Akamai

Akamai cookies are primarily set by Bot Manager and Edge Server: _abck (1 year, bot detection state), bm_sz (4 hours, session token for the bot challenge), ak_bmsc (12 hours, edge session affinity) and akacd_* (configurable, cache directive). None of these are marketing cookies. They are written automatically when Bot Manager or Edge Server is active for the domain.

Akamai Bot Manager and App and API Protector set strictly necessary security cookies such as _abck, bm_sz, ak_bmsc, ak_bmsc_ssn and bm_lso that store bot risk signals and session integrity tokens. mPulse adds analytics cookies (RT, mp_rid) that store Real User Monitoring identifiers. Akamai itself does not set marketing or advertising cookies.

For the standard CDN and security stack (caching, WAF, DDoS, Bot Manager), no. These cookies are strictly necessary under ePrivacy art. 5(3) and the CNIL exempts them. Consent is required for Akamai products that profile visitors (Audience Insights, Predictive Personalization, Bot Manager Premier device intelligence beyond pure security).

No consent is required for content delivery and for strictly necessary security cookies (_abck, bm_sz, ak_bmsc), which fall under legitimate interest and the ePrivacy strictly necessary exemption. Consent is required for mPulse, Identity Cloud and any optional advanced fingerprinting feature that goes beyond what is strictly necessary to operate the service.

Article 6(1)(b) GDPR (performance of contract, the visitor requested the page) and art. 6(1)(f) (legitimate interest in security and delivery) for the CDN and security stack. Article 6(1)(a) consent for profiling products. Article 28 GDPR governs the processor relationship between the publisher and Akamai.

Content delivery, denial of service mitigation, web application firewall, basic bot management and account protection rely on legitimate interest under Article 6(1)(f) GDPR. mPulse Real User Monitoring, behavioural analytics, identity management and any optional personalization rely on consent under Article 6(1)(a) GDPR collected via a consent management platform.

Yes. EU traffic is normally served from European points of presence, but Akamai SOC operations and security intelligence access logs centrally from the US, India and Costa Rica. Akamai is certified under the EU US Data Privacy Framework with 2021 SCCs as a fallback. A Transfer Impact Assessment under EDPB Recommendation 01/2020 is required.

Akamai signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR with customers through its Data Processing Addendum and confirms participation in the EU US Data Privacy Framework. Supplementary measures include TLS 1.3, encryption at rest, ISO 27001, ISO 27017, ISO 27018, PCI DSS Level 1, SOC 2 Type II and the option to keep Datastream logs in regional data stores.

Not for the standard CDN alone. Required for Akamai Bot Manager Premier with device fingerprinting, Akamai Audience Insights, Predictive Personalization or Edge Auth. The DPIA should describe data flows, the SOC access from non EU countries and the retention of WAF logs.

A DPIA is recommended whenever Akamai is deployed with Bot Manager Premier, Account Protector, mPulse Real User Monitoring, Identity Cloud or EdgeWorkers running personalization logic, and whenever it protects high risk resources such as financial services, public sector portals or healthcare applications. Basic content delivery via Ion does not generally require a DPIA.

Sign the Data Processing Addendum with the EU residency commitment, list strictly necessary cookies in the privacy notice without gating, gate Audience Insights and similar profiling products behind consent, configure WAF log retention to the shortest needed, train teams on the Akamai DSAR portal and document the chain in your record of processing.

Sign the Akamai Data Processing Addendum, list Akamai in your record of processing activities, document security cookies in the cookie policy and explicitly mention the United States destination. Integrate mPulse and other optional features with a consent management platform so that they only collect data after consent, limit Datastream log retention and confirm that Bot Manager rules do not capture sensitive request bodies (passwords, payment data).

EU based alternatives include OVHcloud Edge (France), Gcore (Luxembourg), Bunny.net (Slovenia) and StackPath (with EU data centres) for CDN needs, plus Cloudflare for the EU Data Residency add on. For Bot Management specifically, Imperva and Radware offer European deployments. The right choice depends on edge coverage, security features and contractual data residency commitments.

Cloudflare (US with EU regional services), Fastly (US with Compute@Edge EU), Bunny.net (Slovenia, EU first), Gcore (Luxembourg), Stackpath, Edgio (formerly Limelight), CloudFront (US with EU regions) and Microsoft Azure Front Door. None are fully EU only at the corporate level; Bunny.net and Gcore are the most EU centric.

List the strictly necessary cookies (_abck, bm_sz, ak_bmsc, akacd_*) in the security section of the privacy notice, declare Akamai as a sub processor with EU residency, mention the EU US Data Privacy Framework certification, link to the Akamai Trust Center and explain why these cookies cannot be refused without breaking the service.

List Akamai Technologies Inc. as the processor of the CDN and security services, describe the strictly necessary security cookies (_abck, bm_sz, ak_bmsc, ak_bmsc_ssn, bm_lso), explain that mPulse cookies (RT, mp_rid) only load after consent, mention the United States destination under SCCs and the EU US Data Privacy Framework, and link to the Akamai Privacy Statement.