Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Omeda is a United States based customer data platform for publishers that combines identity resolution, email marketing and behavioural web tracking through cookies.
Omeda is a United States based customer data platform and audience marketing suite built primarily for publishers. It unifies subscriber and visitor data into a single profile through identity resolution, then activates that profile across email and other marketing channels. Its Olytics service tracks website behaviour with a lightweight JavaScript tag that works alongside existing page metadata. The platform aims to turn unknown visitors into known, addressable contacts.
Olytics sets cookies such as oly_anon_id for anonymous visitors and oly_enc_id for recognised customers, which carry identifiers used to track behaviour over time. Omeda collects page views, content interactions, form submissions and email engagement, and links these events to contact records when an individual is identified. Because the platform resolves identities and builds detailed profiles, the data it holds is clearly personal data under the GDPR. The combination of behavioural and contact data makes these profiles rich and potentially intrusive.
The Olytics cookies are not strictly necessary, so storing and reading them requires prior consent under Art. 5(3) of the ePrivacy Directive. The profiling, identity resolution and marketing activation must also comply with the GDPR, including a valid lawful basis and respect for data subject rights. Combining anonymous and known identifiers raises the stakes, because it can reveal a great deal about an individual. Controllers should be especially careful to honour objections to profiling and direct marketing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is the appropriate basis for the Olytics tracking and the marketing activation, and it must be freely given, specific, informed and unambiguous. The Olytics tag should remain blocked until the visitor opts in through a consent management platform, and identification should not happen before consent. Separate consents may be needed for analytics, profiling and electronic marketing communications. Visitors must be able to withdraw consent easily, after which tracking and marketing must stop.
Omeda processes data on infrastructure in the United States, which is a third country for European users. Transfers can rely on the EU US Data Privacy Framework where Omeda is certified, or on Standard Contractual Clauses supported by a transfer impact assessment and supplementary measures. The controller should confirm Omeda current certification status and document the chosen safeguard. Given the depth of the profiles involved, robust technical and organisational measures are particularly important.
Gate the Olytics tag behind a compliant consent banner and ensure identification only occurs after opt in. Conclude a data processing agreement with Omeda, record the United States transfer mechanism and run a transfer impact assessment. Configure retention limits, manage data subject requests and disclose Omeda clearly in the privacy and cookie policies. Review the configuration regularly so that profiling and marketing remain aligned with the consents collected.
Websites using Omeda must obtain user consent under GDPR regulations.
DPIA considerations
As a customer data platform, Omeda performs identity resolution and large scale profiling that combine behavioural events with contact records, which strongly indicates the need for a data protection impact assessment. Assess the matching of anonymous and known identifiers, the scale of audience building, the marketing activation and the international transfer to the United States. Document the lawful basis, retention, the rights of data subjects and the supplementary measures applied to the transfers.
Sample consent text
We use Omeda to recognise visitors, build audience profiles and personalise our communications. Omeda sets cookies such as oly_anon_id and oly_enc_id and processes data in the United States. It runs only after you accept marketing and analytics cookies.
Third-party domains contacted
omeda.comoa.omeda.comolytics.omeda.comcdn.omeda.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| oly_anon_id | third party | 1 year | Stores a pseudonymous identifier for anonymous visitors so that Olytics can track behaviour before a person is identified. |
| oly_enc_id | third party | 1 year | Stores an encrypted customer identifier used to link behaviour to a known contact once the visitor is recognised. |
| _om_session | third party | Session | Maintains the Olytics tracking session so that events within a single visit are grouped together. |
Omeda collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Through its Olytics service, Omeda sets cookies such as oly_anon_id for anonymous visitors and oly_enc_id for recognised customers, along with a session cookie. These identifiers track behaviour and connect it to contact records. None of them are strictly necessary, so they require consent before being placed.
Yes. The Olytics cookies and the profiling they enable are not strictly necessary, so prior consent is required under Art. 5(3) of the ePrivacy Directive and the GDPR. The Olytics tag must stay blocked until the visitor opts in, and identification should never happen before consent is given.
Consent under Art. 6(1)(a) GDPR is the appropriate basis for the behavioural tracking, identity resolution and marketing activation that Omeda performs. The ePrivacy Directive separately requires prior consent for the cookies. Legitimate interest is generally unsuitable given the scale of profiling and the matching of anonymous and known data.
Yes. Omeda processes personal data on infrastructure in the United States, which is a third country for European users. Transfers should rely on the EU US Data Privacy Framework where Omeda is certified, or on Standard Contractual Clauses with a transfer impact assessment and supplementary measures.
Yes, a data protection impact assessment is strongly advisable. Omeda carries out identity resolution and large scale profiling that combine behavioural and contact data and transfer it to the United States. The assessment should weigh the intrusiveness of the profiling and document the safeguards in place.
Block the Olytics tag behind a consent management platform and ensure no identification or tracking occurs before opt in. Sign a data processing agreement with Omeda, record the US transfer mechanism and run a transfer impact assessment. Set retention limits, support data subject requests and keep marketing aligned with the consents you hold.
European hosted customer data platforms and consent first marketing tools can reduce third country transfers and may offer stronger data residency guarantees. Lighter analytics tools such as Matomo can cover web measurement without full identity resolution. Any alternative still requires a lawful basis, transparency and careful management of profiling and marketing consents.
List the Olytics cookies oly_anon_id and oly_enc_id with their purpose and duration, and name Omeda as a recipient that processes data in the United States. Explain that consent is required for tracking and marketing and how it can be withdrawn. Keep the policy aligned with the live configuration and review it whenever audiences or activations change.