Permutive

Overview

Permutive is a privacy-first audience platform designed for publishers and media companies to build, activate, and monetize first-party audience data without relying on third-party tracking cookies. Its distinguishing technical approach is edge computing: behavioral data is processed within the visitor's browser rather than uploaded to a cloud server, producing cohort-level audience segments that are stored locally and shared with advertisers without exposing individual user data. Permutive is widely used by major publishers including Condé Nast, BuzzFeed, The Guardian, and Vice Media as a cookieless advertising infrastructure layer.

What This Script Does

Edge-side data processing: Permutive's JavaScript SDK (loaded from cdn.permutive.com or static.permutive.app) runs behavioral analysis entirely in the browser using a WebWorker. Page view data — article categories, tags, topics, section, scroll depth, time on page — is processed locally to assign the visitor to audience cohorts (e.g., "interested in personal finance," "in-market for travel"). This processing happens without uploading individual-level data to Permutive's servers.

Local storage for segment data: Permutive stores cohort membership in localStorage under the embedding site's domain. The _pdfps key (no expiry, localStorage) stores the visitor's current segment IDs. A _puid UUID in localStorage persists the anonymous visitor identifier. A permutive-id first-party cookie (1-year expiry) provides a fallback identifier for environments where localStorage is restricted.

Publisher-side data collection: While individual behavioral events are processed locally, Permutive does send segment membership data (not raw event data) to the publisher's server-side configuration and the Permutive dashboard for reporting. Publishers can see aggregate audience segment sizes and segment-level performance metrics.

Header bidding integration: Permutive passes cohort segment IDs into the header bidding process via prebid.js key-values (e.g., permutive=["seg-1234","seg-5678"]). Demand-side platforms connected to the publisher's SSP receive these segment signals in the bid request, allowing them to bid higher for users matching valuable audience segments. The segments themselves are abstracted identifiers — advertisers receive the segment ID, not the underlying behavioral data.

Identity and third-party integrations: Permutive supports first-party identity resolution through publisher login data. When a logged-in user is present, Permutive can enrich segment profiles with CRM data. The platform also integrates with Google Ad Manager, The Trade Desk, and other programmatic platforms for audience activation.

Consent & Compliance

Permutive is classified under analytics and marketing consent categories. Despite its privacy-forward architecture, the platform's end purpose is advertising monetization — building audience segments that enable programmatic ad targeting and yield optimization. The local processing approach reduces data exposure risks but does not eliminate the consent requirements.

Under GDPR, Permutive stores data in localStorage and sets first-party cookies for persistent visitor identification. Article 5(3) of the ePrivacy Directive applies to any storage of or access to information on a user's device, regardless of whether it is a cookie — this includes localStorage. Consent is required. The creation of behavioral profiles for advertising targeting, even if cohort-based, falls within the scope of GDPR processing requiring a lawful basis.

Permutive is a registered IAB TCF 2.0 vendor (Vendor ID: 908). Applicable IAB TCF purposes include Purpose 1 (Store and/or access information on a device), Purpose 7 (Measure ad performance), and Purpose 8 (Measure content performance). For full advertising activation, Purpose 2 (Use limited data to select advertising) and Purpose 4 (Select personalised ads) may apply depending on the publisher's Permutive configuration.

Under CCPA/CPRA, Permutive's collection of behavioral data for advertising purposes constitutes a sale or share of personal information in the programmatic context. Publishers using Permutive must disclose it and provide opt-out mechanisms for California residents.

Permutive is headquartered in London (UK) and New York. As a UK company post-Brexit, data transfers to the US from UK/EEA rely on International Data Transfer Agreements (UK) and Standard Contractual Clauses (EU). Permutive participates in the EU-US Data Privacy Framework.

Should You Block This Without Consent?

Yes. Despite its privacy-preserving architecture, Permutive builds behavioral audience profiles for advertising monetization and stores persistent identifiers in the browser via localStorage and cookies. The end purpose — enabling higher-value programmatic ad targeting — is marketing, and the data storage requires consent under ePrivacy regardless of where processing occurs. Block until marketing consent is obtained.