Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
PerimeterX, now part of HUMAN Security, is a bot mitigation and fraud prevention platform that distinguishes real users from automated traffic. It sets first party security cookies and runs client side JavaScript that collects device, browser and behavioural signals to score each visit. Because it relies on device fingerprinting and persistent identifiers, it raises specific ePrivacy and GDPR considerations even though it serves a security purpose. Signals are processed in the United States under the EU US Data Privacy Framework.
PerimeterX is a bot mitigation and fraud prevention service that is now part of HUMAN Security, following the 2022 merger. It helps websites and applications tell genuine human visitors apart from automated traffic such as scrapers, credential stuffing tools and fake account bots. The service runs client side JavaScript that collects device, browser and behavioural signals, then scores each request on the server side to decide whether to allow, challenge or block it. It is widely deployed on login pages, checkout flows and APIs where automated abuse causes real financial harm. Because the protection is woven into the request path, it operates on every visitor rather than only on those who interact with a particular feature. This combination of persistent identifiers and large scale scoring is exactly what gives it both its security value and its privacy sensitivity.
PerimeterX sets a small family of first party cookies in the website operator domain. The _pxvid visitor identifier persists for up to one year and acts as a stable device reference, while the _pxhd device hash helps check fingerprint consistency across sessions, and the short lived _px3 token carries a signed risk verdict that refreshes frequently. Alongside these cookies the client script reads device and browser signals such as canvas, WebGL and audio characteristics, navigator properties and connection level TLS and HTTP fingerprints. It also collects behavioural biometrics including mouse movement, scrolling and keystroke timing throughout the session. These signals together build a device fingerprint and behavioural profile that the backend uses to assign a bot or human verdict. The exact cookie set and durations can vary by deployment and product configuration.
The signals PerimeterX processes, including device identifiers and behavioural patterns, are personal data under the GDPR because they single out and recognise individual users and devices. Security and fraud prevention can be a legitimate interest under Article 6(1)(f), and the recitals expressly recognise fraud prevention as a valid interest, but the controller must still run and document a balancing test. The ePrivacy Directive adds a separate layer because reading information from and storing information on a user device generally requires consent unless it is strictly necessary for a service the user has explicitly requested. Regulators such as the CNIL treat device fingerprinting the same way as cookies for this purpose. Whether the strictly necessary exemption applies is fact specific and tends to be read narrowly, so many deployments cannot assume it covers all of the collection. This tension between a legitimate security purpose and the ePrivacy storage and access rule is the central compliance question for the tool.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Many operators argue that the security cookies and signals strictly necessary to keep a login or payment flow safe fall within the ePrivacy exemption, and so place them in a strictly necessary category that loads without prior consent. That position is defensible only where the collection is genuinely limited to security and is not reused for analytics, advertising or profiling. Any signal collection that goes beyond protecting the requested service, or that is reused for other purposes, should be gated behind consent in your consent management platform. A practical approach is to classify PerimeterX as a security control, document why each cookie and signal is necessary, and ensure your CMP reflects that classification transparently. You should also describe the device fingerprinting plainly in the cookie notice so users understand that more than simple cookies are involved.
HUMAN Security is headquartered in the United States and operates its services from there, so signals collected from European visitors are transferred to the United States for processing. HUMAN self certifies under the EU US Data Privacy Framework and its UK and Swiss extensions, which provides an adequacy based transfer mechanism for organisations that participate. Where the framework does not cover a particular transfer, Standard Contractual Clauses are used as a fallback safeguard. As a controller you should confirm the current certification status, record the chosen transfer mechanism in your records of processing, and complete a transfer impact assessment where your risk approach requires one. Keeping evidence of these mechanisms is important because the legal landscape for transatlantic transfers has changed several times.
