RU EN
www.
Technical audit · 01.09.2026

liveramp.com

Data broker LiveRamp
GLOBAL

The site of LiveRamp — a company specialising in identity resolution and advertising data matching — 1319 requests, 33 nodes, a 4.5-minute recording. The consent-management platform Ketch is installed on the site, but the personalisation service Intellimize, tied to a user identifier, starts three seconds before it loads, and Google Analytics sends data with the gcs=G100 marker earlier than Ketch recorded consent. The policy names Google Analytics and Google Ads, but does not disclose Intellimize, Ketch and the AdSense advertising node by name.

Request timeline

+0 ms · browser telemetry (not the site)
At the very start of the recording there is a request to browser.events.data.msn.com — telemetry of the Microsoft Edge browser. It has nothing to do with the liveramp.com site and does not enter the analysis of its behaviour.
+3561…+3799 ms · loading the site and the first scripts
The home page liveramp.com is opened. Served through Cloudflare (server: cloudflare). From the markup, cdn.prod.website-files.com (the site is on Webflow), jsDelivr, and — at once — the personalisation service Intellimize (cdn.intellimize.co) and Google Tag Manager start. The content-security-policy is reduced to frame-ancestors 'self'; there is no strict transport or permissions policy. The browser was sending the DNT: 1 header.
+4255…+5209 ms · personalisation before consent
Intellimize sends POST requests: api.intellimize.co/context-v2 and /prediction with a user identifier, then log.intellimize.co/logger. In total more than fifty requests go to the personalisation service over the recording. All of this is before the consent platform loads.
+5733…+9649 ms · the consent platform loads late
geo.privacymanager.io, then eu.ketchcdn.com and cdn.ketchjs.com — the Ketch consent-management platform. The configuration loads at +6676 ms, the consent-state request (consent/get) goes out at +9146 ms, the update (consent/update) at +9649 ms. By this point the Intellimize personalisation and the first Google Analytics request have already run.
+8042 ms · Google Analytics transmits data
region1.google-analytics.com/g/collect: property G-JY5CK6C64V, client identifier, page_view event, consent-mode marker gcs=G100. The request goes out a second and a half earlier than Ketch recorded consent with an update. Later in the recording, variation_viewed (personalisation), scroll and page_view events go out with the same marker.
+8186 ms · Google Ads conversion tracking
pagead2.googlesyndication.com/ccm/collect with the identifier AW-874879263 — the conversion tracking of Google Ads advertising campaigns, 14 requests over the recording.
+35579…+247169 ms · navigation across sections
Navigation across the our-platform, solutions (enterprise-identity, data-sellers), clean-rooms, partners pages and the partner directory. On each page Ketch goes through a new cycle, and Google Analytics and personalisation send new events with gcs=G100.

Declared versus actual

✓ Controller — LiveRamp; the site and marketing privacy policy (Website And Marketing Privacy Policy) — declared
✓ Automated technologies are used (cookies, pixel tags, device identifiers), activated when visiting the site — declared
✓ Google Analytics (web analytics) and Google Ads (digital advertising) are named, as well as LinkedIn, Twitter as channels — declared
✓ Sections described: the user's choices regarding data, disclosures, international transfers, security, retention, rights — declared
+ Intellimize — personalisation and A/B testing with a user identifier, not named; starts before the consent platform — not declared
+ Ketch — consent-management platform, not named individually — not declared
+ AdSense/DoubleClick (googlesyndication.com) — advertising node, not named — not declared
+ Wistia, Sentry, RampedUp, PartnerFleet, Storylane, Finsweet — not named — not declared
+ Sending Google Analytics data with gcs=G100 and Intellimize personalisation before consent is recorded by the Ketch platform — not declared

Transfer timings

+3568 ms cdn.intellimize.co

Intellimize personalisation service.

+3799 ms www.googletagmanager.com

Google Tag Manager.

+4255 ms api.intellimize.co

Personalisation: context-v2, prediction with a user identifier.

+5733 ms geo.privacymanager.io

Ketch, loads after the personalisation and GTM.

+8042 ms region1.google-analytics.com

GA4 G-JY5CK6C64V, client identifier, page_view, gcs=G100.

+8186 ms pagead2.googlesyndication.com

Google Ads conversions AW-874879263, 14 requests.

Detected trackers

Indicators of GDPR non-compliance

Context

liveramp.com is the site of LiveRamp, a large data broker. LiveRamp matches the scattered digital traces of a single person — email address, cookies, device identifiers — into a unified profile and links advertisers’ customer databases to online profiles for targeting; such services are commonly called identity resolution and data onboarding. The controller is LiveRamp. The site is built on Webflow (cdn.prod.website-files.com) and served through Cloudflare (server: cloudflare).

