Does Adobe Audience Manager require consent under GDPR?

Yes. Adobe Audience Manager is firmly in the marketing category. Its demdex third-party cookie enables cross-site tracking across all sites using AAM, and ID sync exchanges visitor identifiers with advertising network partners. GDPR requires explicit consent; the ePrivacy Directive requires it before the demdex cookie is set.

What cookies does Adobe Audience Manager set?

AAM sets demdex (180-day, third-party cross-site tracker under demdex.net), dextp (180-day, last sync timestamp under demdex.net), dst (180-day, sync error flag), aam_uuid (30-day first-party fallback UUID), and AMCV_[orgID]@AdobeOrg (2-year Experience Cloud visitor ID). Data goes to dpm.demdex.net.

How does ConsentStack handle Adobe Audience Manager?

ConsentStack classifies Adobe Audience Manager as marketing. The dil.js library and any server-side forwarding from Adobe Analytics are blocked until marketing consent is obtained. ConsentStack prevents the demdex cross-site cookie from being set and stops ID sync calls to advertising partner networks until the visitor explicitly consents.

What tracker domains does Adobe Audience Manager use?

ConsentStack has catalogued tracker domains for Adobe Audience Manager including cm.everesttech.net. These are the network destinations Adobe Audience Manager's scripts contact, which a consent platform blocks until a visitor agrees.

Adobe Audience Manager - DMP Tracking & Cookie Consent

Back to Vendor Library

Overview

Adobe Audience Manager is Adobe's data management platform (DMP) used by enterprises to build audience segments from website visitor data and activate them across advertising platforms. When its scripts are present on a site, they are collecting behavioral signals and syncing visitor IDs with third-party advertising networks. Audience Manager is one of the more privacy-impactful Adobe products due to its core function of enabling cross-site audience targeting.

What This Script Does

Adobe Audience Manager deploys the dil.js (Data Integration Library) script or receives data via server-side forwarding from Adobe Analytics. The DIL collects on-site behavioral signals and transmits them to Adobe's Audience Manager servers for segment qualification.

Key cookies set:

demdex — a third-party cookie set under the demdex.net domain. Contains a unique visitor ID used to identify users across different websites that use Adobe Audience Manager. 180-day expiry. This is a cross-site tracking cookie.
dextp — records the last time a data synchronization call was made for the visitor. Set under demdex.net. 180-day expiry.
dst — set under demdex.net when a data sync destination returns an error. 180-day expiry.
_dp — set under the first-party domain, indicates whether the Demdex domain (third-party) is accessible in the visitor's browser. 1-day expiry.
aam_uuid — first-party cookie that stores the Audience Manager unique user ID. Used as a fallback when third-party cookies are blocked. 30-day expiry.
AMCV_[orgID]@AdobeOrg — Experience Cloud Visitor ID cookie, shared across Adobe products. 2-year expiry.

The script contacts dpm.demdex.net for data collection and ID synchronization. Audience Manager performs "ID syncs" with dozens of advertising and data partners — exchanging visitor IDs with platforms like Google, The Trade Desk, and various DSPs. These sync calls are visible as pixel fires to partner domains during page load.

Data collected includes: page URLs, on-site behavioral signals (product views, content categories, search terms), first-party data passed by the site operator, and cross-site audience membership from ID sync partners. Audience Manager builds visitor profiles and evaluates them against segment rules in real time, making segment memberships available for ad targeting.

Consent & Compliance

Adobe Audience Manager operates firmly in the marketing category. Its sole purpose is to build audience segments for advertising targeting and syndicate those segments to ad platforms.

Under the GDPR, Audience Manager processes personal data extensively — cross-site tracking IDs, behavioral profiles, and ID syncs with third-party advertising networks. The demdex third-party cookie enables cross-site tracking, which requires explicit consent. The ID sync mechanism, which shares visitor identifiers with advertising partners, constitutes data sharing with third parties that must be disclosed and consented to.

The ePrivacy Directive requires consent for all cookies set by Audience Manager. Both the third-party demdex cookies and the first-party fallback cookies are used for advertising purposes and do not qualify for the strictly necessary exemption.

Under CCPA/CPRA, Audience Manager's core function — building audience segments and syncing them with advertising platforms — constitutes "sharing" of personal information for cross-context behavioral advertising. This triggers opt-out requirements and the obligation to honor Global Privacy Control (GPC) signals.

Should You Block This Without Consent?

Yes. Adobe Audience Manager is a DMP built for cross-site audience targeting. It sets third-party tracking cookies, syncs visitor IDs with advertising networks, and exists solely to enable marketing use cases. It must be blocked until explicit consent is obtained.

Is Adobe Audience Manager GDPR compliant?

Adobe Audience Manager typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Adobe Audience Manager can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Adobe Audience Manager, not on Adobe Audience Manager itself.

Visit website