Start by signing a data processing agreement with HUMAN Security and mapping exactly which cookies and signals are collected on your site. Document your legitimate interest assessment for fraud prevention and decide, per page or flow, whether the strictly necessary exemption truly applies or whether consent is needed. Update your privacy notice and cookie policy to name the security cookies, explain the device fingerprinting and behavioural analysis, and state that signals are processed in the United States. Configure your consent management platform so that any non essential collection is blocked until the user agrees. Set appropriate retention expectations and confirm with the vendor how long identifiers such as the visitor cookie persist. Finally, review the configuration periodically so your documentation stays aligned with how the product is actually deployed.
Websites using PerimeterX (HUMAN Security) must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is strongly recommended because PerimeterX combines persistent device fingerprinting, behavioural biometrics and large scale automated scoring of every visitor, which constitutes systematic monitoring under Article 35. The assessment should document the necessity and proportionality of fingerprinting for fraud prevention, the retention of visitor identifiers such as the one year _pxvid cookie, the transfer of signals to the United States, and the measures that limit reuse of the data beyond security. It should also weigh the legitimate interest in security against the impact on users who cannot easily opt out of a protective control.
Sample consent text
This site uses PerimeterX by HUMAN Security to protect against bots and fraud. It stores a security identifier on your device and analyses device and behaviour signals to tell humans from automated traffic. These signals are processed in the United States.
Third-party domains contacted
perimeterx.netpx-cdn.netpx-cloud.nethumansecurity.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _pxvid | first party security | Up to 12 months | Persistent visitor identifier that gives each device a stable reference so the service can recognise returning visitors and build session history for bot detection. |
| _pxhd | first party security | Up to 12 months | Device hash used to check that the device fingerprint stays consistent across sessions and to support risk scoring. |
| _px3 | first party security | Short lived (refreshes during the session) | Holds a cryptographically signed risk verdict token that confirms whether a request was assessed as human, refreshed frequently. |
| _pxde | first party security | Session | Carries encrypted diagnostic and signal data used to validate the integrity of the security check. |
PerimeterX (HUMAN Security) is an essential service, but transparency matters. Manage all your consent with FlowConsent.
PerimeterX sets first party security cookies in the operator domain, typically a _pxvid visitor identifier that can last up to a year, a _pxhd device hash and a short lived _px3 token that carries a signed risk verdict. It also reads device and browser signals and behavioural patterns rather than relying on cookies alone. The exact names and durations can vary by deployment.
It depends on how the tool is scoped. Where the security cookies and signals are strictly necessary to protect a login or payment the user requested, many operators rely on the ePrivacy strictly necessary exemption and load them without consent. Where collection goes beyond that or is reused for other purposes, consent is required and the activity should be gated in your consent banner.
The processing is usually based on legitimate interest under Article 6(1)(f) for fraud prevention and bot mitigation, supported by a documented balancing test. Separately, the ePrivacy Directive governs the storage and access on the device, which can still require consent even when the underlying processing rests on legitimate interest.
Yes. HUMAN Security operates from the United States, so signals from European visitors are transferred there for processing. Those transfers rely on the EU US Data Privacy Framework and its UK and Swiss extensions, with Standard Contractual Clauses used as a fallback where needed.
A Data Protection Impact Assessment is strongly advised because the tool combines persistent device fingerprinting, behavioural biometrics and automated scoring of every visitor, which amounts to systematic monitoring. The assessment should cover necessity, proportionality, retention of identifiers and the US transfer.
Sign a data processing agreement, map the cookies and signals collected, and document your legitimate interest assessment. Update the privacy notice and cookie policy to describe the fingerprinting and US processing, and configure your consent management platform so that any non essential collection waits for consent.
Other bot mitigation and fraud prevention options include Cloudflare Bot Management, Akamai Bot Manager, DataDome and Arkose Labs. Each makes different trade offs on fingerprinting, hosting region and consent posture, so evaluate them against your data residency and privacy requirements.
List the security cookies by name where possible, state their purpose and duration, and explain that device fingerprinting and behavioural analysis are also used. Note that signals are processed in the United States and identify the transfer mechanism, then review the wording whenever the configuration changes.