Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Salesforce Audience Studio is the Data Management Platform formerly known as Krux, acquired by Salesforce in 2016 and integrated into the Marketing Cloud suite. It collects cross site behavioural data through a third party pixel, builds segmented audiences and activates them on advertising networks (Google Ads, Meta, The Trade Desk). Salesforce announced in 2024 that Audience Studio will be retired in 2025, replaced by Data Cloud.
Salesforce Audience Studio is the rebranded name of Krux Digital, a Data Management Platform acquired by Salesforce in 2016 for 700 million USD and integrated into the Marketing Cloud suite. It is a third party advertising DMP that builds cross site behavioural profiles, segments them and activates them on advertising networks (Google Ads, Meta, The Trade Desk, Amazon DSP). Salesforce announced in February 2024 that Audience Studio will be retired in 2025 and replaced by Salesforce Data Cloud, the consent first first party customer data platform.
The publisher inserts the Krux JavaScript pixel in the head of every page. The pixel drops third party cookies (krux, _kuid_, _ks) and a localStorage entry that contain a pseudonymous visitor identifier. The data is sent to the Salesforce DMP infrastructure on AWS where it is combined with data from every other publisher running the Krux pixel. Audiences are then exported to advertising networks via server to server APIs.
Audience Studio sets the krux third party cookie (Krux Digital domain, 1 year), the _kuid_ first party cookie (visitor identifier, 1 year) and the _ks third party cookie (segment payload, 30 days). It collects URL, referrer, device, browser, IP address (mapped to a coarse country and ISP), declared interests, demographics inferred from third party data partners and any custom attribute the publisher pushes via the Krux Control API.
Audience Studio is the textbook case of a third party advertising DMP that always requires explicit prior consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3). It is also a textbook case of joint controllership with the activation networks. The CNIL (FR) has explicitly cited Krux deployments in the 2020 sanctions against publishers, and the Belgian APD targeted similar third party DMPs in its 2022 IAB TCF decision.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Wire the Krux pixel to your CMP so that it loads only after the visitor has accepted the marketing or advertising data category. Push the consent state to Audience Studio via the Krux Consent API (krux("consent:accept")) so that the segment build and activation can be paused on a per visitor basis. Use the IAB TCF v2.2 vendor list to expose Salesforce.com Inc as a vendor and let the visitor opt out per purpose.
By default Audience Studio runs on AWS US East and US West. EU residency on AWS Frankfurt is available on enterprise contract. Salesforce is certified under the EU US Data Privacy Framework, which currently provides the legal basis for the transfer. The DPA also includes Standard Contractual Clauses as a fallback. A Transfer Impact Assessment is recommended given the cross site profiling nature of the processing.
Sign the Salesforce DPA, complete a DPIA covering the cross site profile build, the activation networks and the US transfer, request EU residency on the enterprise contract, wire the Krux pixel to your CMP, push consent updates via the Krux Consent API and document Audience Studio in your Article 30 register. Plan the migration to Salesforce Data Cloud before the 2025 sunset.
Websites using Salesforce Audience Studio must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is required because Audience Studio combines cross site behavioural data into individual profiles for advertising activation, which the EDPB Guidelines on DPIAs flag as systematic monitoring at scale and large scale processing for profiling. The DPIA must cover the US transfer, the joint controllership with the activation networks and the planned migration to Salesforce Data Cloud.
Sample consent text
We use Salesforce Audience Studio to build advertising audiences from your browsing on this and other partner sites. This requires your explicit consent. You can refuse and we will not load the Krux pixel. Your consent can be withdrawn at any time via the Cookie preferences link in the footer.
Third-party domains contacted
krxd.netkrxd.netbeacon.krxd.netbeacon.krxd.netcdn.krxd.netcdn.krxd.netsalesforce.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _kuid_ | third_party | 6 months | Cross site user identifier used by Audience Studio (Krux) for audience segmentation. |
| krux | third_party | 1 year | Krux Digital cross site visitor identifier used to enrich the audience profile. |
| kxchocolate | third_party | 6 months | Salesforce DMP cookie used to recognise visitors across partner sites. |
| _kuid_ | first_party | 1 year | First party visitor identifier mapped to the central Audience Studio profile. |
| _ks | third_party | 30 days | Carries the segment payload for activation on advertising networks. |
Salesforce Audience Studio collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Third party cookies _kuid_ and kxchocolate on krxd.net, plus first party cookies depending on the integration. They store hashed user identifiers used for segmentation.
Three cookies: krux (third party on krxd.net, 1 year), _kuid_ (first party visitor identifier, 1 year) and _ks (third party segment payload, 30 days). A localStorage entry stores the same identifier as a fallback when third party cookies are blocked.
Yes. The DMP is used for advertising and cross site profiling, both of which require consent under Article 5(3) ePrivacy.
Yes, always. Audience Studio is a third party advertising DMP that builds cross site behavioural profiles, which requires explicit prior consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. The CNIL and the Belgian APD have explicitly cited similar third party DMPs in enforcement decisions.
Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. SCCs and the EU US Data Privacy Framework cover the US transfer.
Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy). Legitimate interest is not appropriate because the cross site profile and the activation on advertising networks create a high risk to data subject rights and require granular per purpose consent under the IAB TCF v2.2.
Yes. Audience Studio processes data on US infrastructure. Salesforce signs SCCs and is DPF certified.
Yes by default. Audience Studio runs on AWS US East and US West. EU residency on AWS Frankfurt is available on enterprise contract. Salesforce is certified under the EU US Data Privacy Framework and the DPA includes Standard Contractual Clauses as a fallback.
Required given the cross site profiling, large scale processing and US transfer.
Yes. The cross site profile build, the systematic monitoring across publishers and the activation on advertising networks meet several criteria of mandatory DPIA under Art. 35(3) GDPR (systematic monitoring on a large scale, large scale processing for profiling).
Plan a migration (Salesforce is sunsetting the product). In the meantime, gate the tag behind a TCF CMP, pass valid consent strings, run a DPIA and document activation partners.
Sign the Salesforce DPA, complete a DPIA, request EU residency where possible, wire the Krux pixel to your CMP so it loads only after explicit marketing consent, push consent updates via the Krux Consent API and document Audience Studio in your Article 30 register. Plan the migration to Salesforce Data Cloud before the 2025 sunset.
Salesforce Data Cloud is the official replacement (consent first, first party). Other DMPs and CDPs include Adobe Audience Manager (also being retired), Adobe Real Time CDP, Tealium AudienceStream, Lytics, BlueConic and the open source RudderStack Customer Data Platform. EU vendors include Commanders Act and Mediarithmics.
Salesforce Data Cloud, Tealium AudienceStream, Segment, Adobe Real Time CDP, mParticle, Permutive. EU based vendors limit transfer issues.
Document _kuid_, kxchocolate and any associated first party cookies, their purpose and duration, plus the activation partners list.
List krux, _kuid_ and _ks with their lifetime and purpose. Mention Salesforce.com Inc as a joint controller and the activation networks as recipients. Update the policy when audiences are exported to a new advertising network and when the planned migration to Salesforce Data Cloud takes effect.