> Using Oracle Eloqua under the GDPR: cookies set by the tracking script, consent rules, US transfers with an EU pod option and DPIA tips. > > Canonical: https://www.flowconsent.com/en/services/marketing/eloqua Marketing # Oracle Eloqua Marketing · [Official website](https://eloqua.com) Oracle Eloqua is an enterprise B2B marketing automation platform that uses a JavaScript tracking script and first party cookies to profile visitors, link form submissions to known contacts and orchestrate multi channel campaigns. [Block Oracle Eloqua until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 5 - Third-party domains 5 - Servers United States (Oracle Cloud, with optional EU pod hosting available) Overview ## What does Oracle Eloqua do? ## What Oracle Eloqua does Oracle Eloqua is an enterprise grade B2B marketing automation platform owned by Oracle. It supports lead management, email marketing, multi channel campaign orchestration, dynamic content, lead scoring and integration with CRM systems such as Oracle CX, Salesforce and Microsoft Dynamics. Eloqua is typically deployed by mid market and enterprise organisations with complex B2B sales cycles where marketing teams need to nurture leads over weeks or months and pass qualified contacts to sales. ## How the Eloqua tracking script behaves The Eloqua tracking script is a small JavaScript snippet placed on the customer website. When a visitor loads a page, the script issues a request to a customer specific Eloqua tracking subdomain, typically in the form s###.t.eloqua.com, and to the endpoint s.aspx. The response sets first party cookies on the customer domain so subsequent visits can be linked. Eloqua collects URL, referrer, user agent, IP address, time on page and form submissions. When a visitor submits a form that maps to a known contact, the previously anonymous browsing history is retroactively associated with the contact record, building a long term behavioural profile. ## Cookies set by Eloqua Eloqua sets first party cookies such as ELOQUA (a persistent visitor identifier valid for around two years), ELQSTATUS (records whether tracking is active and consent has been granted) and the temporary \_elqQ queue used during page load. Because these cookies build a persistent profile linked to identified contacts, they are not strictly necessary and require informed consent under the ePrivacy Directive and Article 6(1)(a) GDPR. ## US transfer and the EU pod option By default, Eloqua processes data on Oracle infrastructure in the United States. Oracle is certified under the EU US Data Privacy Framework and offers Standard Contractual Clauses as additional safeguards. Oracle also offers an EU pod that hosts Eloqua data within the European Union, which is a practical mitigation for organisations subject to strict data residency requirements. Even with an EU pod, customers should perform a transfer impact assessment because Oracle remains a US parent company subject to US law including FISA 702 and Executive Order 12333. ## The B2B exemption debate Some controllers argue that B2B marketing communications fall under a soft opt in or under legitimate interest. This argument is fragile under EU law. The ePrivacy Directive Article 5(3) on cookies and similar technologies does not distinguish between B2B and B2C contexts. National regulators including the CNIL, the ICO, the BfDI and the AEPD all require prior informed consent for non essential tracking cookies regardless of audience. The Eloqua tracking script therefore requires consent in the EEA and the UK, even on B2B properties. ## DPIA and consent banner integration Run a Data Protection Impact Assessment before deploying Eloqua, document the lawful basis, retention periods, EU pod choice and transfer mechanism. Integrate the Eloqua tracking script with your consent management platform so that it is loaded only after the visitor grants marketing consent. Use the Eloqua first party cookie configuration to align cookie domain and SameSite attributes with your privacy posture, and update your privacy notice and cookie policy to disclose Eloqua, its purpose and the data flows involved. Compliance ## Oracle Eloqua and the GDPR Oracle Eloqua is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Article 6(1)(a) GDPR for visitor tracking, behavioural profiling and cross session identification. Legitimate interest under Article 6(1)(f) may apply only to strictly necessary operational cookies that do not perform marketing profiling. