Akamai Bot Manager
Akamai Bot Manager is an enterprise bot management product running at the edge of the Akamai CDN. It classifies and mitigates bots through device fingerprinting, behaviour analysis and JavaScript challenges.
What does Akamai Bot Manager do?
Akamai Bot Manager is a bot detection and mitigation product that runs on the Akamai Intelligent Platform, the world's largest content delivery network. It analyses every request reaching your site, scores it against bot signatures and machine learning models, and applies the action you configured (allow, monitor, slow down, serve alternate content, challenge with a JavaScript test or a captcha, block).
What Akamai Bot Manager does
Bot Manager Premier injects a JavaScript sensor that fingerprints the device, captures behavioural signals (mouse movements, scrolling, typing cadence), and posts the proof of work back to the Akamai edge. The edge stores a bot score in a signed cookie so subsequent requests do not require revalidation. Akamai threat intelligence updates the rules continuously from the global Akamai network.
Cookies and data collected
The platform sets first party cookies on the protected domain (typically _abck for the score, bm_sz for the session, ak_bmsc for behaviour) and reads the IP, user agent, TLS fingerprint, the device sensor payload, and request headers. None of the cookies is used for marketing.
GDPR and ePrivacy implications
The bot scoring cookies can be considered strictly necessary for security under Article 5(3) ePrivacy, since they directly support the integrity of the service. The behavioural signals are personal data and rely on legitimate interest (Article 6(1)(f) GDPR) with a documented balancing test. Akamai is a processor under your DPA. Inform users in your privacy notice that bot management is used.
Data hosting and transfers
Edge evaluation happens close to the visitor (including EU points of presence). Akamai Technologies is a US company and the central threat intelligence platform runs in the US. Transfers are covered by the EU-US Data Privacy Framework (Akamai is certified) and by Standard Contractual Clauses for non DPF flows.
How to deploy it compliantly
Treat Bot Manager as a strictly necessary security tool, enabled by default. Restrict the sensor to pages where bot risk justifies it (login, checkout, search), keep the cookies on the first party domain, and document the deployment in your record of processing activities. Provide an accessible alternative for users blocked by false positives.
Akamai Bot Manager and the GDPR
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR) for security, fraud and bot prevention, with documented balancing test; the bot scoring cookie can be considered strictly necessary
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, NIS2, EU-US Data Privacy Framework, EDPB Guidelines 5/2020 on consent
Impact assessment (DPIA)
A DPIA is recommended when Bot Manager runs on consumer journeys (login, account creation, checkout) where false positives could exclude legitimate users. Document the signals captured by the sensor (device, behaviour), the retention by Akamai, the EU edge architecture, and the appeal path for users blocked by mistake.
Sample text for your banner
We use Akamai Bot Manager to protect this site against automated abuse, fraud and credential stuffing. It sets small bot scoring cookies and reads device signals on every request. These are strictly necessary for security and are active without prior consent.
What Akamai Bot Manager sets and contacts
- Tracking method
- Edge protection on the Akamai CDN, JavaScript sensor that collects device and behaviour signals, first party cookies for bot scoring
- Server location
- Akamai Intelligent Platform edge with EU points of presence; centralised analytics in the United States
- Data transferred outside the EU
- Akamai Technologies is a US company operating a global CDN. Bot Manager evaluates requests at the edge close to the visitor (including EU edge), but central analytics and the Threat Intelligence platform run in the United States. Transfers rely on the EU-US Data Privacy Framework (Akamai is certified) and on Standard Contractual Clauses.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _abck | http_cookie | 1 year | Stores the signed Akamai Bot Manager score and a sensor verification token used to identify legitimate browsers across requests. |
| bm_sz | http_cookie | 4 hours | Akamai session cookie issued at the edge to associate a visitor session with the bot scoring decisions. |
| ak_bmsc | http_cookie | 2 hours | Stores intermediate behavioural state and sensor results during a visit. |
| bm_sv | http_cookie | 1 hour | Sensor verification cookie used to confirm that the JavaScript sensor has been executed by a legitimate browser. |
Third-party domains contacted (4)
akamaihd.netakamaized.netakamaiedge.netedge.akamai.com
Frequently asked questions about Akamai Bot Manager
Can't find your question? Write to us, we answer fast.
What cookies does Akamai Bot Manager set?
Bot Manager typically sets _abck (bot score), bm_sz (session), ak_bmsc (behavioural state) and bm_sv (sensor verification) as first party cookies on the protected domain. Lifetimes range from session to one year. They are not used for marketing.
Does Akamai Bot Manager require GDPR consent?
Generally no. The cookies and the sensor are used to protect the integrity of the service and qualify as strictly necessary under Article 5(3) ePrivacy. Disclose Bot Manager in your privacy notice instead of asking for consent.
What is the legal basis for processing?
Legitimate interest under Article 6(1)(f) GDPR for fraud and bot prevention, with a documented balancing test. The strictly necessary cookies benefit from the exemption of Article 5(3) ePrivacy.
Are data transferred outside the EU?
Edge evaluation happens close to the visitor (including EU). Akamai Technologies is a US company and central analytics run in the United States. Transfers rely on the EU-US Data Privacy Framework and on SCCs for any non DPF flow.
Do I need a DPIA?
A DPIA is recommended for deployments on consumer flows where false positives could impact rights (login, account creation, payment). Document the signals, the impact on accessibility, the appeal mechanism, and the retention of bot scores.
How do I implement Akamai Bot Manager compliantly?
Enable Bot Manager on critical surfaces (login, password reset, search) rather than every page. Keep the cookies first party. Document the legitimate interest balancing test. Provide an alternative path for users blocked by mistake.
Are there alternatives to Akamai Bot Manager?
Alternatives include Cloudflare Bot Management, AWS WAF Bot Control, Datadome, PerimeterX (HUMAN), F5 Distributed Cloud Bot Defense, Imperva Advanced Bot Protection and Reblaze. Datadome and HUMAN can offer EU hosting.
How do I update my cookie policy for Akamai Bot Manager?
List _abck, bm_sz, ak_bmsc and bm_sv as strictly necessary security cookies, with their lifetime and the fact that Akamai operates the bot management. Mention the US transfer mechanism and link to Akamai's privacy notice.
ipapi.co
ipapi.co is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ipapi.co supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ipapi.co ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
v4Guard Checkpoint
v4Guard Checkpoint is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. v4Guard Checkpoint supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, v4Guard Checkpoint ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Authy
Authy is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Authy supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Authy enables informed decisions that improve experience and drive results.
Cloudflare Turnstile
Cloudflare Turnstile is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Cloudflare Turnstile supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Cloudflare Turnstile ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Slider Captcha
Slider Captcha is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Slider Captcha supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.
Twilio Authy
Twilio Authy is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Twilio Authy offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Twilio Authy empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.