It looks like you're in . Would you like to see content relevant to your location?

You can change this anytime by selecting “Reset my location” in the footer.

Yes No

Website Cookie Policy

AECOM Global – Website Cookie Policy L1-009-PL2

1. Purpose and Scope

  1. This Policy explains how and why AECOM (collectively, “AECOM” or “the Company”) uses cookies, pixels, tags, SDKs, local storage, session replay, analytics scripts, advertising identifiers, and similar online tracking technologies (collectively, “Cookies and Other Trackers”) on AECOM websites and digital services, and the choices available to users.

  2. This Policy applies to AECOM websites and digital services that link to it. It should be read together with AECOM’s Privacy Notice and any applicable notice presented when personal information is collected.

  3. For California residents, this Policy supplements AECOM’s California privacy disclosures by explaining how cookies and similar technologies may involve the collection, disclosure, sale, or sharing of personal information.

  4. For Europe / United Kingdom (EU/UK) users, non-essential cookies are used only with consent where required by the ePrivacy Directive, Privacy and Electronic Communications Regulations 2003 (PECR), EU General Data Protection Regulation (GDPR), and UK GDPR. For the purposes of EU GDPR and UK GDPR, the data controller is AECOM, unless a specific notice states otherwise.

  5. Where required by applicable U.S. state privacy law, AECOM recognizes legally valid universal opt-out mechanisms as requests to opt out of targeted advertising or other covered processing.

2. What are Cookies and other Trackers and Similar Technologies

  1. A “Cookie” is a small text file that may be stored on, and accessed from, a user’s internet browsing device when they visit certain websites. The other tracking technologies such as JavaScript, local storage, log files, and other mechanisms work similarly to cookies in that they track a user’s website activity to enable the collection of information about how a user utilizes a website (“Usage Information”). A “Web Beacon,” also known as a pixel tag or clear GIF, is a clear graphic image delivered through a web browser or HTML e-mail. The web beacon operates as a tag recording an end user’s visit to a particular web page or viewing of a particular e-mail. It is also often used in conjunction with a web cookie and provided as part of a third-party tracking service. Web beacons provide an ability to produce specific profiles of user behavior in combination with web server logs. Common usage scenarios for web beacons include online ad impression counting, file download monitoring, and ad campaign performance management. Web beacons also can report to the sender about which emails are read by recipients. For the purposes of this Policy, all these tracking technologies are referred to as “cookies.” Cookies set by the AECOM website are known as “first-party cookies.” Cookies set by third parties, such as those who serve content or provide advertising or analytics services on their domains are known as “third-party cookies.”

  2. Where applicable law requires prior consent, AECOM uses consent-management and tag-management controls designed to keep non-essential Cookies and Other Trackers disabled until the applicable choice is made. Because tracking may occur through scripts, pixels, network requests, or other technologies even when no browser cookie is stored, this Policy applies to both stored cookies and other online tracking requests.

  3. Information collected through Cookies and Other Trackers may constitute “personal information” under the CCPA/CPRA and “personal data” under other privacy laws, including IP address, device identifiers, cookie IDs, advertising IDs, browsing activity, approximate or precise location, inferred interests, form-interaction metadata, session replay data, or other information linked or reasonably linkable to a consumer, household, browser, device, or pseudonymous profile. AECOM’s Privacy Notice provides additional information about categories of personal information, sources, purposes, disclosures, retention, and rights.

3. Advertising and Targeting

  1. AECOM may work with third parties, such as advertising networks, analytics providers, tag-management providers, video-hosting providers, social media platforms, measurement services, and other technology partners (“third-party ad/analytics companies”) to measure website use, personalize content, measure campaigns, and deliver or assess advertising on AECOM websites and third-party sites, apps, and services. These activities are non-essential and may constitute a “sale” or “sharing” of personal information under the CCPA/CPRA even when AECOM does not receive money.

  2. AECOM and third-party ad/analytics companies may collect or receive IP address, device identifiers, cookie identifiers, advertising IDs, browser and device information, page views, clickstream data, referring URLs, approximate location, interaction events, session replay data where enabled, and inferences. Where these activities are used for cross-context behavioral advertising, retargeting, ad measurement involving third parties, or identity synchronization, AECOM treats them as potential “sharing” or “sale” under the CCPA/CPRA and provides the opt-out methods described in this Policy.

