Kasada

What Is Kasada and How Does It Work

Kasada is a bot mitigation and anti-automation security platform developed by the Australian company Kasada Pty Ltd. It protects web applications and APIs against credential stuffing, account takeover, scraping, and other automated threats by injecting a client-side JavaScript challenge script into web pages. This script gathers device fingerprint signals, mouse and keyboard behavioural patterns, browser properties and network metadata, then submits them to Kasada cloud servers for real-time scoring. Requests assessed as bot-generated are blocked or challenged before they reach the protected application.

Data and Cookies Collected

Kasada sets cookies in the KP_* namespace (for example KP_UIDz and KP_SESSIONID) to associate device sessions with bot-risk scores. The JavaScript challenge script also collects a broad set of device signals including browser version, installed fonts, canvas and WebGL fingerprints, screen resolution, hardware concurrency, touch capability and timing characteristics. Behavioural signals such as mouse movement entropy and keystroke cadence are sampled where available. These signals are transmitted to Kasada infrastructure for scoring and are not used for advertising or tracking purposes beyond bot detection and fraud prevention.

GDPR and ePrivacy Implications

Device fingerprinting and the setting of storage identifiers on end-user devices is regulated by ePrivacy Directive Article 5(3), which requires either user consent or a strictly-necessary justification. Kasada and many security vendors argue that bot-detection cookies and fingerprinting are strictly necessary because they protect the security of the communication and prevent fraud. However, several EU Data Protection Authorities have taken the view that device fingerprinting that extends beyond pure session integrity into persistent device identification is not automatically exempt and may require consent. Under the GDPR, the data controller (your organisation) must document a legal basis for processing. Legitimate interest under Article 6(1)(f) is the most commonly relied-upon basis, supported by a Legitimate Interest Assessment that weighs security benefits against the privacy intrusion of fingerprinting all visitors.

Kasada acts as a data processor under Article 28 GDPR, meaning a Data Processing Agreement must be in place. Your Article 13/14 privacy notice must disclose Kasada as a recipient of device and behavioural data and explain the legal basis for the transfer. The risk level for this service is classified as medium because the fingerprinting scope is broad but the purpose is narrowly scoped to security.

Consent Requirements: Strictly Necessary vs Consent Debate

The prevailing practice across EU operators is to classify Kasada as strictly necessary for security purposes and to rely on legitimate interest, not consent. This approach is defensible when: the script is deployed solely for bot and fraud prevention, no data is shared with advertising networks, the KP_* cookies are session-scoped or short-lived, and a Legitimate Interest Assessment is documented and retained. If the Kasada deployment involves persistent cross-session device identification or if data is used beyond bot detection, the strictly-necessary exemption weakens and consent may become advisable. Operators should monitor guidance from their lead supervisory authority and update their approach if DPA enforcement practice shifts.

International Data Transfers

Kasada is headquartered in Sydney, Australia and operates cloud infrastructure in the United States and Australia. The EU has not adopted an adequacy decision for Australia, so transfers of personal data from the EU to Kasada in Australia must rely on Standard Contractual Clauses or another Article 46 mechanism. Transfers to US infrastructure fall under the EU-US Data Privacy Framework if Kasada is certified, or alternatively under SCCs. Operators should verify Kasada's current DPF certification status and ensure the Data Processing Agreement references appropriate transfer safeguards.

Practical Compliance Steps

To deploy Kasada in a GDPR-compliant manner: sign a Data Processing Agreement with Kasada under Article 28, complete and document a Legitimate Interest Assessment for the bot-detection processing, disclose Kasada in your privacy notice as a security processor receiving device and behavioural data, list KP_* cookies in your cookie policy under the strictly-necessary category with a clear security purpose description, verify international transfer safeguards (SCCs for AU, DPF or SCCs for US), and consider a DPIA if Kasada is deployed on high-traffic consumer-facing pages where large-scale profiling of visitor devices could be inferred. Review your cookie audit at least annually or when Kasada updates its script.