Salesforce Data Cloud

Overview

Salesforce Data Cloud is Salesforce's customer data platform (CDP) designed to unify first-party data from multiple touchpoints into consolidated customer profiles. On websites, it deploys tracking scripts that capture real-time behavioral signals — page views, clicks, form submissions, and custom events — and feed them into Salesforce's identity resolution and segmentation engine. The resulting unified profiles power personalization, audience targeting, and cross-channel marketing automation.

What This Script Does

Data Cloud's web SDK (sometimes loaded via cdn.c360a.salesforce.com or similar Salesforce CDN domains) collects a comprehensive set of behavioral and identity signals:

• Pageview and navigation events — every page visit is logged with URL, referrer, timestamp, and page metadata
• Identity events — when visitors authenticate, submit forms, or provide identifying information, these signals are captured for identity resolution. Email addresses, user IDs, and other identifiers are transmitted to Salesforce to link anonymous browsing sessions to known profiles
• Custom engagement events — site operators can instrument arbitrary events (video views, downloads, feature usage) that feed into the CDP
• Device and browser metadata — user agent, screen resolution, language, and timezone data are collected for identity resolution and segmentation

The script typically sets a first-party cookie (often with a _sfdc_ prefix or custom name configured by the implementation) to maintain a consistent anonymous visitor ID across sessions. This cookie persists for 1-2 years in most configurations. Data is transmitted in real time to Salesforce Data Cloud ingestion endpoints.

The collected signals feed into Data Cloud's identity resolution engine, which uses deterministic and probabilistic matching to merge anonymous and known profiles across devices and channels. Resolved profiles are then available for segmentation, activation to ad platforms, email personalization, and other marketing automation workflows.

Consent & Compliance

Data Cloud is classified under marketing and analytics. Its core function — building unified behavioral profiles for cross-channel marketing activation — is fundamentally a marketing data processing activity. Under GDPR, this type of profiling requires explicit consent under Article 6(1)(a). The identity resolution process, which links browsing behavior to known individuals, represents a high level of data processing that cannot be justified under legitimate interest for most use cases.

The ePrivacy Directive requires consent for the persistent tracking cookies set by the web SDK, as they serve no function necessary for the service explicitly requested by the visitor.

Under CCPA/CPRA, the behavioral data collected is personal information, and transmitting it to a CDP that activates audiences for advertising purposes likely constitutes "sharing" of personal information. Businesses must provide opt-out mechanisms and disclose this data processing in their privacy notices. The cross-device identity resolution adds additional sensitivity.

Should You Block This Without Consent?

Yes. Data Cloud's web SDK exists entirely to collect behavioral data for marketing profiling and cross-channel identity resolution. It provides no functionality that is necessary for the website to operate. All scripts must be blocked until the visitor explicitly consents to marketing data collection.