Third-Party Analytics and Embedded Technologies: AECOM may use third-party technologies including Google Analytics, Microsoft Clarity, Microsoft Bing, Google Ads/DoubleClick, and Wistia to understand website use, provide embedded media, measure campaigns or conversions, and improve services, performance, and user experiences. Analytics, heatmap, session-replay, advertising, conversion, and embedded-media technologies are non-essential where required by applicable law. Information about available choices is provided through AECOM’s Cookie Settings tool.

  1. For more information about how Google uses information collected through websites that use its services, review Google’s applicable privacy information.

  1. Google Privacy Policy at https://www.google.com/policies/privacy/partners/ ; and

  2. Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout .

How Cookie Choices Are Applied: AECOM uses its Cookie Settings and related tag-management controls to apply a user’s selection to the non-essential categories covered by that choice. These controls may apply to cookies as well as scripts, pixels, and network requests. Where required by applicable law, a recognized opt-out preference signal is treated as a request to opt out of covered sale, sharing, or targeted-advertising activities for the applicable browser or device.

  1. Browser- and device-level cookie choices are applied when received through AECOM’s Cookie Settings tool. Other opt-out requests are processed within the time required by applicable law. AECOM does not require account creation or identity verification to process an opt-out that applies only to the browser or device from which it is submitted.

3.1 Categories

This section describes common categories of Cookies and Other Trackers AECOM may use. Not every technology appears on every page, in every region, or on every visit, and providers may change cookie names or technical implementation. AECOM’s Cookie Settings tool is the operational source for the current browser-specific inventory and available choices. Non-essential technologies are subject to consent where required and to applicable U.S. sale, sharing, or targeted-advertising opt-out requirements.

3.1.1 Essential Cookies

Essential cookies are strictly necessary for the website to function, maintain security, remember privacy choices, load requested pages, balance traffic, prevent fraud, or enable a user-requested transaction. They cannot be switched off through AECOM’s cookie tool. Essential cookies must not be used for advertising, analytics, session replay, cross-context behavioral advertising, profiling, or any purpose unrelated to providing the website or service requested by the user. Essential cookies may still enable AECOM and certain third-party service providers (for example, security, traffic-management, and consent-management vendors) to collect user and device data, including IP addresses, device identifiers, and browsing activity, solely for the essential purposes described above. A user can set their browser to block or alert them about these cookies, but doing so may result in some parts of the AECOM website having reduced functionality.

Table 1. Essential Cookies
Cookie Name Purpose Duration Legal Basis CCPA Sale/Share & Opt-Out Status
JSESSIONID Java-based web application servers to maintain an anonymous user session ID across your current browsing visit. 6 months (Art. 6(1)(f) legitimate interest/PECR strictly necessary exemption). Not sold or shared. Always active; cannot be disabled.
OptanonConsent and OptanonAlertBoxClosed Manages user consent preferences. Essential for maintaining user consent settings. 6 months Strictly Necessary (Art. 6(1)(f) legitimate interest / PECR strictly necessary exemption). Not sold or shared. Always active; cannot be disabled.
TrafficBalancing Script-generated cookies used by AECOM’s hosting infrastructure to manage server traffic loads, ensure pages load quickly, and prevent system crashes. 6 months Strictly Necessary (Art. 6(1)(f) legitimate interest / PECR strictly necessary exemption). Not sold or shared. Always active; cannot be disabled.
__cf_bm / Cloudflare Cookies: Network security cookies that help detect and block malicious automated bot traffic, protecting the site against spam and credential-stuffing attacks. 6 months Strictly Necessary (Art. 6(1)(f) legitimate interest / PECR strictly necessary exemption). Not sold or shared. Always active; cannot be disabled.
CSRF Protection Tokens injected into web forms to verify that the person submitting a contact form or application is actually the user on the site, preventing cross-site scripting fraud 6 months Strictly Necessary (Art. 6(1)(f) legitimate interest / PECR strictly necessary exemption). Not sold or shared. Always active; cannot be disabled.

