> How the Akamai Web Application Protector WAF inspects requests, the cookies it sets, the GDPR Article 32 security duty and US transfer considerations. > > Canonical: https://www.flowconsent.com/en/services/security/akamai-web-application-protector Security # Akamai Web Application Protector Essential · [Official website](https://www.akamai.com/us/en/products/security/web-application-protector-enterprise-waf-firewall-ddos-protection.jsp) Akamai Web Application Protector (WAP) is the entry level Web Application Firewall in the Akamai security portfolio. It sits on the Akamai global edge network as a reverse proxy, inspects every HTTP request before it reaches the publisher's origin, blocks the OWASP Top 10 categories of attack and applies rate limiting and bot mitigation rules. Because it is a security layer rather than a tracker, it processes request metadata (IP, User Agent, URL) under legitimate interest, and the cookies it may set (AKA\_A2, \_abck, bm\_sz) qualify as strictly necessary. [Block Akamai Web Application Protector until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 4 - Third-party domains 4 - Servers Akamai global edge network (United States headquartered, with European points of presence) Overview ## What does Akamai Web Application Protector do? ## **What Web Application Protector does** Akamai Web Application Protector (WAP) is the simplest Web Application Firewall in the Akamai security catalogue. It runs on the Akamai global edge network as a reverse proxy in front of the publisher's origin. Every incoming HTTP request is inspected against signature based and behavioural rules covering the OWASP Top 10 (SQL injection, cross site scripting, RCE, LFI), then either passed through, challenged or blocked. WAP also includes basic bot mitigation, rate limiting and DDoS protection. ## **What data is processed** At a minimum WAP processes the connection metadata of every request : IP address, TLS handshake details, User Agent, HTTP headers, request URL and method. When the WAF rule requires it, the request body (form data, JSON payload) is also inspected. Bot mitigation also sets short lived cookies (AKA\_A2, \_abck, bm\_sz, akacd\_\*) that act as challenge tokens. Logs are streamed to Akamai's security operations and can be exported to the publisher's SIEM through Akamai DataStream. ## **GDPR Article 32 and ePrivacy** Running a WAF is a textbook implementation of Article 32 GDPR (appropriate technical and organisational measures). The lawful basis is legitimate interest under Article 6(1)(f) GDPR (security of the network and information systems), reinforced by Article 6(1)(c) where NIS2 or DORA explicitly require WAF capabilities. The bot detection cookies are strictly necessary to deliver the security service the publisher and the visitor implicitly request, and therefore exempt from consent under Article 5(3) ePrivacy. ## **US transfers and Akamai DPA** European traffic normally terminates at European Akamai points of presence, but Akamai is headquartered in Massachusetts and its security operations centres are global. Request metadata and incident logs may therefore be processed in the United States. The Akamai DPA incorporates the EU Standard Contractual Clauses and references Akamai's EU, US Data Privacy Framework certification. A Transfer Impact Assessment is expected by European supervisory authorities. ## **Compliance checklist** Document the Akamai WAF in the processing register as a security processor. Sign the Akamai DPA. Mention Akamai Technologies Inc. and the United States in the privacy notice with the Article 32 legitimate interest balancing test. Configure short retention for incident logs. Do not mix WAP with marketing analytics in the same module so the strictly necessary status of the WAF cookies is unambiguous. Compliance ## Akamai Web Application Protector and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for site security and fraud prevention; legal obligation (Art. 6(1)(c) GDPR) for the publisher's Article 32 GDPR duty to implement appropriate security measures - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, NIS2, DORA (financial sector), national security baselines ### Impact assessment (DPIA) Akamai WAP is a security layer that processes connection metadata to block attacks. Key considerations : (1) the WAF inspects HTTP headers, URLs and sometimes request bodies that may contain personal data submitted by the visitor, retention of those samples for investigation should be limited; (2) the cookies set by Akamai (AKA\_A2, \_abck, bm\_sz) are bot detection tokens and qualify as strictly necessary under Article 5(3) ePrivacy; (3) Akamai is a US company and request logs are processed globally, the publisher relies on the Akamai DPA, SCCs and the EU, US Data Privacy Framework; (4) Akamai shares aggregated threat intelligence with other customers, which is processed under legitimate interest and should be mentioned in the privacy notice; (5) detailed incident logs may include source IPs of legitimate visitors mistakenly classified, individual rights requests should be handled accordingly. A DPIA is recommended whenever the WAF body inspection feature is enabled. ### Sample text for your banner > This site is protected by Akamai Web Application Protector (Akamai Technologies Inc., United States), a Web Application Firewall operating on the Akamai global edge network. Akamai inspects every incoming request (IP, headers, URL) to block attacks and may store technical request logs and short lived bot detection cookies (AKA\_A2, \_abck, bm\_sz). This processing is necessary to keep the site secure and does not require your consent. Cookies and trackers ## What Akamai Web Application Protector sets and contacts - Tracking method Reverse proxy WAF on the Akamai edge (HTTP layer, transparent to the browser) - Server location Akamai global edge network (United States headquartered, with European points of presence) - Cookieless mode available Yes - Data transferred outside the EU Akamai Technologies Inc. is headquartered in Cambridge, Massachusetts. Web Application Protector runs on the Akamai global edge network. European traffic is normally terminated at European points of presence, but request metadata (IP, User Agent, URL, response code) is processed by Akamai under its global security operations. Transfers to the United States rely on Standard Contractual Clauses signed in the Akamai DPA and on Akamai's EU, US Data Privacy Framework certification. