Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Marketo Forms, part of Adobe Marketo Engage, embeds lead capture forms and loads the Munchkin tracking script on your pages. Munchkin sets a first party cookie called _mkto_trk that associates the browser with Marketo lead activity and links form fills to a lead record. Data is processed in the United States and the tracking is used for marketing, so prior consent is required under the GDPR and the ePrivacy Directive.
Marketo Forms is the lead capture component of Adobe Marketo Engage, a marketing automation platform. You embed Marketo forms on landing pages and websites to collect leads, and the platform loads the Munchkin tracking script to record visitor behaviour. Form submissions and tracked activity are associated with a Marketo lead record, which feeds scoring, segmentation, and automated marketing campaigns.
Munchkin sets a first party cookie called _mkto_trk, which lasts about 2 years and associates the browser with Marketo lead activity, so that anonymous page views can be linked to a lead record once a form is filled. Marketo processes the data submitted through forms, such as name and email address, along with IP addresses, pages viewed, and behavioural events. Because this activity is tied to identifiable lead records, it constitutes personal data used for marketing.
The _mkto_trk cookie is used for marketing tracking and lead profiling rather than a strictly necessary function, so Article 5(3) of the ePrivacy Directive requires prior consent before Munchkin runs. The processing of form data and behavioural activity linked to identifiable leads is personal data under the GDPR, which requires a lawful basis, transparency about profiling and scoring, and a record of processing activities.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The Munchkin script must not load and the _mkto_trk cookie must not be set before the visitor accepts the marketing category in your consent management platform. The form itself can be displayed, but tracking and behavioural association should wait for consent, and any marketing follow up by email needs a separate valid opt in. Consent must be freely given, specific, informed, and as easy to withdraw as to grant.
Adobe processes Marketo data in the United States, with regional pods available, so you must document the transfer under the Standard Contractual Clauses and the EU US Data Privacy Framework and sign the Adobe Data Processing Agreement. In practice, gate the Munchkin script behind your consent management platform, separate tracking consent from form submission, add a clear marketing opt in, set sensible data retention, and list the _mkto_trk cookie and its duration in your cookie policy.
Websites using Marketo Forms must obtain user consent under GDPR regulations.
DPIA considerations
Marketo Forms loads the Munchkin script, which sets a persistent first party cookie (_mkto_trk) with a lifetime of around 2 years, links form fills and browsing to identifiable Marketo lead records, and processes data on US infrastructure. A DPIA should assess the scale of lead profiling and scoring, the combination of form data with behavioural tracking, the international transfer to the United States, and retention periods, together with mitigations such as consent gating, separation of tracking from form submission, and shortened data retention.
Sample consent text
We use Marketo Forms and the Munchkin tracking script to capture and follow up on your enquiries and to personalise our marketing. Marketo places a cookie on your device to recognise your browser and link your activity to your lead record. This cookie loads only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
munchkin.marketo.netyour Marketo instance host (for example 123-ABC-456.mktoresp.com)your Marketo instance marketo.com hostapp-sjp.marketo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _mkto_trk | marketing | 2 years | Main Marketo Munchkin cookie. Associates the browser with Marketo lead activity so that page views and form submissions can be linked to a single lead record for tracking, scoring, and marketing automation. |
| _mkto_trk_extra | marketing | 2 years | Supplementary Munchkin tracking cookie used in some configurations to store additional lead association and visit information alongside _mkto_trk. |
| BIGipServer* | functional | Session | Load balancing cookie set by the Marketo instance to route requests to the correct server. It does not track behaviour but is set when the Marketo assets load. |
Marketo Forms places tracking cookies for advertising — comply with GDPR using FlowConsent.
Through the Munchkin tracking script, Marketo sets a first party cookie called _mkto_trk that lasts about 2 years. It associates the browser with Marketo lead activity so that page views and form fills can be linked to the same lead record over time.
Yes for the tracking. The _mkto_trk cookie is used for marketing and lead profiling, not a strictly necessary function, so Article 5(3) of the ePrivacy Directive requires prior, opt in consent before Munchkin loads. The form can be shown, but tracking should wait for consent, and any email follow up needs its own valid opt in.
The storage and reading of the _mkto_trk cookie relies on consent under the ePrivacy Directive, and the profiling and marketing that follow rely on consent under Article 6(1)(a) of the GDPR. Processing a form submission to answer a direct enquiry can sometimes rest on contract or legitimate interest, but the tracking cookie still requires consent.
Yes. Adobe processes Marketo data on infrastructure in the United States, although regional pods are available. Transfers are covered by Standard Contractual Clauses and the EU US Data Privacy Framework, which you should reference in your privacy notice along with Adobe as a recipient.
A full DPIA is not always mandatory, but it is strongly recommended because Marketo profiles and scores leads, combines form data with behavioural tracking, and transfers data to the United States. Document the purposes, data categories, retention, and safeguards, and reassess if you enable advanced lead scoring or large scale automated decision making.
Load the Munchkin script only after the visitor accepts the marketing category in your consent management platform, and keep _mkto_trk blocked until then. Separate tracking consent from form submission, add a clear marketing opt in to the form, sign the Adobe Data Processing Agreement, set sensible retention, and document the cookie in your cookie policy.
EU based or privacy focused form and marketing automation tools such as HubSpot with EU data residency, Brevo, or self hosted form solutions can keep more data within the European Union and run with fewer tracking cookies. The right choice depends on whether you need deep Marketo automation or prefer EU data residency and a lighter tracking footprint.
List the _mkto_trk cookie, its purpose and its 2 year duration, name Adobe (Marketo Engage) as a recipient, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that the Marketo cookie and any related cookies are reflected accurately.