CMS

Adobe Experience Manager

Adobe Experience Manager (AEM) is Adobe's enterprise content management system, comprising AEM Sites, AEM Assets and AEM Forms. It is delivered as a self hosted product or as AEM as a Cloud Service, and ships with optional ContextHub personalisation that can set behavioural cookies.

Block Adobe Experience Manager until consent Scan my site

Overview

What does Adobe Experience Manager do?

What is Adobe Experience Manager?

Adobe Experience Manager (AEM) is Adobe's enterprise content management system, marketed as part of the Adobe Experience Cloud. AEM Sites delivers public websites and editorial workflows, AEM Assets manages images, video and document libraries, AEM Forms handles digital forms and approvals. The product is offered as a customer hosted Java application, as Adobe Managed Services, or as AEM as a Cloud Service.

Cookies and data collected

By default AEM sets a handful of strictly necessary cookies such as login-token, cq-authoring-mode and the JSESSIONID for the underlying Java application. ContextHub, the personalisation framework bundled with AEM Sites, can additionally write cq.profile, cq.products and cq.surferinfo cookies in the visitor browser to drive segmentation. When AEM is integrated with Adobe Analytics, Adobe Target or the Experience Cloud Identity Service, the corresponding cookies and identifiers (AMCV_, mbox, ECID) are set as well.

GDPR and ePrivacy implications

Login and CSRF cookies are strictly necessary and exempt from consent under Article 5(3) of the ePrivacy Directive. ContextHub segmentation cookies and any Adobe Analytics or Target integration go beyond strictly necessary processing: they require informed, prior consent. Where AEM is hosted by Adobe (AMS or Cloud Service), processing on behalf of the customer is governed by the Adobe Data Processing Addendum.

Consent requirements

Strictly necessary AEM cookies are exempt. Personalisation, A/B testing and analytics integrations must be gated behind a Consent Management Platform. The AEM Sites integration with Adobe Tags or Launch makes it straightforward to wire third party scripts to a CMP signal. ContextHub itself does not include native consent management, so disable or restrict it until the visitor accepts the analytics or marketing category.

Data transfers

AEM as a Cloud Service and Adobe Managed Services support EU regional hosting on AWS or Azure. Even then, support telemetry, backups, and Experience Cloud integrations (Analytics, Target, ECID) usually flow through US Adobe systems. Adobe relies on the EU US Data Privacy Framework and SCCs. Customers running self hosted AEM in their own EU data centre can keep CMS data on shore but must still review any Experience Cloud add ons.

Practical compliance steps

Audit which AEM components are active (ContextHub, Personalisation, Search and Promote, Analytics integration). Configure your CMP to block personalisation, A/B testing and analytics scripts until consent is granted. Use AEM Tags or Launch to load third party scripts conditionally on consent state. Sign Adobe's DPA, choose EU hosting where available, document data flows in your record of processing activities, and run a DPIA when ContextHub or Target is used at scale.

Compliance

Adobe Experience Manager and the GDPR

Adobe Experience Manager is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis: Strictly necessary cookies (login, CSRF) do not require consent, but ContextHub personalisation cookies, integrations with Adobe Analytics or Target, and any third party scripts loaded through AEM require consent (Art. 6(1)(a) GDPR) before being set.
Risk level: medium
Applicable regulations: GDPR, ePrivacy Directive (Cookie Law), CCPA

Impact assessment (DPIA)

AEM itself is a CMS and most cookies it sets directly (login, CSRF, authoring mode) are strictly necessary. A DPIA may be needed where AEM Sites is combined with ContextHub personalisation, Adobe Target experiments, Adobe Analytics, or large scale profiling using the Experience Cloud ID. Document the full Experience Cloud integration footprint before exempting AEM from Art. 35 GDPR review.

Sample text for your banner

Our website is built on Adobe Experience Manager. We use Adobe ContextHub and Adobe Analytics to personalise content and measure performance. These services may transfer data to Adobe Inc. in the United States. Please confirm your consent below.

Cookies and trackers

What Adobe Experience Manager sets and contacts

Tracking method: JavaScript and server side CMS, ships with optional ContextHub personalisation module, can set first party authentication cookies (login-token, cq-authoring-mode) plus analytics or personalisation cookies when AEM Sites is configured with Target, Analytics or ContextHub stores
Server location: United States (Adobe Inc.) by default. Adobe Managed Services (AMS) and Adobe Experience Manager as a Cloud Service offer EU regional hosting (Ireland, Netherlands, Germany) on AWS or Azure. Self hosted AEM can run anywhere the customer chooses.
Cookieless mode available: Yes
Data transferred outside the EU: Adobe Inc. is US headquartered. Even when AEM Sites is hosted in an EU region, Adobe support, telemetry, the Adobe Experience Cloud Identity Service (ECID), and integrations with Adobe Analytics or Target route data through US infrastructure. Adobe relies on SCCs and the EU US Data Privacy Framework. Self hosted AEM avoids these flows if no Adobe Cloud integration is enabled.

