Akamai

Overview

Akamai is the world's largest content delivery network and a major cloud security provider, serving approximately 30% of global internet traffic. It operates over 4,000 edge locations worldwide. On websites, Akamai's presence manifests as CDN asset delivery, DDoS and bot protection via Bot Manager, and Real User Monitoring via its mPulse product.

What This Script Does

Akamai operates at multiple layers on a website simultaneously. Its CDN function is invisible to the browser (it transparently proxies requests), while its monitoring and security scripts have explicit client-side behavior.

mPulse Real User Monitoring

• boomerang.js — The mPulse RUM script. Loaded from Akamai's edge network, typically from a domain like akstat.io or embedded via an Akamai configuration beacon. Approximately 80–120KB.
• Collects page load timing (Navigation Timing API data), resource loading waterfall, AJAX call performance, and Core Web Vitals.
• Sends telemetry beacons to mpulse.soasta.com or Akamai's mPulse ingestion endpoints.
• Sets a first-party cookie for session continuity: RT — the Round Trip Time cookie. Contains a base64-encoded JSON payload with session start time, navigation timing, and a session identifier. Persists for the browser session or up to 7 days depending on configuration.

Bot Manager

• Akamai Bot Manager injects a browser fingerprinting script via a dynamically generated URL (the script URL changes to prevent blocklist circumvention). Typically 20–40KB.
• Collects: JavaScript execution timing, browser API availability (Canvas, WebGL, AudioContext), mouse movement entropy, keyboard timing patterns, and browser feature flags.
• Executes challenges (CAPTCHA, proof-of-work) for suspicious sessions.
• Sets _abck cookie — Akamai Bot Manager session cookie. Contains an encrypted blob with bot detection signals. Persists for 1 year. Set as Secure, HTTP-only.
• Sets bm_sz cookie — Bot Manager size/version indicator. Persists for 4 hours.

Kona Site Defender and Prolexic These operate at the network layer and set no client-side cookies. They are transparent to the browser.

Domains Contacted

• akstat.io, akam.io — mPulse beacon endpoints
• mpulse.soasta.com — mPulse data ingestion
• {customer}.edgesuite.net, {customer}.akamaized.net — CDN asset delivery domains
• Akamai edge IPs span most major IP blocks worldwide

Consent & Compliance

Consent category: Essential / Analytics (split by product)

• CDN (essential): Content delivery is strictly necessary infrastructure. No consent required.
• Bot Manager (essential/security): Bot detection and DDoS protection serve a legitimate security interest. The _abck cookie supports a security function. Under GDPR, security-purpose cookies may operate under legitimate interest. However, browser fingerprinting is intrusive — the German DPA (DSK) and others have expressed concern about fingerprinting even for security purposes.
• mPulse RUM (analytics): The RT cookie and performance telemetry constitute analytics data collection. Under GDPR and ePrivacy, this requires consent or a legitimate interest balancing test. The French CNIL's exemption for audience measurement analytics (no cross-site tracking, aggregated data) may apply to mPulse if configured to anonymize data.
• CCPA/CPRA: Akamai processes technical data as a service provider. Bot Manager fingerprint data and mPulse visitor sessions may constitute personal information.
• EU-US Data Privacy Framework: Akamai participates in the DPF. Data residency options are available for EU customers.

Should You Block This Without Consent?

Conditional. Akamai's CDN and Bot Manager protect critical infrastructure and should not be blocked. The mPulse RUM analytics script should be blocked until analytics consent is granted, unless configured to operate in a cookieless, anonymized mode that qualifies for the analytics exemption.