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, CCPA, CPRA, LGPD ### Impact assessment (DPIA) A DPIA is strongly recommended when deploying Oracle Eloqua because it performs systematic monitoring of website visitors at scale, builds long term behavioural profiles linked to identified contacts, transfers personal data to the United States and supports cross channel marketing activities. Document scope, lawful basis, retention, EU pod choice, transfer mechanism (DPF, SCCs) and rights handling. ### Sample text for your banner > We use Oracle Eloqua to measure your interactions with our content, link form submissions to your profile and personalise our B2B marketing communications. Eloqua sets first party cookies and may transfer data to Oracle in the United States. By clicking Accept, you consent to this processing. You can withdraw your consent at any time in our cookie preferences. Cookies and trackers ## What Oracle Eloqua sets and contacts - Tracking method JavaScript tracking script (Eloqua tracking tag) - Server location United States (Oracle Cloud, with optional EU pod hosting available) - Data transferred outside the EU Data is transferred to Oracle infrastructure in the United States by default. Oracle is certified under the EU US Data Privacy Framework (DPF) and uses Standard Contractual Clauses (SCCs) as additional safeguards. An EU pod option is available for customers requiring data residency within the European Union, which can mitigate transfer risk but does not fully exclude US access by Oracle as a US parent company. ### Cookies set (5) | Name | Type | Duration | Purpose | | ---------- | ------------ | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | ELOQUA | first\_party | \~2 years | Persistent visitor identifier used by the Eloqua tracking script to link page views across sessions and to attribute form submissions to a known contact. | | ELQSTATUS | first\_party | \~2 years | Indicates whether tracking is active and whether the visitor has granted consent for Eloqua to record activity. | | \_elqQ | first\_party | session | Temporary queue cookie used during page load to buffer tracking events before they are sent to the Eloqua tracking endpoint. | | JSESSIONID | first\_party | session | Session cookie set on Eloqua hosted landing pages and forms to maintain server side session state. | | CSRF token | first\_party | session | Anti CSRF token used by Eloqua hosted forms to protect against cross site request forgery on form submissions. | ### Third-party domains contacted (5) - `eloqua.com` - `s.eloqua.com` - `t.eloqua.com` - `s###.t.eloqua.com` - `secure.eloqua.com` Questions ## Frequently asked questions about Oracle Eloqua Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Oracle Eloqua set? Oracle Eloqua sets first party cookies on the customer domain through its tracking script. The main cookies are ELOQUA, a persistent visitor identifier with a lifetime of around two years, ELQSTATUS, which records whether tracking is active and consent has been granted, and the temporary \_elqQ cookie used as a queue during page load. Customer specific session cookies and CSRF tokens may also be set on Eloqua hosted landing pages and forms. Because these cookies build a long term profile linked to identified contacts, they are not strictly necessary and require prior consent in the EEA and the UK. ### Does Eloqua require user consent? Yes. The Eloqua tracking script and its first party cookies perform behavioural profiling that goes well beyond what is strictly necessary to deliver a service requested by the visitor. Under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) GDPR, you must obtain prior, informed, freely given and specific consent before loading the Eloqua tracking script. This applies on both B2C and B2B properties because EU consent rules do not exempt business audiences. ### What is the legal basis for processing under Eloqua? For the deposit and reading of Eloqua tracking cookies, the legal basis is consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive. For the subsequent processing of B2B contact data inside Eloqua for marketing campaigns, the legal basis is typically consent or, for very limited operational purposes, legitimate interest under Article 6(1)(f) subject to a documented balancing test. Special categories of data should not be processed without an explicit Article 9 basis. ### Does Eloqua transfer data outside the EU? Yes by default. Eloqua is hosted on Oracle infrastructure in the United States. Oracle relies on the EU US Data Privacy Framework and on Standard Contractual Clauses for transfers to other regions. Oracle also offers an EU pod that hosts Eloqua data within the European Union, which is the preferred option for EU controllers. Even with the EU pod, perform a transfer impact assessment because Oracle remains a US parent company subject to US surveillance laws such as FISA 702 and EO 12333. ### Do I need a DPIA for Eloqua? Yes, a DPIA is strongly recommended and often mandatory. Eloqua performs systematic