Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Cisco AppDynamics is an application performance monitoring (APM) platform. Its core tracing is server side, but the optional Browser Real User Monitoring (RUM) feature injects JavaScript that sets ADRUM cookies and captures page performance, session and IP data. When RUM is enabled the tool becomes non essential and consent is generally required in the EU.
Cisco AppDynamics is an application performance monitoring platform used to trace transactions, detect errors and measure how applications and infrastructure behave. Most of its monitoring is server side through language agents, but it also offers Browser Real User Monitoring, known as RUM or End User Monitoring, which observes the experience of real visitors in the browser.
Server side APM agents collect technical telemetry about your application and do not set cookies in the visitor browser. The Browser RUM feature is different, it injects a JavaScript agent that sets ADRUM cookies and captures page load timing, errors, browser and device details, the visitor IP address and session identifiers. That browser data can identify individuals and is personal data under the GDPR.
If only server side APM is used, you can usually rely on legitimate interest for operational performance monitoring. Once Browser RUM is enabled, the ADRUM cookies are not strictly necessary for a service the visitor requested, so the ePrivacy Directive requires prior consent before they are set, and the IP and session data must have a valid GDPR basis and be disclosed.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Where Browser RUM is active, load the ADRUM script only after the visitor consents to performance or analytics cookies, and block it behind your consent manager until then. If you run server side APM only, no browser consent is needed because nothing is stored on the visitor device, though you still document the processing.
AppDynamics is a Cisco product and its SaaS controllers and RUM collectors may run on infrastructure in the United States or other regions. When RUM data including IP addresses leaves the EEA, you need a transfer mechanism such as the Data Privacy Framework or Standard Contractual Clauses. Choosing an in region controller can help keep server side data within the EEA.
Decide whether you need Browser RUM at all, gate it behind consent if you do, consider IP anonymisation, sign a data processing agreement with Cisco, confirm the controller region and transfer mechanism, list the ADRUM cookies in your cookie policy and document the lawful basis for server side monitoring.
Websites using AppDynamics must obtain user consent under GDPR regulations.
DPIA considerations
Server side APM alone is low risk and a DPIA is rarely needed. When Browser RUM or End User Monitoring is enabled, assess the risk of systematic collection of IP addresses and session data and document the processing, since combined behavioural monitoring across many users can raise the risk profile.
Sample consent text
We use Cisco AppDynamics Browser Monitoring to measure page performance. This sets cookies and may transfer performance data and your IP address to Cisco outside the EU. Do you accept performance monitoring?
Third-party domains contacted
appdynamics.comeum-appdynamics.comcdn.appdynamics.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ADRUM | Performance / RUM | Session | Correlates browser RUM beacons with a user session for performance monitoring |
| ADRUM_BT | Performance / RUM | Session | Identifies the business transaction for end user monitoring |
| ADRUM_BTa | Performance / RUM | Session | Stores business transaction context for RUM correlation |
AppDynamics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Server side APM sets no browser cookies. When Browser RUM is enabled it sets ADRUM cookies such as ADRUM, ADRUM_BT and ADRUM_BTa to correlate performance beacons with a user session.
It depends on the mode. Pure server side APM needs no browser consent. If Browser RUM is enabled, the ADRUM cookies are non essential, so prior consent is required under the ePrivacy Directive.
Server side performance monitoring can rely on legitimate interest under Article 6(1)(f) GDPR. Browser RUM that sets cookies and captures IP and session data needs consent under Article 6(1)(a).
It can. AppDynamics is a Cisco product and its SaaS controllers and RUM collectors may run in the US, so when RUM data including IP addresses leaves the EEA you need a transfer mechanism such as the Data Privacy Framework or Standard Contractual Clauses.
Server side APM rarely needs a DPIA. With Browser RUM enabled, assess the risk of systematic collection of IP and session data across many users and document the processing, carrying out a DPIA if the risk is high.
Decide if you need Browser RUM, gate it behind consent if you do, consider IP anonymisation, sign a data processing agreement with Cisco, confirm the controller region and disclose the ADRUM cookies and the server side basis.
Alternatives include other APM tools such as server side only observability stacks, or EU hosted monitoring platforms. Choosing server side tracing without browser RUM avoids setting cookies on the visitor device.
If Browser RUM is enabled, list the ADRUM cookies with their purpose and duration, name Cisco as a recipient, explain possible US transfers and describe how visitors withdraw consent. Server side only setups need no cookie entry.