PerimeterX (HUMAN Security)

What PerimeterX (HUMAN Security) Is

PerimeterX is a bot mitigation and fraud prevention service that is now part of HUMAN Security, following the 2022 merger. It helps websites and applications tell genuine human visitors apart from automated traffic such as scrapers, credential stuffing tools and fake account bots. The service runs client side JavaScript that collects device, browser and behavioural signals, then scores each request on the server side to decide whether to allow, challenge or block it. It is widely deployed on login pages, checkout flows and APIs where automated abuse causes real financial harm. Because the protection is woven into the request path, it operates on every visitor rather than only on those who interact with a particular feature. This combination of persistent identifiers and large scale scoring is exactly what gives it both its security value and its privacy sensitivity.

Cookies and Data Collected

PerimeterX sets a small family of first party cookies in the website operator domain. The _pxvid visitor identifier persists for up to one year and acts as a stable device reference, while the _pxhd device hash helps check fingerprint consistency across sessions, and the short lived _px3 token carries a signed risk verdict that refreshes frequently. Alongside these cookies the client script reads device and browser signals such as canvas, WebGL and audio characteristics, navigator properties and connection level TLS and HTTP fingerprints. It also collects behavioural biometrics including mouse movement, scrolling and keystroke timing throughout the session. These signals together build a device fingerprint and behavioural profile that the backend uses to assign a bot or human verdict. The exact cookie set and durations can vary by deployment and product configuration.

GDPR and ePrivacy Implications

The signals PerimeterX processes, including device identifiers and behavioural patterns, are personal data under the GDPR because they single out and recognise individual users and devices. Security and fraud prevention can be a legitimate interest under Article 6(1)(f), and the recitals expressly recognise fraud prevention as a valid interest, but the controller must still run and document a balancing test. The ePrivacy Directive adds a separate layer because reading information from and storing information on a user device generally requires consent unless it is strictly necessary for a service the user has explicitly requested. Regulators such as the CNIL treat device fingerprinting the same way as cookies for this purpose. Whether the strictly necessary exemption applies is fact specific and tends to be read narrowly, so many deployments cannot assume it covers all of the collection. This tension between a legitimate security purpose and the ePrivacy storage and access rule is the central compliance question for the tool.

Consent Requirements and CMP Integration

Many operators argue that the security cookies and signals strictly necessary to keep a login or payment flow safe fall within the ePrivacy exemption, and so place them in a strictly necessary category that loads without prior consent. That position is defensible only where the collection is genuinely limited to security and is not reused for analytics, advertising or profiling. Any signal collection that goes beyond protecting the requested service, or that is reused for other purposes, should be gated behind consent in your consent management platform. A practical approach is to classify PerimeterX as a security control, document why each cookie and signal is necessary, and ensure your CMP reflects that classification transparently. You should also describe the device fingerprinting plainly in the cookie notice so users understand that more than simple cookies are involved.

International Data Transfers

HUMAN Security is headquartered in the United States and operates its services from there, so signals collected from European visitors are transferred to the United States for processing. HUMAN self certifies under the EU US Data Privacy Framework and its UK and Swiss extensions, which provides an adequacy based transfer mechanism for organisations that participate. Where the framework does not cover a particular transfer, Standard Contractual Clauses are used as a fallback safeguard. As a controller you should confirm the current certification status, record the chosen transfer mechanism in your records of processing, and complete a transfer impact assessment where your risk approach requires one. Keeping evidence of these mechanisms is important because the legal landscape for transatlantic transfers has changed several times.

Practical Compliance Steps

Start by signing a data processing agreement with HUMAN Security and mapping exactly which cookies and signals are collected on your site. Document your legitimate interest assessment for fraud prevention and decide, per page or flow, whether the strictly necessary exemption truly applies or whether consent is needed. Update your privacy notice and cookie policy to name the security cookies, explain the device fingerprinting and behavioural analysis, and state that signals are processed in the United States. Configure your consent management platform so that any non essential collection is blocked until the user agrees. Set appropriate retention expectations and confirm with the vendor how long identifiers such as the visitor cookie persist. Finally, review the configuration periodically so your documentation stays aligned with how the product is actually deployed.