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------- | ------------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AKA\_A2 | Strictly necessary | 1 hour | Akamai bot detection token issued by Web Application Protector and Bot Manager to verify that the request is coming from a real browser, not from an automated client. | | \_abck | Strictly necessary | 1 year | Akamai Bot Manager cookie that stores the result of the bot challenge so subsequent requests do not have to be challenged again. | | bm\_sz | Strictly necessary | 4 hours | Akamai Bot Manager session cookie used to track the integrity of a browser session and detect anomalies suggesting automation. | | akacd\_\* | Strictly necessary | Session | Akamai cookie that ties the visitor to a specific Akamai edge server for sticky routing during the security analysis. | ### Third-party domains contacted (4) - `akamai.com` - `akamaihd.net` - `akamaized.net` - `akamaitechnologies.com` Questions ## Frequently asked questions about Akamai Web Application Protector Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Akamai Web Application Protector set? AKA\_A2 (1 hour), \_abck (1 year), bm\_sz (4 hours) and akacd\_\* (session). All are short to medium lived bot detection or sticky routing cookies on Akamai or publisher domains. ### Do I need consent for those cookies? No. They are strictly necessary to deliver the security service the publisher is required to operate under Article 32 GDPR. They are exempt from consent under Article 5(3) ePrivacy. ### What legal basis applies? Legitimate interest (Article 6(1)(f) GDPR) for the security processing, plus legal obligation (Article 6(1)(c)) where NIS2 or DORA require WAF capabilities. Document the balancing test in the processing register. ### Is data transferred to the United States? Yes. Akamai is US headquartered, request metadata and incident logs may transit the United States. SCCs and Akamai's EU, US Data Privacy Framework certification apply. A Transfer Impact Assessment is expected. ### Is a DPIA required? Recommended when the request body inspection feature is enabled (potential capture of personal data in payloads) or when WAP feeds into automated decisions affecting users (account blocking). ### How do I implement Akamai WAP compliantly? Sign the Akamai DPA. Document the legitimate interest balancing test for Article 32. Mention Akamai Technologies Inc. and the United States in the privacy notice. Configure short retention for incident logs. Avoid mixing the WAF cookies with marketing cookies. ### Are there European alternatives? Yes : OVHcloud WAF, Cloudflare WAF (US but offers EU regions), Imperva (US), F5 Distributed Cloud WAF or self hosted ModSecurity, Coraza on EU origins. Akamai remains a market leader for very high traffic sites that require an edge WAF. ### How should I update my cookie policy? List AKA\_A2, \_abck, bm\_sz and akacd\_\* in the strictly necessary section with their domain, duration and security purpose. Add Akamai Technologies Inc. to the recipient list and mention the United States as a transfer destination for the security logs. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [Apereo CAS](https://www.flowconsent.com/en/services/security/apereo-cas) [Apereo CAS is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Apereo CAS offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Apereo CAS empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/security/apereo-cas) [Essential](https://www.flowconsent.com/en/services/security/apereo-cas) · ### [Confiant](https://www.flowconsent.com/en/services/security/confiant) [Confiant is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Confiant supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Confiant ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/confiant) [Essential](https://www.flowconsent.com/en/services/security/confiant) · ### [Lunio](https://www.flowconsent.com/en/services/security/lunio) [Lunio is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Lunio integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Lunio makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/security/lunio) [Marketing](https://www.flowconsent.com/en/services/security/lunio) · ### [Sqreen](https://www.flowconsent.com/en/services/security/sqreen) [Sqreen is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sqreen integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sqreen helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/sqreen) [Essential](https://www.flowconsent.com/en/services/security/sqreen) · ### [Qualva](https://www.flowconsent.com/en/services/security/qualva) [Qualva is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Qualva supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Qualva ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/qualva) [Essential](https://www.flowconsent.com/en/services/security/qualva) · ### [NTLM](https://www.flowconsent.com/en/services/security/ntlm) [NTLM is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. NTLM integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, NTLM helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/ntlm) [Essential](https://www.flowconsent.com/en/services/security/ntlm) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)