3.1.2 Non-essential – Functional Cookies

Functional cookies enable optional functionality, localization, embedded media, or personalization. These cookies are non-essential unless the user specifically requests the function during that session and the cookie is strictly necessary to provide that requested function. Functional cookies may be set by AECOM or by third-party providers, may disclose information to partners and must be blocked until the user accepts the functional category where consent is required. If a user does not allow these cookies, some or all of these services may not function properly.

Table 2. Functional Cookies
Cookie Name Purpose Duration More Information Legal Basis CCPA Sale/Share & Opt-Out Status
translation.
JSON 		Provides translations Session Translation for multilingual WordPress sites. Consent No sale/share. Blocked by “Reject Non-Essential Cookies”; withheld absent consent (EU/UK).
Wistia embedded-video requests Loads embedded video and transmits video-player or playback events where Wistia content is enabled. Session / request-based; see Cookie Settings Wistia (for example, fast.wistia.com, distillery.wistia.com, embed-cloudfront.wistia.com) Consent where required Non-essential functional/embedded-media technology. Subject to applicable consent controls; current availability is shown in Cookie Settings.
BROWSERID ID used to identify anonymous activity. 12 months Unique browser instance identification. Consent No sale/share. Blocked by “Reject Non-Essential Cookies”; withheld absent consent (EU/UK).
SESSIONID ID used to identify anonymous activity in one session. Session Unique session identification. Consent No sale/share. Blocked by “Reject Non-Essential Cookies”; withheld absent consent (EU/UK).

3.1.3 Non-essential – Performance Cookies

  1. Performance and analytics technologies allow AECOM and its analytics providers to count visits, understand traffic sources, measure campaign performance, generate heatmaps, conduct session replay where enabled, and improve website performance. These technologies may operate through cookies or through network requests that transmit analytics or interaction events. They are non-essential where required by applicable law and are subject to the consent and opt-out controls described in this Policy.

  2. Performance cookies help AECOM to know which pages are the most and least popular and to understand how visitors move around the AECOM website. If a user does not allow these cookies, AECOM will not know when a user has visited its website and will be unable to monitor its performance.

Table 3. Performance Cookies and Other Trackers
Cookie Name Purpose Duration More Information Legal Basis CCPA Sale/Share & Opt-Out Status
_ga ID used to identify users. 1 year Google Analytics Consent Non-essential analytics. Subject to applicable consent and opt-out controls. California sale/share treatment depends on provider role, configuration, contractual restrictions, and purpose.
_ga_123455 ID used to identify users. 1 year Google Analytics Consent Non-essential analytics. Subject to applicable consent and opt-out controls. California sale/share treatment depends on provider role, configuration, contractual restrictions, and purpose.
_ga_EBWMJ4FEME Google Analytics session/user identifier; tracks user behavior across pages to measure and improve website performance. Used to distinguish website sessions or visitors and measure interactions with the website. Analytics reports are generally presented in aggregated form. 1 year Google Analytics Consent Non-essential analytics. Subject to applicable consent and opt-out controls. California sale/share treatment depends on provider role, configuration, contractual restrictions, and purpose.
_ga_MZYL0YKBNK Google Analytics session/user identifier; tracks user behavior across pages to measure and improve website performance. Used to distinguish website sessions or visitors and measure interactions with the website. Analytics reports are generally presented in aggregated form. 1 year Google Analytics Consent Non-essential analytics. Subject to applicable consent and opt-out controls. California sale/share treatment depends on provider role, configuration, contractual restrictions, and purpose.
_ga_Y1G8KVG2ZL Google Analytics session/user identifier; tracks user behavior across pages to measure and improve website performance. Used to distinguish website sessions or visitors and measure interactions with the website. Analytics reports are generally presented in aggregated form. 1 year Google Analytics Consent Non-essential analytics. Subject to applicable consent and opt-out controls. California sale/share treatment depends on provider role, configuration, contractual restrictions, and purpose.
_clck Identifies unique visitors and records session behavior for Microsoft Clarity heatmaps and session replay. 1 year Microsoft Clarity (.aecom.com – first-party). Consent Non-essential analytics/session replay. Disclosure to Microsoft may be subject to applicable consent and sale/sharing or targeted-advertising opt-out requirements depending on configuration and purpose.
_clsk Microsoft Clarity session cookie; consolidates page views into a single session recording. Session Microsoft Clarity (.aecom.com- first-party). Consent Non-essential analytics/session replay. Disclosure to Microsoft may be subject to applicable consent and sale/sharing or targeted-advertising opt-out requirements depending on configuration and purpose.
CLID Microsoft Clarity unique visitor identifier; links user behavior to a Clarity project. 1 year Microsoft Clarity (www.clarity.ms — third-party). Consent Non-essential analytics/session replay. Disclosure to Microsoft may be subject to applicable consent and sale/sharing or targeted-advertising opt-out requirements depending on configuration and purpose.

