GDPR

GDPR (General Data Protection Regulation) provides a mechanism for publishers to pass two key objects to buyers (DSPs):

1. Applicability: Shows if GDPR applies to a specific user (whether the user is in the EU).
2. Consent string (TC string), which is an encoded string that specifies which companies and purposes the user has granted permission for (such as personalization or measurement).

GDPR support follows the IAB TCF 2.0/2.2 (Transparency and Consent Framework) standard. Unlike COPPA, GDPR requires passing detailed user consent status for specific purposes, such as data processing purposes and vendor permissions.

How it works

Handling GDPR involves two main objects: regs (regulations) and user (consent data).

1. The regs.ext.gdpr object specifies whether GDPR rules apply to the request:

   • 1: GDPR applies.
   • 0: GDPR doesn't apply.

2. The user.ext.consent object contains the TC string (a base64 string) generated by a consent management platform (CMP) on the site or inside the app.
   The TCF string (transparency and consent string) is a standard encoded string created by IAB Europe to capture user preferences for data processing and cookies under GDPR. It tells ad networks what the user opted into or out of.

Examples

Bid Request

{
  "id": "req_gbp_789",
  "imp": [{
    "id": "1",
    "banner": { "w": 300, "h": 250 }
  }],
  "regs": {
    "ext": {
      "gdpr": 1
    }
  },
  "user": {
    "id": "45abc44e-105a-430c-87d4-82550186636e",
    "ext": {
      "consent": "CPQ7F6APQ7F6AAGABCENAJ-AAAAp77_______9______9_z_f______9vP_7_______f_9n_3_7__________IT1AhH7AAA.YAAAAAAAAAA"
    }
  }
}

Bid Response

DSPs typically don't pass consent data back in the bid response, but they must verify the consent string before placing a bid. If the string lacks permission for their specific vendor ID (the DSP's ID in the IAB Global Vendor List), they can't:

• Read or write cookies.
• Use personal data for ad targeting.
• Place tracking pixels inside adm (creative code).

Key updates to TCF 2.0 support in OpenRTB 2.6

1. GPP (Global Privacy Platform): OpenRTB 2.6 increasingly replaces regs.ext.gdpr with regs.gpp and regs.gpp_sid. This new IAB standard integrates GDPR, CCPA, and other privacy regulations into a single universal object.

2. Legitimate interest: The consent string includes more than just simple yes/no consent. It also indicates whether a user has objected to data processing based on a vendor's legitimate interest.

3. Publisher restrictions: Publishers can use the consent string to restrict specific vendors from taking certain actions, even if the user consented to them.