Omeda

What Omeda is

Omeda is a United States based customer data platform and audience marketing suite built primarily for publishers. It unifies subscriber and visitor data into a single profile through identity resolution, then activates that profile across email and other marketing channels. Its Olytics service tracks website behaviour with a lightweight JavaScript tag that works alongside existing page metadata. The platform aims to turn unknown visitors into known, addressable contacts.

What data and cookies it collects

Olytics sets cookies such as oly_anon_id for anonymous visitors and oly_enc_id for recognised customers, which carry identifiers used to track behaviour over time. Omeda collects page views, content interactions, form submissions and email engagement, and links these events to contact records when an individual is identified. Because the platform resolves identities and builds detailed profiles, the data it holds is clearly personal data under the GDPR. The combination of behavioural and contact data makes these profiles rich and potentially intrusive.

GDPR and ePrivacy implications

The Olytics cookies are not strictly necessary, so storing and reading them requires prior consent under Art. 5(3) of the ePrivacy Directive. The profiling, identity resolution and marketing activation must also comply with the GDPR, including a valid lawful basis and respect for data subject rights. Combining anonymous and known identifiers raises the stakes, because it can reveal a great deal about an individual. Controllers should be especially careful to honour objections to profiling and direct marketing.

Consent requirements

Consent is the appropriate basis for the Olytics tracking and the marketing activation, and it must be freely given, specific, informed and unambiguous. The Olytics tag should remain blocked until the visitor opts in through a consent management platform, and identification should not happen before consent. Separate consents may be needed for analytics, profiling and electronic marketing communications. Visitors must be able to withdraw consent easily, after which tracking and marketing must stop.

International data transfers

Omeda processes data on infrastructure in the United States, which is a third country for European users. Transfers can rely on the EU US Data Privacy Framework where Omeda is certified, or on Standard Contractual Clauses supported by a transfer impact assessment and supplementary measures. The controller should confirm Omeda current certification status and document the chosen safeguard. Given the depth of the profiles involved, robust technical and organisational measures are particularly important.

Practical compliance steps

Gate the Olytics tag behind a compliant consent banner and ensure identification only occurs after opt in. Conclude a data processing agreement with Omeda, record the United States transfer mechanism and run a transfer impact assessment. Configure retention limits, manage data subject requests and disclose Omeda clearly in the privacy and cookie policies. Review the configuration regularly so that profiling and marketing remain aligned with the consents collected.