Identity, ECID and its limits

Identity, ECID and its limits

Every hit needs a visitor identifier. Adobe uses two primary methods: ECID (Experience Cloud ID) and login IDs.

ECID — the default

ECID (Experience Cloud ID) is a first-party cookie set by the Web SDK or AppMeasurement.js.

• Generated automatically on the visitor's first hit
• Persists for 2 years in the browser
• Sent with every subsequent hit
• Identifies a browser on a device, not a person

ECID example:

Visit 1 (Monday, Chrome): ECID = abc-123-def (auto-generated)
Visit 2 (Wednesday, Chrome): ECID = abc-123-def (same, from cookie)
Visit 3 (Wednesday, Firefox): ECID = xyz-789-ghi (new, different browser)

Same person, different browser = different ECID = different visitor count.

Logged-in user IDs

If a visitor logs in, you can send their user ID instead of ECID:

alloy("setConsent", {...});
alloy("sendEvent", {
  xdm: {
    identityMap: {
      "Customer_ID": [{ id: "alice@example.com" }]
    }
  }
});

This stitches multiple ECIDs to one person. Now whether Alice is on Chrome or Firefox, she's counted as one visitor.

Trade-off: You're sending a PII identifier (email, user ID). Ensure you have consent and follow privacy regulations.

Device vs. person

ECID is device-scoped. User ID is person-scoped. Most companies rely on ECID until they can implement authenticated user ID tracking.

Example Super's complaint form page:

• Unauthenticated visitor: counted as one visitor per device
• Logged-in user: counted as one visitor across all devices (if customer ID set)

ECID limits

Cross-domain: ECIDs don't cross domains. If your site is split across example.com and contact.example.com, each subdomain gets its own ECID unless you sync them.

Cookie clearing: If the visitor clears cookies, a new ECID is generated = new visitor.

Private browsing: Each session gets a new ECID (cookies don't persist) = separate visitors.

Why visitor counts vary

• Bots counted as visitors (if bot filter is off)
• ECID cross-domain drift (visitor counted twice if subdomains not synced)
• Cookie clearing between visits (new ECID generated)
• Duplicate hits with same ECID (should be deduplicated, but verify)
• User ID mismatches (same person, different User ID sent = split across visitors)

Identity best practice

1. Always set ECID (Web SDK/AppMeasurement do this automatically)
2. If you have user logins, set customer ID once the user authenticates
3. Use a consistent User ID scheme (no "user123" on one page, "email@example.com" on another)
4. Enable the Experience Cloud ID Service if using multiple Adobe solutions