TCF string
The Transparency and Consent Framework string records which purposes and vendors a person agreed to. We read it on each request and bid only for what it permits.
Compliance and standards
Every rule has aplace in the product.
Laws and platform policies differ by region and by operating system. This page maps each one to what the platform does in response.
Standards
The rules the platform reads.
Rules reach the platform in two ways. Some arrive as signals inside each request, and some are set as policy for the whole account. The product treats both as inputs to the decision, not as notes added afterwards.
- Signals travel with every bid request and are read before we bid
- Policy is applied when audiences are built and when delivery is configured
- Absence of a signal is treated as an answer that limits what we do
Regime by regime
What each rulechanges in practice.
| Regime | What the platform does |
|---|---|
| GDPR and UK GDPR | Requires a recorded consent signal before personal data is used for retargeting where consent is the basis. Without it, requests are served contextually or declined. Rights requests are routed to the advertiser as controller. |
| CCPA and other US state laws | Honours opt-out of sale and sharing signals, including those carried in the Global Privacy Platform string. Opt-out requests are applied to retargeting. |
| COPPA | Apps directed at children are excluded from audiences and from delivery. Requests flagged as child-directed are not bid on for retargeting. |
| Apple ATT | The IDFA is used only where the person allowed tracking. Without it, iOS demand is limited to contextual delivery and aggregate attribution through SKAdNetwork or AdAttributionKit. |
| Android advertising ID policy | The advertising ID is used only for advertising, respects the person's choice to reset or delete it, and is not linked to other identifiers. |
Consent frameworks
Read on every request,not once per account.
Global Privacy Platform string
This string carries regional signals, including US state opt-outs. We read it on each request and apply the strictest applicable signal.
Global Privacy Control
On this website, we honour the Global Privacy Control signal sent by a visitor's browser as an opt-out request.
Roles
Who is responsiblefor what.
For data an advertiser sends about its own app users, the advertiser is the controller and we act as processor. The data processing addendum summary sets out the terms.
Advertiser
Holds the relationship with the user.
- A lawful basis for the processing, and for retargeting
- Consent collection, including the ATT prompt, passed to us accurately
- Notices that explain retargeting and offer an opt-out
- No sensitive data and no data about children sent to us
Publisher
Holds the relationship with the audience.
- Accurate signals for consent and child-directed status
- An app-ads.txt file that lists authorised sellers
- Honest declarations of the app, its bundle and its content
- Notices to its own users about advertising in the app
Open standards
Standards we supportand why they matter.
- OpenRTB
- The common language of real-time bidding. It lets us receive requests from many sellers in one format and carries the consent and supply fields we depend on.
- app-ads.txt
- A file in which a publisher lists who may sell its app inventory. It lets a buyer check that a seller is authorised.
- sellers.json
- A list an exchange publishes of the sellers it represents, so a buyer can see who stands behind a bid.
- SupplyChain object
- A field that records each party a request passed through, so a buyer can see how long the path is and who sat on it.
- Open Measurement SDK
- A standard way to measure whether an ad was viewable inside an app, without each vendor adding its own code.
- TCF and Global Privacy Platform
- The signals that carry a person's consent and opt-out choices from the app to every party in the bid path.
Not legal advice. This page describes how the product behaves. It does not give legal advice, and each customer should take its own advice on its obligations. We claim no certification and no membership of any body.
Questions
Compliance, answered.
Does the platform make my campaign compliant?
It applies the signals and policies described here. Lawfulness of the data you send and the notices you give stays with you.
What happens when there is no consent signal?
Where the law requires one, we treat a missing signal as no permission. The request is served contextually or declined.
Do you work with children's apps?
We do not retarget on them. Apps directed at children are excluded from audiences and delivery.
Are you certified under any scheme?
No certification or membership is claimed. If that changes, it will be stated here.
Can we see the signed terms?
The data processing addendum is available through the contact page. A summary is on the addendum page.
Get started