Show Menu
TOPICS×

GDPR in Audience Manager

This document covers the technicalities related to the General Data Protection Regulation (GDPR) for Audience Manager and shows you how to submit GDPR requests to Audience Manager.

GDPR Documentation in the Experience Cloud

Before reading the Audience Manager specifics, we advise you go through the Experience Cloud material for the European General Data Protection Regulation (GDPR), linked below:
The sections below explain what GDPR means for Audience Manager and how you can submit GDPR requests to Audience Manager.

Types of GDPR Requests and How to Make a GDPR Request

As an Audience Manager customer, you can submit individual GDPR requests to access and delete customer data, either through the Privacy Service UI ( UI link here and documentation here ) or by calling the Privacy Service API ( documentation here and API reference here ). You can submit any Audience Manager identifiers (IDs), as described in the section Audience Manager Identifiers , in the requests along with their respective namespace IDs (data source IDs). If you have questions, please reach out to Customer Care at gdprsupport@adobe.com .

Access Data

We understand your commitment to honoring your GDPR customer requests within 30 days of reception. For that reason, we try to process your data access request as soon as possible.
Request
You can log data access requests through the Privacy Service UI ( UI link here and documentation here ) or by calling the Privacy Service API ( documentation here and API reference here ). In either case, you must upload a JSON with the Audience Manager identifiers for which you are submitting the data access request. To see what a well-formed JSON looks like, you can download a sample JSON .
Response
Responses to access data requests contain a summary of total number of traits and segments, trait type, descriptions of traits and segments along with the respective data source names. The Access response will also include second party and third party data accessible to the Data Controller along with the first party data. When declared IDs such as cross device CRM IDs or customer cookie IDs are sent in GDPR requests, Audience Manager will include the Access response from all the linked devices (up to 100 devices per declared ID).
Response Status
If there are any errors from Audience Manager in the response, these are surfaced as error codes in the response. We have a list of error codes , where you can find more information about the returned errors.
Example Response
A sample access response could look like the one below. In this example, the Data Subject's ID is a cookie ID. They qualified for several traits and belong to a few segments. The cookie ID is linked to a mobile ID. The example also contains metadata for the phone they use.
{
  "id": "45338264191156397602180946733455975613",
  "namespace": {
    "id": 0,
    "integration code": "",
    "data provider name": "Demdex, Inc",
    "type": "COOKIE"
  },
  "warnings": [{
    "title": "Device Data",
    "description": "Contains data from all users of this device"
  }],
  "data": {
    "traits": [{
      "name": "Website Visitors",
      "type": "1st party",
      "description": "All Active Visitors",
      "data export controls": [],
      "data provider name": "My company",
      "last realization": "2018-04-10 17:00:37"
    }, {
      "name": "Interested in Italian Holidays",
      "type": "1st party",
      "description": "Query string contains holidays/bella_italia",
      "data export controls": [],
      "data provider name": "My company",
      "last realization": "2018-04-10 17:00:37"
    }, {
      "name": "Lifestyle>Recreational>Garden Party",
      "type": "3rd party",
      "description": "Survey respondents that have expressed an interest in hosting garden parties",
      "data export controls": [],
      "data provider name": "A third party data provider",
      "last realization": "2018-04-10 17:00:36"
    }],
    "segments": [{
      "name": "test",
      "description": "Interested in Photography",
      "data export controls": [],
      "data provider name": "My company",
      "last realization": "2018-04-10 17:00:37",
      "active": "false"
    }, {
      "name": "Traveler and Frequent Flier",
      "description": "",
      "data export controls": [],
      "data provider name": "A third party data provider",
      "last realization": "2018-04-10 17:00:37",
      "active": "true"
    }, {
      "name": "Interested in Sports",
      "description": "",
      "data export controls": [],
      "data provider name": "My company",
      "last realization": "2018-04-10 17:00:37",
      "active": "true"
    }]
  },
  "links": [{
    "id": "e4fe9bde-caa0-47b6-908d-ffba3fa184f2",
    "namespace": {
      "id": 20914,
      "integration code": "DSID_20914",
      "data provider name": "Google",
      "type": "MOBILE"
    },
    "linking datetime": "2018-04-10 17:00:37"
  }],
  "deviceMetadata": {
    "hardware": "Mobile Phone",
    "manufacturer": "Samsung",
    "marketing name": "Galaxy S8 Plus",
    "model": "",
    "os name": "Android",
    "os version": "7.0",
    "vendor": "Samsung"
  }
}

