video creative platform that personalises ads, tracks conversions and sets behavioural identifiers, requiring prior GDPR consent under Article 5(3) ePrivacy.
Promo AI is a US based advertising and video creative platform that uses generative AI to produce, personalise and serve ad units across social, display and connected TV channels. It combines a creative engine with audience analytics, A/B testing and conversion tracking to optimise marketing campaigns. The platform deploys a JavaScript SDK and conversion pixels on customer websites, which sets identifiers and reports back behavioural events. Because the service personalises ads based on visitor behaviour, it is treated as advertising and audience profiling under GDPR and ePrivacy.
The Promo AI tag sets cookies such as _promo_uid (visitor identifier), _promo_session (session correlation) and _promo_ad_clicks (creative engagement state). The platform receives the visitor IP, user agent, referrer, page URL, on site events (page view, video view, add to cart, purchase), creative identifiers and the campaign that drove the visit. When the customer connects their advertising accounts, additional signals like ad impressions, clicks and conversions are exchanged with Meta, Google, TikTok and other ad networks for optimisation.
Promo AI is used for advertising personalisation and conversion tracking, two activities that fall outside any consent exemption under Article 5(3) of the ePrivacy Directive. The CNIL, BfDI, AEPD and ICO require prior, freely given, specific and informed consent before any identifier is set or read. The legal basis under Article 6(1)(a) GDPR is consent. Profiling at this scale also calls for a DPIA, and the AI Act adds transparency obligations regarding AI generated creatives.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Promo AI is operated from the United States and processes data on US cloud infrastructure for AI generation and analytics. Transfers from the EEA rely on Standard Contractual Clauses and on EU US Data Privacy Framework certification where the entity is enrolled. A transfer impact assessment must evaluate the impact of US surveillance laws (FISA 702, EO 12333) on the visitor data shared with the platform. Document onward transfers to advertising partners in your record of processing activities.
Block the Promo AI script and conversion pixels in your CMP until consent. Map the service under advertising or audience targeting, never strictly necessary. Sign SCCs, complete a TIA, run a DPIA covering the profiling and AI generation, and add Promo AI to your record of processing activities. For AI Act compliance, disclose to users that creatives shown to them are AI generated and document the data used to fine tune the models. Align retention rules across the website tag, the ad accounts and the analytics warehouse.
Websites using Promo AI must obtain user consent under GDPR regulations.
DPIA considerations
High risk DPIA recommended due to large scale advertising profiling, AI driven creative personalisation, behavioural conversion tracking, US transfers and potential AI Act transparency obligations.
Sample consent text
We use Promo AI (advertising personalisation and AI generated creative, US vendor) which sets identifiers on your device and shares signals with Promo AI in the United States to tailor ads. Without your consent these identifiers are not set or read.
Third-party domains contacted
promo.comcdn.promo.comapp.promo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _promo_uid | third_party | 12 months | Persistent visitor identifier used to recognise returning visitors and tie them to advertising audiences. |
| _promo_session | third_party | session | Session correlation identifier that groups events for the current visit. |
| _promo_ad_clicks | third_party | 90 days | Stores creative engagement state (impressions, clicks, completions) for AI driven optimisation. |
| _promo_conv | third_party | 30 days | Conversion attribution cookie used to credit a campaign or creative when a goal is completed. |
Promo AI places tracking cookies for advertising — comply with GDPR using FlowConsent.
Promo AI typically sets _promo_uid (visitor identifier), _promo_session (session correlation) and _promo_ad_clicks (creative engagement state). Conversion pixels can also write campaign or click identifiers depending on the connected ad networks.
Yes. Promo AI is used for advertising and audience profiling, so it falls outside the strictly necessary exemption of Article 5(3) of the ePrivacy Directive. Prior, freely given, specific and informed consent is mandatory and the script must be blocked by a CMP until acceptance.
Article 6(1)(a) GDPR (consent) is the only realistic basis for cross site advertising profiling and conversion tracking. Legitimate interest cannot bypass the ePrivacy consent requirement. AI generated creative also calls for AI Act transparency notices.
Yes. Promo AI runs on US cloud infrastructure for AI generation and analytics. Transfers rely on Standard Contractual Clauses, supplemented by EU US Data Privacy Framework certification when applicable, and a transfer impact assessment.
A DPIA is strongly recommended. The processing involves systematic, large scale advertising profiling, AI driven creative personalisation, behavioural conversion tracking and US transfers, all of which trigger high risk indicators in WP29 and EDPB guidelines. AI Act conformity assessments may also apply.
Block the Promo AI script and conversion pixels in your CMP until consent. Map the service under advertising or audience targeting, never strictly necessary. Sign SCCs, complete a TIA, run a DPIA, document Promo AI in your record of processing activities, and add an AI generated content disclosure for AI Act compliance.
European AI driven creative platforms include Smartly.io (Finland, recently acquired), Creatopy (Romania), Pencil (UK) and Adcreative.ai (UK based but with US infrastructure). For privacy first measurement, Piwik PRO and Matomo offer European hosted analytics that pair well with creative tools.
List the Promo AI cookies (_promo_uid, _promo_session, _promo_ad_clicks), state the advertising and AI driven personalisation purpose, mention the data shared (events, creative IDs, IP, user agent), name the Promo AI vendor with US transfers under SCCs, link to the consent withdrawal mechanism and the AI generated content disclosure.