Consent & Privacy Guide

What Is Privacy in Digital Advertising?

Privacy in digital advertising refers to how websites, applications and advertising technologies collect, use, share and protect information relating to users.

Modern advertising ecosystems may involve publishers, advertisers, DSPs, SSPs, ad exchanges, analytics platforms, identity providers and other technology vendors.

GDPR & Digital Advertising

The General Data Protection Regulation (GDPR) is a European Union privacy regulation that governs the processing of personal data in situations covered by the regulation.

Why GDPR Matters to Publishers

Publishers serving users in applicable jurisdictions may need to consider how personal data is collected and used for analytics, personalization, advertising and other purposes.

Common AdTech Considerations

• Providing appropriate privacy information to users.
• Obtaining consent where required.
• Respecting user choices.
• Managing third-party vendors and purposes.
• Passing relevant consent information to advertising technology partners.

CCPA & CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides privacy rights to eligible California residents.

Advertising Considerations

• Understand applicable consumer privacy rights.
• Provide required privacy disclosures.
• Handle applicable opt-out requests.
• Consider how data is shared with advertising partners.
• Ensure applicable signals and user choices are respected.

CCPA/CPRA requirements are different from GDPR. A publisher should not assume that implementing one privacy framework automatically satisfies another.

What Is a Consent Management Platform?

A Consent Management Platform (CMP) helps websites and applications present privacy choices to users and manage the resulting consent or preference signals.

Typical CMP Flow

Consent Strings in AdTech

Consent strings are machine-readable signals used to communicate privacy and consent choices between components of an advertising ecosystem.

Why Consent Strings Matter

An ad request may pass privacy-related information to downstream advertising partners. Those partners can use the applicable signals to determine how they should process the request.

Common Concepts

• User consent
• Legitimate interest
• Vendor permissions
• Advertising purposes
• Measurement purposes
• Privacy and jurisdiction signals

Cookies & Browser Storage

Cookies and other browser storage technologies can be used for different purposes. Not every cookie has the same privacy implications or legal requirements.

Privacy in the Advertising Request Flow

Privacy information can influence how an advertising request is processed. A simplified publisher advertising flow can look like this:

If a user does not provide a particular permission, the publisher and its technology partners may need to adjust how the request is handled depending on the applicable privacy framework and configuration.

Publisher Privacy Checklist

Use this checklist as a starting point when reviewing privacy and consent implementation.

Common AdTech Privacy Problems

Privacy & Legal Disclaimer

The information on this page is provided for educational and technical reference purposes only. It is not legal advice and should not be treated as a substitute for advice from a qualified privacy or legal professional.

Privacy laws and industry requirements can change. Always verify the requirements that apply to your organization, users, partners and jurisdictions before implementing a privacy or consent solution.