3.1.4 Non-essential – Targeting and Advertising Cookies

Targeting, advertising, and conversion technologies may identify browsers or devices, measure advertising or conversions, synchronize identifiers, support retargeting, or otherwise support advertising measurement. These technologies may operate through cookies or network requests. Depending on purpose and configuration, the activity may constitute a sale, sharing, or targeted advertising under applicable U.S. privacy law and is subject to the applicable consent and opt-out mechanisms described in this Policy.

Table 4. Targeting and Advertising Cookies
Cookie Name Purpose Duration More Information Legal Basis CCPA Sale/Share & Opt-Out Status
MUID Microsoft User Identifier; used to synchronize user identity across Bing and Clarity for advertising measurement and retargeting. 1 year Microsoft Bing Consent May constitute sale, sharing, or targeted advertising under applicable U.S. privacy law depending on configuration and purpose. Subject to applicable consent and opt-out controls, including GPC where required.
ANONCHK Bing/Clarity anonymous check; indicates whether an identifier is transferred or synchronized between Microsoft advertising and analytics services. Session Microsoft Bing (.c.clarity.ms — third-party). Consent May constitute sale, sharing, or targeted advertising under applicable U.S. privacy law depending on configuration and purpose. Subject to applicable consent and opt-out controls, including GPC where required.
MR Microsoft Bing remarketing cookie; tracks user activity to enable retargeted advertising on Bing and partner networks. 7 days Microsoft Bing (.c.bing.com — third-party). Consent May constitute sale, sharing, or targeted advertising under applicable U.S. privacy law depending on configuration and purpose. Subject to applicable consent and opt-out controls, including GPC where required.
SM Microsoft Clarity session marker; used to determine whether Clarity should record the current session. Session Microsoft Clarity (.c.clarity.ms — third-party). Consent May constitute sale, sharing, or targeted advertising under applicable U.S. privacy law depending on configuration and purpose. Subject to applicable consent and opt-out controls, including GPC where required.
SRM_B Bing remarketing cookie; stores a unique user ID to track conversions and measure advertising campaign effectiveness. 1 year Microsoft Bing (.c.bing.com — third-party). Consent May constitute sale, sharing, or targeted advertising under applicable U.S. privacy law depending on configuration and purpose. Subject to applicable consent and opt-out controls, including GPC where required.
visitor_id ID used to identify users for personalization. 1 year AECOM-controlled pseudonymous visitor identifier. Consent First-party personalization technology. Subject to applicable consent controls and the preferences available in Cookie Settings.

4. Managing Cookies

  1. Users may manage cookie preferences through browser controls and AECOM’s Cookie Settings tool. Where required by applicable law, users may also exercise applicable sale, sharing, or targeted-advertising opt-out rights through AECOM’s privacy-choice mechanism or a legally recognized opt-out preference signal.

  2. Cookie preferences are browser- and device-specific unless AECOM can associate the preference with a known user account or profile. If a user deletes or blocks cookies, they may need to reset preferences. Similarly, if a user has enabled GPC and visits the AECOM website from a different browser or a different device, GPC must be enabled on that browser or device as well; opt-out preference signals apply on a per-browser, per-device basis unless AECOM can associate them with a known user. AECOM does not treat the absence of an opt-out preference signal as affirmative consent. Where required by applicable law, AECOM will not request consent to cover sale or sharing activities for the applicable statutory period after an opt-out.

4.1 Controlling Cookies on the AECOM Website

Users may accept, reject, or adjust non-essential cookie categories through the Cookie Banner or Cookie Settings link. California residents may also use AECOM’s applicable privacy-choice mechanism or a recognized opt-out preference signal to opt out of covered sale or sharing activities.

