Adobe Experience Platform Identity Service

What the Adobe Identity Service is

The Adobe Experience Platform Identity Service is the foundational identity resolution layer of the Adobe Experience Cloud. It issues a persistent visitor identifier called the Experience Cloud ID (ECID), formerly known as the Marketing Cloud ID (MID). The ECID lets every Adobe product downstream (Adobe Analytics, Adobe Target, Adobe Audience Manager, Adobe Campaign, Adobe Commerce, Adobe Journey Optimizer) recognise the same visitor across sessions and across properties, stitching together separate touchpoints into a single profile.

What data is collected

The Identity Service writes the AMCV_<orgID>@AdobeOrg cookie on the operator's first party domain (2 year lifetime) containing the ECID. The same ECID is sent to demdex.net (the Adobe Audience Manager identity graph host) where it is joined to the Adobe Marketing Cloud ID and to third party partner cookies from DSPs and ad networks. The Web SDK (alloy.js) and the legacy Visitor Service handle cookie issuance, ID syncing, opt out and consent state. The Identity Service does not write tracking data itself, but every downstream Adobe product transmits its events with the ECID attached.

GDPR and ePrivacy implications

Because the Identity Service writes a persistent cookie that is not strictly necessary, ePrivacy Art. 5(3) requires prior informed consent before alloy.js or the legacy Visitor.js may execute. Under the GDPR the same processing requires consent under Art. 6(1)(a) since the ECID is a persistent online identifier and personal data. Operators should treat the Identity Service as a high risk processing activity because it is a cross product, cross device identifier shared across Adobe ecosystems. Demdex.net synchronisation involves transfer to Adobe Inc. in the US and joining with third party ad tech vendors.

Consent integration

Adobe Experience Platform supports the IAB Europe TCF v2.2 consent string, the Google Additional Consent string and a custom Adobe consent format. The Web SDK can be configured to wait for a consent decision before issuing the ECID, which is the recommended approach for GDPR compliance. With Adobe Launch or Adobe Tags, operators wire the consent signal from their Consent Management Platform to the Identity Service tag, then propagate the same signal to Analytics, Target and Audience Manager.

Data transfers and EU regional processing

Adobe operates a global edge network with US primary processing. Adobe Experience Platform Enterprise customers can choose EU regional processing for their tenant (Ireland or Frankfurt), which keeps event data and profile storage in the EU. However, the identity graph reconciliation that powers cross site recognition is global by design, so some processing always touches non EU infrastructure. Adobe self certifies under the EU US Data Privacy Framework, offers Standard Contractual Clauses, and has Binding Corporate Rules approved by the CNIL.

Practical compliance steps

Gate the Identity Service (alloy.js or Visitor.js) behind a Consent Management Platform with explicit advertising consent before issuing the ECID. Configure the Web SDK with consent integration so the ECID and downstream Adobe products honour the visitor's choice. Sign Adobe's Data Processing Addendum and Standard Contractual Clauses, and where relevant the BCR. Document the Identity Service in the record of processing, including the ECID, the AMCV cookie, the demdex.net synchronisation, the US transfer mechanism and the EU regional processing option chosen. Run a DPIA covering the cross product identity graph.