The recording: 1319 requests, 33 nodes, a recording length of 261 seconds (about four and a half minutes), taken on 1 September 2026. Besides the own domains, the page addresses a large set of third-party recipients: the personalisation service Intellimize (several nodes), Google (Analytics, Tag Manager, Ads conversions), the Ketch consent platform, the video platform Wistia (several nodes), Sentry monitoring, the RampedUp, PartnerFleet, Storylane, Finsweet widgets. The session runs across the home page, the platform and solutions sections, the clean rooms and the partner directory.

The processing is described by LiveRamp’s site and marketing privacy policy (Website And Marketing Privacy Policy).

Who receives data directly

Intellimize, Google (Analytics, Tag Manager, Ads), Ketch, Wistia, Sentry.

Declared versus actual

The consent platform loads later than the trackers — and this is the core of the discrepancy. Ketch (eu.ketchcdn.com, cdn.ketchjs.com, geo.privacymanager.io) is installed on the site — a full consent-management platform. But per the chronology it loads at +5733 ms, requests the consent state at +9146 ms and updates it at +9649 ms, whereas the personalisation service Intellimize sends requests with a user identifier as early as +3568…+5209 ms, and Google Tag Manager starts at +3799 ms. That is, the personalisation and the tag loader run before the consent platform even appeared in the session.

Google Analytics goes out with a consent marker earlier than consent is recorded. The first Google Analytics 4 request with the client identifier and a page_view event goes out at +8042 ms with the gcs=G100 marker — “consent granted”. But the consent-state update at Ketch happens only at +9649 ms, a second and a half later. The G100 marker is meanwhile set in all analytics requests over the recording, including the personalisation events variation_viewed and scroll.

Personalisation tied to the user is not disclosed. Intellimize — a personalisation and A/B-testing service — sends POST requests to api.intellimize.co/context-v2 and /prediction carrying a user identifier, and keeps a log at log.intellimize.co/logger; more than fifty requests in total over the recording. This is targeted processing of the visitor’s behaviour, and it is not described in the privacy policy: neither Intellimize by name nor personalisation as an activity appears in the document.

Some recipients are named, some are not. The policy names Google Analytics as web analytics and Google Ads as an advertising platform directly — this is disclosed. But Intellimize, the Ketch consent platform itself, the advertising node pagead2.googlesyndication.com (AdSense/DoubleClick) and the video platform Wistia are absent from the document by name. For a company whose business is the matching and resolution of identity, the incompleteness of the disclosure of its own web recipients is especially notable.

Security headers are set in part. The site sets the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and the referrer policy strict-origin-when-cross-origin. But the content-security-policy is reduced to frame-ancestors 'self' and does not restrict script sources, there is no strict transport, no permissions policy.

Proven: the personalisation and the tag loader start before the consent platform. Intellimize (cdn.intellimize.co +3568 ms, api.intellimize.co +4255 ms) and Google Tag Manager (+3799 ms) are initiated by the markup and precede the loading of Ketch (+5733 ms) and the consent-state request (+9146 ms).

Proven: Google Analytics sends data with a consent marker earlier than it is recorded. The GA4 request with gcs=G100 goes out at +8042 ms, the consent update at Ketch at +9649 ms.

Proven: Intellimize receives a user identifier. The POST requests to api.intellimize.co carry a user-identifier field (its value is cut out in the published file during sanitisation).

Not proven and not unambiguously established: the origin of the gcs=G100 marker. The marker could have been set either as a default value in the consent-mode configuration or as a saved choice from an earlier visit. Response bodies and cookie headers were removed from the published file during sanitisation, so the source of the marker cannot be reconstructed from the recording. What is recorded is the observable: analytics and personalisation send data before the consent platform recorded the choice in this session.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. The full user identifier is not reproduced in the analysis.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers several pages of the site, including the partner directory. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording.

The request to browser.events.data.msn.com relates to the telemetry of the Microsoft Edge browser, not to the liveramp.com site, and does not enter the analysis of the site’s behaviour; it is listed only for the completeness of the recording. The Wistia video platform and its auxiliary nodes (including litix.io — Mux video analytics) serve the embedded videos; their presence is functional, but as recipients of web data they are also not named in the policy.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed, the value of the user identifier in the Intellimize requests is cut out. The conclusion that the personalisation and analytics start before consent is recorded rests on the network level — the timings, addresses and initiators of the requests are read from the recording, and the Intellimize and Google Analytics requests precede the Ketch consent cycle.

