Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Acquia Personalization, formerly Acquia Lift, is a personalization and customer data platform that tracks visitor behaviour across sessions, builds profiles and segments audiences to tailor content.
Acquia Personalization, formerly known as Acquia Lift, is a personalization engine and customer data platform from the United States. It tracks how visitors behave across sessions, unifies that behaviour into profiles and groups people into segments so the site can show tailored content and offers. Its purpose is to recognise individuals over time and adapt the experience to them.
The platform sets cookies that assign a persistent visitor identifier and tracks page views, content interactions, clicks and any attributes you feed it. Over time it accumulates a behavioural profile linked to that identifier and can combine it with known customer data. Because it builds an evolving picture of each person, it processes personal data well beyond a single visit.
Building profiles and segmenting people is profiling under the GDPR, which carries specific transparency duties and a right to object. The non essential cookies that drive it require prior consent under the ePrivacy Directive. You must tell visitors clearly that profiling takes place, explain its logic at a high level and let them refuse without detriment.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Cross session profiling cookies cannot fire before the visitor gives freely given, specific, informed and unambiguous consent, and legitimate interest is generally not adequate for this kind of tracking. The consent prompt should name personalization and profiling plainly rather than hiding it under generic wording. Visitors must be able to withdraw consent and to object to profiling as easily as they accepted it.
As a United States vendor, Acquia commonly processes data on United States infrastructure, though regional hosting may be available. Because the profiles can be detailed, any transfer to the United States or another third country must rely on Standard Contractual Clauses or the EU US Data Privacy Framework together with a transfer impact assessment. Confirm the contracted hosting region and keep the safeguards on file.
Run a data protection impact assessment, gate all profiling cookies behind consent and make personalization optional rather than forced. Limit the attributes you feed the platform, set a sensible profile retention period and provide an easy route to object to profiling and to access or delete a profile. Sign a data processing agreement, secure the United States transfer mechanism and describe the profiling clearly in your privacy and cookie notices.
Websites using Acquia Personalization must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is strongly recommended because the platform carries out profiling and systematic monitoring of behaviour across sessions to build visitor profiles. Assess the categories of data collected, how identifiers persist over time, the criteria used to segment individuals and any automated decisions that follow. Evaluate the consent mechanism, the retention of profiles, the rights of data subjects to object to profiling and the transfer of data to the United States. Document the necessity and proportionality of the profiling, the safeguards in place and the residual risk, and revisit the assessment when new data sources or segments are added.
Sample consent text
With your consent we use Acquia Personalization to recognise you across visits, build a profile of your interests and tailor the content you see. This involves profiling. You can accept, reject or set preferences, and you may withdraw consent or object to profiling at any time.
Third-party domains contacted
acquia.comlift.acquia.comacquia-sites.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| tc_ttid | Marketing | 24 months | Assigns a persistent visitor identifier used to build and recognise a personalization profile across sessions. Set only after consent. |
| tc_session | Marketing | Session | Tracks behaviour and content interactions within a visit and links them to the visitor profile. Set only after consent. |
| tc_seg | Marketing | 12 months | Stores the audience segments a visitor has been assigned to so the site can deliver tailored content. Set only after consent. |
Acquia Personalization collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Acquia Personalization sets cookies that assign a persistent visitor identifier, track behaviour within a visit and store the segments a visitor belongs to. These cookies drive cross session profiling and tailored content, so they are non essential. They should load only after the visitor has given consent.
Yes. The platform tracks behaviour across sessions and builds profiles, which is profiling, and the cookies are non essential. Recording and profiling should begin only after freely given, specific, informed and unambiguous consent. Visitors must be able to refuse and to object to profiling at any time.
Consent under Article 6(1)(a) GDPR is the appropriate basis because cross session profiling cookies are non essential and the processing is profiling. Legitimate interest is generally not adequate for this kind of tracking. Document the basis and respect the right to object to profiling.
Acquia is a United States vendor, so processing commonly involves United States infrastructure, although regional hosting may be offered. Because the profiles can be detailed, transfers must rely on Standard Contractual Clauses or the EU US Data Privacy Framework together with a transfer impact assessment.
Very likely yes. The platform performs profiling and systematic monitoring across sessions, which typically requires a data protection impact assessment. Assess the data collected, the persistence of identifiers, the segmentation criteria, the retention of profiles and the United States transfer before launch.
Run a DPIA, gate all profiling cookies behind consent and make personalization optional rather than forced. Limit the attributes you feed the platform, set a sensible profile retention period and provide an easy way to object to profiling and to access or delete a profile. Sign a data processing agreement and secure the United States transfer mechanism.
Other personalization and customer data platforms include Optimizely, Adobe Target, Dynamic Yield and Bloomreach. When comparing them, weigh the hosting region, the default consent behaviour, the controls over profiling and retention and the data processing terms rather than features alone.
Disclose that you use a personalization platform that profiles visitors across sessions, list its cookies with purpose and duration and name the vendor. Explain the legal basis, the profiling, the retention period and how visitors can withdraw consent or object, and review the entry whenever the configuration changes.