Does Akamai require cookie consent?

Conditional. Akamai's CDN and Bot Manager serve essential security functions and do not require consent. The mPulse Real User Monitoring script collects performance analytics via the RT cookie and requires analytics consent under GDPR and ePrivacy. Block mPulse until analytics consent is granted; do not block CDN delivery or bot protection.

What cookies does Akamai set?

Akamai Bot Manager sets _abck (encrypted bot detection signals, 1 year) and bm_sz (version indicator, 4 hours) as HTTP-only, Secure cookies. The mPulse RUM script sets the RT cookie containing session timing and navigation data encoded as base64 JSON. CDN delivery and DDoS protection components set no client-side cookies.

How does ConsentStack manage Akamai consent?

ConsentStack splits Akamai into two categories. Bot Manager and CDN scripts are classified as essential and always permitted. The mPulse analytics script is classified under analytics and blocked until analytics consent is granted. ConsentStack detects the boomerang.js RUM script by its filename and akstat.io beacon domain.

What tracker domains does Akamai use?

ConsentStack has catalogued tracker domains for Akamai including go-mpulse.net, qsearch-a.akamaihd.net and lg3-a.akamaihd.net, among 307 in total. These are the network destinations Akamai's scripts contact, which a consent platform blocks until a visitor agrees.

Akamai (go-mpulse.net) - Edge CDN, Bot Fingerprinting & Privacy Info

Back to Vendor Library

Overview

Akamai is the world's largest content delivery network and a major cloud security provider, serving approximately 30% of global internet traffic. It operates over 4,000 edge locations worldwide. On websites, Akamai's presence manifests as CDN asset delivery, DDoS and bot protection via Bot Manager, and Real User Monitoring via its mPulse product.

What This Script Does

Akamai operates at multiple layers on a website simultaneously. Its CDN function is invisible to the browser (it transparently proxies requests), while its monitoring and security scripts have explicit client-side behavior.

mPulse Real User Monitoring

boomerang.js — The mPulse RUM script. Loaded from Akamai's edge network, typically from a domain like akstat.io or embedded via an Akamai configuration beacon. Approximately 80–120KB.
Collects page load timing (Navigation Timing API data), resource loading waterfall, AJAX call performance, and Core Web Vitals.
Sends telemetry beacons to mpulse.soasta.com or Akamai's mPulse ingestion endpoints.
Sets a first-party cookie for session continuity: RT — the Round Trip Time cookie. Contains a base64-encoded JSON payload with session start time, navigation timing, and a session identifier. Persists for the browser session or up to 7 days depending on configuration.

Bot Manager

Akamai Bot Manager injects a browser fingerprinting script via a dynamically generated URL (the script URL changes to prevent blocklist circumvention). Typically 20–40KB.
Collects: JavaScript execution timing, browser API availability (Canvas, WebGL, AudioContext), mouse movement entropy, keyboard timing patterns, and browser feature flags.
Executes challenges (CAPTCHA, proof-of-work) for suspicious sessions.
Sets _abck cookie — Akamai Bot Manager session cookie. Contains an encrypted blob with bot detection signals. Persists for 1 year. Set as Secure, HTTP-only.
Sets bm_sz cookie — Bot Manager size/version indicator. Persists for 4 hours.

Kona Site Defender and Prolexic These operate at the network layer and set no client-side cookies. They are transparent to the browser.

Domains Contacted

akstat.io, akam.io — mPulse beacon endpoints
mpulse.soasta.com — mPulse data ingestion
{customer}.edgesuite.net, {customer}.akamaized.net — CDN asset delivery domains
Akamai edge IPs span most major IP blocks worldwide

Consent & Compliance

Consent category: Essential / Analytics (split by product)

CDN (essential): Content delivery is strictly necessary infrastructure. No consent required.
Bot Manager (essential/security): Bot detection and DDoS protection serve a legitimate security interest. The _abck cookie supports a security function. Under GDPR, security-purpose cookies may operate under legitimate interest. However, browser fingerprinting is intrusive — the German DPA (DSK) and others have expressed concern about fingerprinting even for security purposes.
mPulse RUM (analytics): The RT cookie and performance telemetry constitute analytics data collection. Under GDPR and ePrivacy, this requires consent or a legitimate interest balancing test. The French CNIL's exemption for audience measurement analytics (no cross-site tracking, aggregated data) may apply to mPulse if configured to anonymize data.
CCPA/CPRA: Akamai processes technical data as a service provider. Bot Manager fingerprint data and mPulse visitor sessions may constitute personal information.
EU-US Data Privacy Framework: Akamai participates in the DPF. Data residency options are available for EU customers.

