Akamai mPulse

What is Akamai mPulse

Akamai mPulse is a real user monitoring (RUM) and digital experience analytics product. It uses an open source script called Boomerang (boomerang.js) which is injected on every page, measures page navigation timings, Core Web Vitals, resource loading, JavaScript errors and custom application events, and posts them as beacons to mpulse.akamai.com for processing and dashboarding. mPulse is sold to large web properties for performance and conversion analysis, often integrated with the Akamai CDN to correlate edge data with browser data.

What data and cookies mPulse collects

Each page load generates a beacon containing IP address, User Agent, referrer, URL, screen and viewport, network type and a battery of timing metrics. mPulse sets a first party RT cookie that stores a persistent visitor identifier and the previous page URL so that navigation flows can be reconstructed. Custom dimensions configured by the merchant (logged in state, cart value, A/B variant) are attached to the beacon. The data is retained for the period selected in the mPulse plan, typically 30 to 90 days for raw beacons.

GDPR and ePrivacy implications

The RT cookie is set on the first page view and persists for one year, which puts it under Article 5(3) of the ePrivacy Directive: consent is required because it is not strictly necessary to provide the requested service. The IP address sent in the beacon is personal data under the GDPR. The Akamai EU US data transfer is governed by the EU US Data Privacy Framework and Standard Contractual Clauses. Some EU regulators (CNIL exemption for measurement, BfDI guidance) allow strictly aggregated, first party, non shared performance measurement without consent, but mPulse does not meet that test in its default configuration.

Is consent required

In most EU jurisdictions yes, because mPulse sets a persistent cookie, transmits IP addresses to a US controller and goes beyond strictly aggregated measurement. Block boomerang.js until consent is captured. The Akamai documentation supports loading mPulse asynchronously after a custom event, which makes it easy to gate the script behind a CMP. If you want to keep some measurement without consent, you can run a parallel server side performance log on your own infrastructure.

Data transfers to the United States

Akamai Technologies, Inc. is headquartered in Cambridge, Massachusetts, and processes mPulse beacons on US infrastructure. Akamai is self certified under the EU US Data Privacy Framework, which provides an adequacy decision for transfers to certified Akamai entities. Akamai also offers the EU SCCs through its Data Processing Addendum. EU customers can request a Transfer Impact Assessment summary covering the Akamai stance on US surveillance law and the technical and contractual safeguards.

Practical compliance steps

Gate the boomerang.js loader behind your consent manager under the Analytics category. Sign the Akamai DPA and reference the DPF or SCCs in your privacy policy. Disable any custom dimensions that contain directly identifying information, and prefer hashed or pseudonymous identifiers for logged in visitors. Where possible, configure the mPulse retention to the shortest period your dashboards still need (often 30 days is enough). Document the integration in the Article 30 record.