Selecting “Reject Non-Essential Cookies” directs AECOM’s Cookie Settings and related tag-management controls to keep the non-essential categories covered by that choice disabled for the applicable browser or device. Where applicable, a sale, sharing, or targeted-advertising opt-out is applied to the activities covered by the relevant privacy law. Essential technologies may continue to operate.

Note: Changing a cookie preference is intended to stop future activation or use of the affected categories through AECOM’s preference controls. Some cookies previously stored on the device may remain until they expire or are deleted through the user’s browser settings. The continued presence of a stored cookie does not necessarily mean the associated tracker continues to be used after a choice is applied.

4.2 Controlling Cookies through the Browser

Users are always free to decline cookies if their browser permits, although doing so may interfere with their online experience, including the use of the AECOM website.

The following links may assist a user in managing their preferences, or a user can select the ‘Help’ option in their internet browser for more details.

  • Google Chrome:

http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647

  • Safari:

http://support.apple.com/kb/PH5042

  • Microsoft Edge:

https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge

  • Mozilla Firefox:

http://support.mozilla.com/en-US/kb/Cookies

5. Additional Privacy Rights of California Residents (CCPA/CPRA)

  1. California Notice at Collection for Cookie-Derived Personal Information:

  1. AECOM may collect the following categories of personal information through Cookies and Other Trackers: identifiers; internet or other electronic network activity information; approximate geolocation; inferences; AECOM does not intend to collect precise geolocation or the contents of communications through non-essential cookies or similar technologies unless the collection is specifically disclosed and any legally required consent or choice is provided.

  2. AECOM uses this information to operate the website, remember privacy choices, secure the website, measure performance, improve user experience, deliver or measure advertising, and comply with law. AECOM may disclose these categories to the types of recipients described in AECOM’s Privacy Notice and in the verified cookie information presented through the Cookie Settings tool. AECOM may sell or share identifiers, internet or other electronic network activity information, approximate geolocation information, or inferences when that information is disclosed to a third party for cross-context behavioral advertising or other purposes that constitute a sale or sharing under applicable law.

  3. AECOM does not use sensitive personal information collected through cookies to infer characteristics and does not use or disclose sensitive personal information beyond permitted purposes unless it provides a right to limit and honors that right.

  1. Data Minimization and Purpose Limitation:

  1. AECOM will collect, use, retain, and disclose cookie-derived personal information only as reasonably necessary and proportionate to the disclosed purposes.

  2. To opt out of sale or sharing of cookie-derived personal information, a user may use the “Do Not Sell or Share My Personal Information” link, adjust Cookie Settings on aecom.com, or activate GPC or another recognized opt-out preference signal. AECOM will process the opt-out without requiring verification, account creation, or additional information for browser/device-level opt-outs. For more information regarding the use of your personal data, see AECOM’s Privacy Notice .

  3. Under the CCPA/CPRA, California residents have the rights to know/access, delete, correct, opt out of sale/sharing, limit use, and disclosure of sensitive personal information where applicable, and not be discriminated or retaliated against for exercising rights. For cookie-derived data, these rights apply to personal information reasonably linkable to a consumer, household, browser, device, or pseudonymous profile. AECOM does not use cookie-derived profiles to make decisions that produce legal or similarly significant effects about website visitors.

  1. Do Not Sell or Share My Personal Information: For purposes of this Policy, a “sale” or “sharing” of personal information includes disclosing or making available personal information (including browsing history and device information) to a third party for purposes of cross-context behavioral advertising or in exchange for monetary or other valuable consideration, whether or not money changes hands. California residents may exercise their right to opt out of sale/sharing by: (i) clicking the “Do Not Sell or Share My Personal Information” link; (ii) adjusting preferences through the Cookie Settings link on aecom.com; or (iii) activating GPC or another recognized opt-out preference signal. Where required by applicable law, AECOM treats a valid opt-out preference signal as a request to opt out of covered sale or sharing activities for the applicable browser or device.

