GDPR (the General Data Protection Regulation) is a European Union regulation, effective May 25, 2018, that governs how the personal data of individuals in the EU and European Economic Area (EEA) is collected, processed, and stored. It applies to any organization that processes the personal data of individuals in the EU/EEA, regardless of where that organization is located.
What GDPR requires
GDPR requires that organizations have a valid legal basis — such as user consent — to process personal data, and it grants individuals rights over their data, including the rights to access, correct, and delete it. For processing based on consent, that consent must be freely given, specific, informed, and unambiguous. Organizations that fail to comply can face significant regulatory penalties.
Why GDPR matters for programmatic advertising
In programmatic advertising, GDPR governs the personal data used to target and measure ads for users in the EU/EEA, so a valid consent signal must accompany requests that are subject to it. The industry commonly transmits this signal using the IAB Europe Transparency & Consent Framework (TCF) consent string.
The Sovrn Ad Exchange supports receiving a GDPR consent signal in the bid request. In Sovrn's oRTB specification, this is passed via the regs.ext.gdpr field, which carries the IAB consent string when a request is subject to GDPR.
Questions? Concerns? Our team would be more than happy to help. Reach out to our Support Team here.