The table below contains descriptions for all the returned fields in the data access response, in the order that they appear above.
Field
Description
id
The user ID for the data that follows. This is either an id you provided in the GDPR data access request, or an ID that is linked to one of the declared IDs you provided. The ID types are described in the Audience Manager Identifiers section.
namespace
Also referred to as data source. See the Audience Manager Identifiers section.
id
The ID of the namespace/data source. See Audience Manager Identifiers (IDs) for all the accepted values.
integration code
Integration codes are friendly names for your data sources, and help you track your data sources easier than using data source IDs.
data provider name
The name of the owner of the data source.
  • For first party data, this is the customer's own company name.
  • For second party data, this is the name of the partner company.
  • For third party data, this is the name of the data partner.
type
The type of ID for which you requested the GDPR data access. Accepted types are listed in the Audience Manager Identifiers section.
warnings
Warnings return further information related to the data access request.
title
Brief information about the warning.
The two warnings you may receive are:
  • Device Data
  • Incomplete request
description
A more detailed description of the warning you received:
  • Device Data - Contains data from all users of this device
  • Incomplete request - Retrieval of Audience Manager data was not completed. Some information may be missing.
data
The traits and segments associated with this user ID.
traits
Traits associated with the user ID.
name
The name of the trait.
type
The trait type. The possible values are:
  • First party for your own traits.
  • Second party for traits that belong to your partners. Read our Second Party Data article for more information.
  • Third party for traits obtained from data partners, via the Audience Marketplace .
description
A few words to help describe the trait's purpose or function. This is an optional field.
data export controls
The data export controls applied to this trait's data source.
data provider name
The name of the owner of the data source that this trait belongs to.
  • For first party data, this is the customer's own company name.
  • For second party data, this is the name of the partner company.
  • For third party data, this is the name of the data partner.
last realization
The exact time that the Data Subject last qualified for this trait. The date format is YYYY-MM-DD.
segments
Segments that this user belongs to.
name
The name of the segment.
description
A few words to help describe this segment. This is an optional field.
data export controls
The data export controls applied to this segment's data source.
data provider name
The name of the owner of the data source that this segment belongs to.
  • For first party data, this is the customer's own company name.
  • For second party data, this is the name of the partner company.
  • For third party data, this is the name of the data partner.
last realization
The exact time that the Data Subject last qualified for this segment. The date format is YYYY-MM-DD.
active
Indicates whether the Data Subject is currently qualified for this segment. Returns true or false .
links
Additional ID that this ID has been linked to. Information is returned on:
  • ID
  • namespace (data source)
  • namespace ID
  • integration code
  • data provider name
  • ID type
All these fields are described in the first rows of this table.
linking datetime
The exact time that an ID sync event made the link between IDs. The date format is YYYY-MM-DD.
device metadata
Information about the device. This information includes the fields below. Note that not all fields are returned for all device types.
  • Hardware information
  • Device manufacturer
  • The marketing name of the device
  • The device model
  • The name of the device's Operating System (OS)
  • The version of the OS
  • The device vendor
Note: We only return device metadata when you submit either one of:
  • Mobile IDs
  • Audience Manager IDs
  • Experience Cloud IDs

Delete Data

We understand your commitment to honoring your GDPR customer requests within 30 days of reception. For that reason, we try to process your data deletion request as soon as possible.
Request
You can log data deletion requests through the Privacy Service UI ( UI link here and documentation here ) or by calling the Privacy Service API ( documentation here and API reference here ). In either case, you must upload a JSON with the Audience Manager identifiers for which you are submitting the data access request. To see what a well-formed JSON looks like, you can download a sample JSON .
Response
In response to data deletion requests, we delete traits and segments associated with the respective Audience Manager identifier. In addition, the respective Audience Manager identifiers for the Data Subject will be permanently opted out of further data collection by Audience Manager and the respective Id mappings will be removed. When declared IDs such as cross device CRM Ids or customer cookie ids are sent in GDPR requests, Audience Manager will perform the necessary Delete actions on all the linked devices (up to 100 devices per declared ID).