Cookies set (5)

Name	Type	Duration	Purpose
login-token	Strictly necessary (AEM authoring login)	Session	Maintains the authenticated session for editors in the AEM author environment
cq-authoring-mode	Strictly necessary (AEM authoring)	Session	Stores the active editing mode (preview, edit, design) for AEM authors
JSESSIONID	Strictly necessary (Java application server)	Session	Identifies the user session on the underlying Java application server
cq.profile	Personalisation (ContextHub)	Persistent (varies)	Stores the ContextHub user profile used for segmentation and personalisation
cq.surferinfo	Personalisation (ContextHub)	Persistent (varies)	Captures device, browser and referrer signals for ContextHub segmentation

Third-party domains contacted (5)

adobeaemcloud.com
adobedtm.com
omtrdc.net
demdex.net
adobe.io

Questions

Frequently asked questions about Adobe Experience Manager

Can't find your question? Write to us, we answer fast.

Write to us

What cookies does Adobe Experience Manager set?

By itself AEM sets only a few strictly necessary cookies (login-token, cq-authoring-mode, JSESSIONID). With ContextHub enabled it adds cq.profile, cq.products and cq.surferinfo to support segmentation. Integrations with Adobe Analytics, Target or the Experience Cloud Identity Service introduce additional cookies (AMCV_, mbox, ECID) that go beyond strictly necessary processing.

Is consent required to run AEM?

Operating AEM as a pure CMS only requires the strictly necessary cookies, which are exempt from consent. As soon as you turn on ContextHub personalisation, A/B testing through Adobe Target, or Adobe Analytics tracking, you must obtain prior explicit consent before those scripts run.

What is the legal basis for processing in AEM?

Strictly necessary CMS cookies rely on Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(f) (legitimate interest in keeping the site running). Personalisation, analytics and marketing cookies require consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy.

Does AEM transfer data outside the EU?

Self hosted AEM in an EU data centre processes CMS data locally. Adobe Managed Services and AEM as a Cloud Service offer EU regions, but Adobe support, telemetry, and any Experience Cloud integration (Analytics, Target, ECID) typically route through the US. Adobe relies on SCCs and the EU US Data Privacy Framework.

Do I need a DPIA for AEM?

A bare AEM Sites deployment for editorial content rarely requires a DPIA. A DPIA becomes appropriate when ContextHub, Target experiments, behavioural personalisation, or large scale analytics integrations are layered on top of AEM, especially when combined with the Experience Cloud Identity Service.

How do I deploy AEM compliantly?

Audit active components and integrations, route every personalisation and analytics script through a Consent Management Platform (Adobe Tags / Launch make this easier), choose EU hosting where possible, sign the Adobe DPA, and document Experience Cloud data flows in your RoPA. Keep ContextHub disabled by default until consent is granted.

Are there alternatives to AEM?

For Europe focused customers, alternatives include open source CMS like TYPO3, Drupal or Strapi (EU friendly hosting), and commercial European platforms like Magnolia, Hippo (Bloomreach) or Storyblok. None offer the same Experience Cloud integration but they reduce US data flow risk.

How do I update my cookie policy for AEM?

List the strictly necessary AEM cookies separately and exempt them from consent. Disclose ContextHub cookies under a personalisation category and Adobe Analytics or Target cookies under analytics and marketing categories. Reference Adobe as a sub processor and link to the Adobe privacy policy and DPA.

Brushd

Brushd is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Brushd offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Brushd empowers organizations to optimize strategy and maximize return on investment.

Analytics

Learnbase

Learnbase is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Learnbase integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Learnbase helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

aThemes Hiero

aThemes Hiero is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. aThemes Hiero supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, aThemes Hiero ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Contentstack

Contentstack is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Contentstack integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Contentstack helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

OpenElement

OpenElement is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. OpenElement supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, OpenElement ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Adobe Portfolio

Adobe Portfolio is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Adobe Portfolio offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Adobe Portfolio empowers organizations to optimize strategy and maximize return on investment.