The identification of services rests on domains and address patterns: Intellimize — by intellimize.co, intellimizeio.com and the paths context-v2, prediction, logger; Google Analytics 4 — by google-analytics.com/g/collect and the property G-JY5CK6C64V; Google Ads — by googlesyndication.com/ccm/collect and the identifier AW-874879263; Google Tag Manager — by googletagmanager.com; Ketch — by ketchcdn.com, ketchjs.com, privacymanager.io; Wistia — by wistia.com; the serving provider — by the server: cloudflare header.

Conclusion

The site of LiveRamp — a large data broker that matches people’s digital traces into unified profiles for advertising — has installed the Ketch consent-management platform, but has not tied the actual loading of the personalisation and analytics to it. The personalisation service Intellimize sends requests with a user identifier three seconds before Ketch loaded, and Google Analytics transmits data with a granted-consent marker gcs=G100 a second and a half earlier than the consent platform recorded the choice. The Google Ads conversion tracking runs in the same session.

The privacy policy names Google Analytics and Google Ads, but does not disclose the Intellimize personalisation, the Ketch consent platform, the AdSense advertising node and the Wistia video platform by name; personalisation tied to a user identifier is not described as a processing activity in the document. Of the security headers, a full content-security-policy, strict transport and a permissions policy are absent.

Remediation: make the loading of the Intellimize personalisation, Google Analytics and the advertising tracking conditional on the result of the Ketch consent platform, so that before the user’s choice is recorded no data — including the user identifier and the gcs=G100 marker — is sent; name all actual recipients of web data in the privacy policy individually — Intellimize, Ketch, AdSense/DoubleClick, Wistia — with the fields transmitted and the purposes, describing the personalisation separately; set a full content-security-policy with a list of trusted sources, strict transport and a permissions policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: global/liveramp-com-2026-09-01.har
SHA-256: 73d4774d2076cb0edf7d7065d4dab74a115248b34b53a70cff5b1edbee0a1446
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — liveramp.com

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website liveramp.com.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The consent-management platform Ketch is installed on the site, but the personalisation and analytics start before it and irrespective of it. The personalisation service Intellimize sends POST requests (context-v2, prediction, logger) tied to a user identifier starting at +3568…+5209 ms — that is, one to three seconds before Ketch even loaded (+6676 ms) and requested the consent state (+9146 ms). Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +8042 ms — earlier than Ketch recorded consent with an update at +9649 ms. The Google Ads conversion tracking goes out at +8186 ms.

2) The privacy policy names Google Analytics and Google Ads, but a number of the actual recipients of web data are not disclosed: the personalisation service Intellimize, the consent platform Ketch, the advertising node AdSense/DoubleClick and the video platform Wistia are absent from the document by name. Intellimize meanwhile receives a user identifier and data about the user's behaviour for personalisation — processing that the policy does not describe.

3) The security headers are set in part: the content-security-policy is reduced to frame-ancestors 'self' and does not restrict script sources, there is no strict transport, no permissions policy. The frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and a referrer policy are set. For a site loading personalisation, advertising and analytics third-party code, the absence of a full content-security-policy means that the list of trusted script sources is practically unrestricted.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/global-liveramp-com/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Jurisdiction determined under Art. 3(2) GDPR —

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — liveramp.com

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website liveramp.com.

2. Circumstances
I visited the website liveramp.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 1 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The consent-management platform Ketch is installed on the site, but the personalisation and analytics start before it and irrespective of it. The personalisation service Intellimize sends POST requests (context-v2, prediction, logger) tied to a user identifier starting at +3568…+5209 ms — that is, one to three seconds before Ketch even loaded (+6676 ms) and requested the consent state (+9146 ms). Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +8042 ms — earlier than Ketch recorded consent with an update at +9649 ms. The Google Ads conversion tracking goes out at +8186 ms.

2) The privacy policy names Google Analytics and Google Ads, but a number of the actual recipients of web data are not disclosed: the personalisation service Intellimize, the consent platform Ketch, the advertising node AdSense/DoubleClick and the video platform Wistia are absent from the document by name. Intellimize meanwhile receives a user identifier and data about the user's behaviour for personalisation — processing that the policy does not describe.

3) The security headers are set in part: the content-security-policy is reduced to frame-ancestors 'self' and does not restrict script sources, there is no strict transport, no permissions policy. The frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and a referrer policy are set. For a site loading personalisation, advertising and analytics third-party code, the absence of a full content-security-policy means that the list of trusted script sources is practically unrestricted.

Full technical documentation is published at: https://gdpru.eu/en/audits/global-liveramp-com/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 32 — security measures

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]