Should You Block This Without Consent?

Conditional. Akamai's CDN and Bot Manager protect critical infrastructure and should not be blocked. The mPulse RUM analytics script should be blocked until analytics consent is granted, unless configured to operate in a cookieless, anonymized mode that qualifies for the analytics exemption.

Is Akamai GDPR compliant?

Akamai typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Akamai can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Akamai, not on Akamai itself.

Visit website

Products (1)

Akamai Client-Side Protection

Akamai Client-Side Protection is a script security solution that monitors third-party JavaScript for supply chain attacks and data skimming. A lightweight agent script observes the behavior of all scripts running on the page, detecting unauthorized data access and exfiltration attempts. Behavioral telemetry is transmitted to Akamai for analysis and alerting.

Consent Categories

Essential Analytics

Also Known As

Akamai CDNmPulseAkamai Bot ManagerAkamai RUMAkamai mPulse scriptcontent delivery network

Industries

Computers Electronics and TechnologyProgramming and Developer Software

Tracked Domains (307)

Akamai's trackers are occasionally seen, seen on about 2% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

go-mpulse.netAnalytics

go-mpulse.net is an analytics domain operated by Akamai, used to measure visits, sessions, and on-site behavior. Seen on about 2% of scanned sites.

qsearch-a.akamaihd.netEssential

qsearch-a.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

lg3-a.akamaihd.netEssential

lg3-a.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

trial-eum-clientnsv4-s.akamaihd.netEssential

trial-eum-clientnsv4-s.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

trial-eum-clienttons-s.akamaihd.netEssential

trial-eum-clienttons-s.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

amp.akamaized.netEssential

amp.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

espn.com.edgesuite.netEssential

espn.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

espncdn.com.edgesuite.netEssential

espncdn.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ms.akadns.netEssential

ms.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fastsimon.akamaized.netEssential

fastsimon.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fox.com.edgesuite.netEssential

fox.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

stls.edgesuite.netEssential

stls.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

msftauth.akadns.netEssential

msftauth.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fr.edgesuite.netEssential

fr.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

res-stls-prod.edgesuite.netEssential

res-stls-prod.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ds-aksb-a.akamaihd.netEssential

ds-aksb-a.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

adobe.com.edgesuite.netEssential

adobe.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

lolstatic-a.akamaihd.netEssential

lolstatic-a.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

speee-ad.akamaized.netEssential

speee-ad.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

com-v1.edgesuite.netEssential

com-v1.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

baseui.akamaized.netEssential

baseui.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

wondershare.com.edgesuite.netEssential

wondershare.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

walmartimages.com.akadns.netEssential

walmartimages.com.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

blz-contentstack-images.akamaized.netEssential

blz-contentstack-images.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

de.edgesuite.netEssential

de.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

akamai.comEssential

akamai.com is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

net-stls-v3.edgesuite.netEssential

net-stls-v3.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

itunes-apple.com.akadns.netEssential

itunes-apple.com.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

luxottica.com.edgesuite.netEssential

luxottica.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

blz-contentstack-assets.akamaized.netEssential

blz-contentstack-assets.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

tmsi.akamaized.netEssential

tmsi.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

tmssl.akamaized.netEssential

tmssl.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ccmbg.com.edgesuite.netEssential

ccmbg.com.edgesuite.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

everesttech.net.akadns.netEssential

everesttech.net.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

chase.com.akadns.netEssential

chase.com.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

naver.com.akadns.netEssential

naver.com.akadns.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

warnermediacdn.akamaized.netEssential

warnermediacdn.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

cedexis-test.akamaized.netEssential

cedexis-test.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

steamcdn-a.akamaihd.netEssential

steamcdn-a.akamaihd.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

cdn1-gae-ssl-default.akamaized.netEssential

cdn1-gae-ssl-default.akamaized.net is an essential domain operated by Akamai, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

+ 267 more tracked domains, shown by how common they are across scanned sites.