Adobe Audience Manager Appears in Tracking Lawsuits. What Does It Share?

What Does Adobe Audience Manager Do?

Audience Manager is a data management platform. Adobe's overview says it helps businesses collect information about site visitors, "create marketable segments, and serve targeted advertising and content." Businesses can combine that data with their own customer records and with data from outside providers.

Its calls go to demdex.net, a domain that Adobe controls. The name comes from Demdex, a company Adobe acquired in 2011 and renamed Audience Manager. Audience Manager recognizes visitors with a third-party cookie named demdex, which Adobe sets on its own domain rather than the website's. Adobe's cookie list says it assigns each visitor a unique ID for 180 days, renewed each time the visitor interacts with a partner website.

Not every demdex.net call comes from Audience Manager. Adobe's visitor ID service, which supports Adobe Analytics and Adobe Target, uses the same domain and the demdex cookie. It also stores its own visitor ID in a first-party cookie whose name begins with AMCV_. The table lists the most common calls and their functions.

Based on Adobe's Experience League documentation, as of November 2026.

Some websites send data to Audience Manager through Adobe Analytics, which Adobe calls server-side forwarding. In that setup, page views and other Analytics data reach Audience Manager without a separate call from the page.

What Does Audience Manager Share with Other Companies?

Audience Manager and its advertising partners each assign their own ID to a specific browser. An ID sync links those IDs, so Adobe and each partner can match data about that specific browser. The syncs run in a hidden frame while the page loads and are on by default. Adobe says a second cookie on its domain, dextp, records "the last time it made a data synchronization call."

Audience Manager also sends its segments, which are groups of visitors with something in common, to other companies' systems, such as ad servers and ad networks. Adobe calls these systems destinations and defines one as any third-party system "that you want to share data with." The ID syncs let Adobe send a segment to an ad network using the ad network's own IDs. The ad network can then recognize those visitors on other websites and show them ads.

Adobe describes Audience Manager as a service provider under California law, meaning it processes data for the businesses that use it. However, the advertising companies that receive the ID syncs and destinations are separate businesses. Passing identifiers to them may qualify as sharing, which California defines as giving personal information to others for advertising based on activity across websites.

Why Do Plaintiffs Focus on It?

Many federal website tracking complaints filed in 2025 and 2026 name demdex.net or Audience Manager. They target retailers, insurers, hospital systems, hotels, automakers, and other businesses, usually over several advertising tools at once. A common allegation is that requests to demdex.net continued after visitors rejected cookies or opted out of the sale of their data.

Plaintiffs point to the demdex cookie because it can follow a browser across websites. Adobe's own documentation says the demdex ID stays the same across different companies' websites. A September 2026 complaint against a sports entertainment company alleges that the cookie lets Adobe track visitors "across multiple domains."

Other complaints focus on the ID syncs. A 2025 complaint filed in Los Angeles against a pharmacy chain alleges that Adobe's demdex server "synchronizes users' unique identifiers with third-party advertising partners."

Most of these complaints rely on the wiretapping provision of the California Invasion of Privacy Act (CIPA), the federal Wiretap Act, or both. Many also cite CIPA's pen register provision, which plaintiffs argue covers the collection of IP addresses and device details. SB 690 leaves pen register claims over website tracking to the California Attorney General starting January 1, 2027.

What Have Courts Said So Far?

Adobe itself was sued in 2025 over its visitor ID service, which the plaintiffs allege tracks people across websites and syncs their IDs with advertising partners. In September 2026, a federal judge in San Jose dismissed the case with permission to amend. The judge held that the plaintiffs "must do more than merely assert that they did not consent." The plaintiffs filed an amended complaint in October 2026.

In October 2026, a federal judge in Kentucky let claims over a health insurer's use of Adobe Analytics proceed. The court cited allegations that Adobe captured members' search terms and assigned them persistent identifiers. Because members used the insurer's portal to review claims and manage prescriptions, the judge found a plausible HIPAA violation, which kept the federal Wiretap Act claim alive.

Which Consent Category Fits Audience Manager?

Adobe does not assign Audience Manager to a consent banner category, but its own descriptions point to advertising. Its device storage disclosure for the IAB's consent framework says the domain is used to "serve targeted advertising and content." Adobe also sends consumers who want to opt out of Audience Manager to its advertising opt-out page.

The visitor ID service is harder to place. Adobe Analytics relies on it, but Adobe says it also syncs IDs automatically with Advertising Cloud, the company's ad platform. Because the ID service and Audience Manager share a domain, websites file demdex.net in different categories. When it is filed under analytics, an advertising opt-out may not stop Audience Manager's ID syncs.

Adobe's Opt-in service can hold Audience Manager until visitors agree, but it is off by default in Adobe's tag manager. The newer Web SDK has a single consent setting for all Adobe products, so visitors' choices apply to Analytics and Audience Manager alike. Its default is "in," which suits an opt-out model. Adobe also documents an opt-in pattern that waits for consent.

What Does This Mean for Businesses?

Audience Manager is a lawful tool for building advertising audiences. For businesses that use it, the key question is what data reaches other companies. A demdex.net request alone does not show that, because the domain serves several Adobe functions.

ID syncs appear in the website's traffic as requests to partner domains. Destinations that run from Adobe's servers never pass through the browser, so the Audience Manager account is the best place to see which companies receive the segments.

I recommend that businesses confirm whether Audience Manager runs on their websites and which consent category it falls under. Where it is active, an opt-out or a Global Privacy Control signal should stop its calls, its ID syncs, and any Analytics data forwarded to it.

Consent banners help only if they block the calls themselves. That usually means the consent platform sends each visitor's choice to the website's tag manager, which then blocks Adobe's code for visitors who decline. At Captain Compliance, where I am Chief Trust & Privacy Officer, our consent platform sends that signal.