monitoring of website visitors at scale, builds long term behavioural profiles, links anonymous behaviour to identified contacts and transfers personal data to a third country. This combination of factors meets several DPIA triggers under Article 35 GDPR and the EDPB guidelines. The DPIA should document scope, lawful basis, retention, EU pod choice, transfer mechanism, security measures and rights handling. ### How do I implement Eloqua GDPR compliantly? Place the Eloqua tracking script behind your consent management platform so it loads only after marketing consent. Choose the EU pod if you serve EU users at scale. Sign an Oracle data processing agreement and review the SCCs annexes. Run a DPIA and a transfer impact assessment. Update your privacy notice and cookie policy to disclose Eloqua. Configure shorter cookie lifetimes where possible and offer a clear withdrawal mechanism. Train marketing teams on lawful basis, retention and minimisation. ### What are alternatives to Eloqua? Common alternatives in the enterprise B2B marketing automation space include HubSpot Marketing Hub, Adobe Marketo Engage and Salesforce Marketing Cloud Account Engagement (formerly Pardot). Each has its own data residency posture and consent maturity. For organisations seeking EU based vendors, options include Brevo (formerly Sendinblue), Mautic (open source) and ActiveCampaign with EU data residency. The right choice depends on CRM integration, EU residency requirements and consent management capabilities. ### How do I update my cookie policy to include Eloqua? List Oracle Eloqua under the marketing or analytics category of your cookie policy. Disclose the cookie names (ELOQUA, ELQSTATUS, \_elqQ), their type (first party), their duration (up to about two years for ELOQUA, session for \_elqQ) and their purpose (visitor profiling, form attribution, campaign personalisation). State the recipient (Oracle America Inc.), the country of transfer (United States, with optional EU pod), the transfer mechanism (DPF, SCCs) and the link to withdraw consent. Update the policy each time you change pod or scope. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Lead Generated](https://www.flowconsent.com/en/services/marketing/lead-generated) [Lead Generated is a lead generation platform designed to help businesses capture, qualify, and convert website visitors into sales-ready leads. It offers smart forms, interactive content, and behavioral tracking to identify high-intent prospects. Lead Generated integrates with CRM and marketing automation tools to streamline lead nurturing. With scoring models and analytics, Lead Generated helps teams focus on the most promising opportunities, improving pipeline quality and revenue growth.](https://www.flowconsent.com/en/services/marketing/lead-generated) [Marketing](https://www.flowconsent.com/en/services/marketing/lead-generated) · ### [CiviCRM](https://www.flowconsent.com/en/services/marketing/civicrm) [CiviCRM is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. CiviCRM provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, CiviCRM helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/civicrm) [Marketing](https://www.flowconsent.com/en/services/marketing/civicrm) · ### [Sales Automator](https://www.flowconsent.com/en/services/marketing/sales-auotomator) [Sales Auotomator is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Sales Auotomator provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Sales Auotomator helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/sales-auotomator) [Marketing](https://www.flowconsent.com/en/services/marketing/sales-auotomator) · ### [Octane AI](https://www.flowconsent.com/en/services/marketing/octane-ai) [Octane AI is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Octane AI integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Octane AI makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/octane-ai) [Preferences](https://www.flowconsent.com/en/services/marketing/octane-ai) · ### [Intice](https://www.flowconsent.com/en/services/marketing/intice) [Intice is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Intice provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Intice helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/intice) [Marketing](https://www.flowconsent.com/en/services/marketing/intice) · ### [ProveSource](https://www.flowconsent.com/en/services/marketing/provesource) [ProveSource is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ProveSource supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ProveSource ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/provesource) [Preferences](https://www.flowconsent.com/en/services/marketing/provesource) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)