Salesforce Audience Studio

Third party cookies _kuid_ and kxchocolate on krxd.net, plus first party cookies depending on the integration. They store hashed user identifiers used for segmentation.

Three cookies: krux (third party on krxd.net, 1 year), _kuid_ (first party visitor identifier, 1 year) and _ks (third party segment payload, 30 days). A localStorage entry stores the same identifier as a fallback when third party cookies are blocked.

Yes. The DMP is used for advertising and cross site profiling, both of which require consent under Article 5(3) ePrivacy.

Yes, always. Audience Studio is a third party advertising DMP that builds cross site behavioural profiles, which requires explicit prior consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. The CNIL and the Belgian APD have explicitly cited similar third party DMPs in enforcement decisions.

Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. SCCs and the EU US Data Privacy Framework cover the US transfer.

Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy). Legitimate interest is not appropriate because the cross site profile and the activation on advertising networks create a high risk to data subject rights and require granular per purpose consent under the IAB TCF v2.2.

Yes. Audience Studio processes data on US infrastructure. Salesforce signs SCCs and is DPF certified.

Yes by default. Audience Studio runs on AWS US East and US West. EU residency on AWS Frankfurt is available on enterprise contract. Salesforce is certified under the EU US Data Privacy Framework and the DPA includes Standard Contractual Clauses as a fallback.

Required given the cross site profiling, large scale processing and US transfer.

Yes. The cross site profile build, the systematic monitoring across publishers and the activation on advertising networks meet several criteria of mandatory DPIA under Art. 35(3) GDPR (systematic monitoring on a large scale, large scale processing for profiling).

Plan a migration (Salesforce is sunsetting the product). In the meantime, gate the tag behind a TCF CMP, pass valid consent strings, run a DPIA and document activation partners.

Sign the Salesforce DPA, complete a DPIA, request EU residency where possible, wire the Krux pixel to your CMP so it loads only after explicit marketing consent, push consent updates via the Krux Consent API and document Audience Studio in your Article 30 register. Plan the migration to Salesforce Data Cloud before the 2025 sunset.

Salesforce Data Cloud is the official replacement (consent first, first party). Other DMPs and CDPs include Adobe Audience Manager (also being retired), Adobe Real Time CDP, Tealium AudienceStream, Lytics, BlueConic and the open source RudderStack Customer Data Platform. EU vendors include Commanders Act and Mediarithmics.

Salesforce Data Cloud, Tealium AudienceStream, Segment, Adobe Real Time CDP, mParticle, Permutive. EU based vendors limit transfer issues.

Document _kuid_, kxchocolate and any associated first party cookies, their purpose and duration, plus the activation partners list.

List krux, _kuid_ and _ks with their lifetime and purpose. Mention Salesforce.com Inc as a joint controller and the activation networks as recipients. Update the policy when audiences are exported to a new advertising network and when the planned migration to Salesforce Data Cloud takes effect.