Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
IBM Coremetrics is an enterprise digital analytics platform that originated at Coremetrics, was acquired by IBM in 2010 and is now operated by Acoustic as Acoustic Analytics. It places a JavaScript tag and cookies on retail and enterprise sites to capture page views, conversions, search terms and click level events, and to build persistent visitor profiles for segmentation and personalisation. Data is processed in the United States, which makes Coremetrics a high risk tracker under the GDPR and the ePrivacy Directive.
IBM Coremetrics is the legacy name of an enterprise digital analytics suite, now operated and rebranded by Acoustic as Acoustic Analytics. It targets retail, banking and large enterprise customers with deep funnel reporting, product affinity analysis and segmentation. Implementation is based on the eluminate.js page tag loaded from data.coremetrics.com or a CNAME on the customer domain.
Coremetrics records page views, search terms, basket adds, transactions, click coordinates and time on page. It assigns a persistent visitor ID stored in the CoreID6 cookie and links activity across sessions and devices when login data is provided. Customer data (registered ID, email hash) can be sent in custom attributes. Optional Click to Identify enriches the visitor profile with personally identifiable information.
The CoreID6 and CoreID6_HHTL cookies fall under Article 5(3) ePrivacy and require prior consent. The persistent profiling activity falls under Article 6(1)(a) GDPR. Because Coremetrics is integrated with Acoustic Marketing Cloud and exports data to advertising activations, legitimate interest is not admissible.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The eluminate.js tag must be blocked until explicit, granular opt in consent has been given through the CMP. Refusal must be as easy as accepting. The CoreID6 cookie has a default lifetime of 15 years, which is incompatible with the CNIL maximum 13 month retention for analytics cookies and must be reduced server side or via the Coremetrics admin console.
Acoustic, L.P. is headquartered in the United States. Coremetrics ingestion endpoints (data.coremetrics.com, libs.coremetrics.com) operate from US data centres. Personal data is therefore transferred to the United States. Customers must rely on the Acoustic DPF certification or signed Standard Contractual Clauses, document a transfer impact assessment and consider EU data residency on Acoustic Analytics where available.
Block eluminate.js until consent, reduce CoreID6 cookie lifetime to 13 months, sign the Acoustic DPA, store the DPF reference, run a transfer impact assessment, document the joint flows with Acoustic Marketing Cloud, list Coremetrics in the privacy and cookie policies and review the configuration after each Acoustic platform release.
Websites using IBM Coremetrics must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended for IBM Coremetrics because it builds large scale persistent visitor profiles, captures click level data, may be combined with the Acoustic marketing cloud and transfers personal data to the United States. The DPIA must address visitor ID persistence, retention and joint controllership with Acoustic.
Sample consent text
We use IBM Coremetrics, operated by Acoustic, to measure how our site is used and to personalise the experience. Coremetrics sets cookies, builds a persistent visitor ID and transfers data to the United States. We only load Coremetrics after you click Accept. You can withdraw consent at any time from the cookie settings.
Third-party domains contacted
data.coremetrics.comlibs.coremetrics.comwelcome.coremetrics.comacoustic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| CoreID6 | persistent | 13 months (default 15 years, must be reduced) | Persistent unique visitor identifier used by Coremetrics to link sessions and pages across visits. |
| CoreM_State_Live | persistent | 13 months | Stores the latest visitor activity state and last interaction timestamp. |
| CoreID6_HHTL | persistent | 13 months | Variant of the CoreID6 visitor identifier used for households or shared device tracking. |
| cmTPSet | persistent | 1 year | Indicates whether third party cookie placement was successful for the Coremetrics tag. |
| 90279749_clogin | persistent | 13 months | Internal identifier used by the Coremetrics login experience tracking. |
IBM Coremetrics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Coremetrics sets the first party cookies CoreID6, CoreM_State_Live, CoreID6_HHTL, cmTPSet and 90279749_clogin used to identify a unique visitor and link sessions. CoreID6 has a default lifetime of 15 years that must be reduced to 13 months for EU compliance.
Yes. The cookies fall under Article 5(3) ePrivacy and the cross session profiling falls under Article 6(1)(a) GDPR. The eluminate.js tag must be blocked until explicit, granular opt in consent has been collected.
Consent (Art. 6(1)(a) GDPR). Legitimate interest is not admissible because Coremetrics builds persistent visitor profiles, can be enriched with personally identifiable information and is integrated with Acoustic Marketing Cloud advertising activations.
Yes. Acoustic, L.P. is a US company and the Coremetrics ingestion endpoints run in the United States. Transfers rely on the EU/US Data Privacy Framework and Standard Contractual Clauses, and require a documented transfer impact assessment.
Yes. The combination of large scale persistent profiling, click level capture, integration with the Acoustic Marketing Cloud and US transfers triggers the DPIA criteria of WP248 and the EDPB threshold guidance.
Tag block eluminate.js until consent, reduce CoreID6 cookie lifetime to 13 months, sign the Acoustic DPA, store the DPF certification reference, document the transfer impact assessment, list Coremetrics in the privacy and cookie policies and audit the configuration after each Acoustic platform release.
Modern alternatives for enterprise digital analytics include Adobe Analytics, Google Analytics 4 with EU data residency add ons, AT Internet/Piano Analytics (EU based), Contentsquare and Matomo Cloud. None of them eliminate compliance work entirely, but Piano Analytics and Matomo Cloud offer EU only hosting by default.
List IBM Coremetrics with the operator (Acoustic, L.P.), the purpose (digital analytics and personalisation), the cookies (CoreID6, CoreM_State_Live, CoreID6_HHTL) with retention reduced to 13 months, the legal basis (consent), the transfer destination (United States) and the safeguards (DPF, SCC, TIA).