Opt-out Request

For opt-out requests, please refer to our documentation on Opt-out Management .

Audience Manager Identifiers (IDs)

When submitting GDPR requests to Adobe Audience Manager, you must include one of the identifiers (IDs) listed below. You can find more information on the ID formats in our Index of Audience Manager IDs .

Adobe Audience Manager Unique User ID

User ID : aam_uuid
Definition : Adobe Audience Manager Unique User ID
Namespace ID : 0
You can also use the CORE namespace. See the second JSON example.
Example in JSON :
 "users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace": "0",
        "type": "namespaceId",
        "value": "85302821933904870272023537812382806531"
      },
      {
        "namespace": "0",
        "type": "namespaceId",
        "value": "85690090981158357332062532910972162921"
      }
    ]
  }
]

 "users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace": "CORE",
        "type": "standard",
        "value": "85302821933904870272023537812382806531"
      },
      {
        "namespace": "CORE",
        "type": "standard",
        "value": "85690090981158357332062532910972162921"
      }
    ]
  }
]

Adobe Experience Cloud ID

User ID : mid
Definition : Adobe Experience Cloud ID, formerly known as Visitor ID or Marketing Cloud ID
Namespace ID : 4
You can also use the ECID namespace. See the second JSON example.
Example in JSON :
 "users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace": "4",
        "type": "namespaceId",
        "value": "54893990981158357332062532910972162921"
      },
      {
        "namespace": "4",
        "type": "namespaceId",
        "value": "46990090981158357332062532910972162921"
      }
    ]
  }
]

 "users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace": "ECID",
        "type": "standard",
        "value": "54893990981158357332062532910972162921"
      },
      {
        "namespace": "ECID",
        "type": "standard",
        "value": "46990090981158357332062532910972162921"
      }
    ]
  }
]

Customer ID

User ID : cid
Definition : Customer ID, such as a cookie you set for anonymous site visitors or a CRM ID from an offline system or a hashed username
Namespace ID : Customer-specific. Please find it from your Audience Manager instance.
Example in JSON :
"users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      
      {
        "namespace":"1234567",
        "type": "namespaceId",
        "value": "unique-user-id-for-datasource-1234567"
      },
      {
        "namespace": "1234567",
        "type": "namespaceId",
        "value": "another-unique-user-id-for-datasource-1234567"
      },
      {
        "namespace":"54321",
        "type": "namespaceId",
        "value": "unique-user-id-for-datasource-54321"
      }
    ]
  }

Mobile advertising ID

User ID : d_cid
Definition : Mobile advertising IDs.
If you are using the Mobile SDK, then you should also send the Experience Cloud ID (MID) along with mobile advertising IDs for complete GDPR Access and Delete responses.
Namespace ID :
  • IDFA: 20915
  • GAID: 20914
See Global Data Sources for more details.
Example in JSON :
"users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace":"20914",
        "type": "namespaceId",
        "value": "e4fe9bde-caa0-47b6-908d-ffba3fa184f2"
      },
      {
        "namespace":"20915",
        "type": "namespaceId",
        "value": "AEBE52E7-03EE-455A-B3C4-E57283966239"
      }
    ]
  }
]

Integration code

User ID : d_cid_ic
Definition : An integration code for the data source. This can be used instead of data source ID / namespace ID in the API request to Adobe Experience Cloud Privacy Core Service.
Namespace ID : Not applicable
Example in JSON:
"users": [
  {
    "key": "Example user 1",
    "action": [
      "access"
    ],
    "userIDs": [
      {
        "namespace": "loyaltyCard",
        "type": "integrationCode",
        "value": "272023537812"
      },
      {
        "namespace":"offlineCampaign",
        "type": "integrationCode",
        "value": "9546673332"
      }
    ]
  }
]