6. Do Not Track Signal

Some browsers transmit a legacy “Do Not Track” signal. AECOM does not respond to legacy Do Not Track signals unless required by applicable law. Where required by applicable law, AECOM recognizes Global Privacy Control (GPC) and other legally valid opt-out preference signals as requests to opt out of covered sale, sharing, or targeted-advertising activities for the applicable browser or device. AECOM’s preference and tag-management controls are intended to apply those signals to covered Cookies and Other Trackers without requiring account creation or identity verification for a browser/device-level opt-out.

The AECOM website may contain links to third-party websites or applications such as Facebook, X (formerly Twitter), LinkedIn, or YouTube. AECOM is not responsible for those websites’ use of cookies, for their privacy practices, or the content of these other websites or applications.

Users should review the privacy policies and notices of those third-party websites and applications to understand their practices.

8. Data Retention

AECOM retains cookie-derived personal information only for as long as reasonably necessary and proportionate to the purposes disclosed in this Policy, the Privacy Notice, and the applicable notice at collection. The duration of individual cookies and similar technologies is described in the Cookie Settings tool or applicable cookie table. Session cookies generally expire at the end of the browser session, while persistent cookies remain for the stated period unless deleted earlier. AECOM retains information derived from cookies and similar technologies only for as long as reasonably necessary for the disclosed purposes or as required by law.

9. EU GDPR and UK GDPR Rights

  1. Where AECOM processes personal data collected through cookies as a data controller subject to Regulation (EU) 2016/679 (EU GDPR) or the UK GDPR as retained in UK law, the following provisions apply.

Lawful Basis: Non-essential cookies (functional, performance, and targeting/advertising) are processed only on the basis of your freely given, specific, informed, and unambiguous consent (Article 6(1)(a) EU GDPR / UK GDPR).

Where personal data is processed through strictly necessary cookies, AECOM relies on an applicable lawful basis under the EU GDPR or UK GDPR, such as legitimate interests or performance of a user-requested service. The storage of or access to information on a user’s device is addressed separately under applicable ePrivacy or electronic-communications law.

  1. AECOM does not rely on legitimate interest as a lawful basis for any non-essential cookie that requires consent under the Privacy and Electronic Communications Regulations (PECR) or the ePrivacy Directive.

  2. Withdrawal of Consent: Where processing is based on consent, you have the right to withdraw that consent at any time without detriment, by accessing the Cookie Settings link on AECOM.com. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal (Article 7(3) EU GDPR / UK GDPR).

  3. Data Subject Rights: Data subjects in the EU and UK have the right to: (a) request access to personal data AECOM holds about them (Article 15); (b) request rectification of inaccurate data (Article 16); (c) request erasure of their personal data where there is no compelling reason for its continued processing (Article 17); (d) object to processing based on legitimate interests (Article 21); (e) request restriction of processing in certain circumstances (Article 18); and (f) receive personal data they provided to AECOM in a structured, commonly used, and machine-readable format where the legal requirements for data portability are met (Article 20 — right to data portability). Requests may be submitted to privacyquestions@aecom.com .

  4. International Transfers: AECOM uses certain third-party analytics and advertising services (including Google Analytics) that may transfer cookie-derived personal data to countries outside the European Economic Area (EEA) or the United Kingdom. Where required, AECOM uses an applicable transfer mechanism or safeguard for transfers of personal data outside the relevant jurisdiction. Further details are set out in AECOM’s Privacy Notice.

  5. Right to Lodge a Complaint: If you believe AECOM has not complied with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority. For EU residents, this is the data protection authority (DPA) in your EU member state of habitual residence. For UK residents, this is the Information Commissioner’s Office (ICO), which may be contacted at http://www.ico.org.uk or by telephone on 0303 123 1113. AECOM encourages users to contact us in the first instance at privacyquestions@aecom.com to seek resolution. UK residents may also raise a complaint directly with AECOM using the contact information below. This does not affect the right to complain to the ICO.

10. Changes to This Policy

The Company may update this Policy from time to time. If AECOM makes material changes to this Policy, it will provide notice as required by applicable law. The revised Policy will identify the date it was last updated.

The updated Policy will always be available at aecom.com and will state the date of the most recent revision.

11. Contact Us

If you have any questions about this Policy, please contact the AECOM Privacy Office at privacyquestions@aecom.com .