Privacy policy

Under the OpenRTB 2.6 standard developed by the IAB Tech Lab, privacy policies are implemented by passing specific signals within bid request objects. The main goal is to give users control over their data and ensure compliance with GDPR (Europe) and CCPA/CPRA (USA) regulations.

How privacy is ensured:

Device and Regs (Regulations) objects

The main node specifies which regulations apply to the current request:

• regs.gdpr: Flag that accepts 0 or 1 as values and indicates whether the transaction falls under European regulations.
• regs.coppa: Flag that restricts the collection of children's data under the Children's Online Privacy Protection Act.
• device.lmt: The Limited Ad Tracking flag, which prohibits cross-app user tracking and disables access to IFA (IDFA/GAID/AAID/OAID). When the device.lmt flag is active, IFV, App Set ID, DUID, and UUID are allowed.
• device.dnt: The Do Not Track flag, which prevents the use of third-party cookies for cross-site user tracking. However, first-party cookies are still allowed. You can also use the following identifiers: IFV, App Set ID, DUID, and UUID.

TCF and GPP (consent management)

The IAB uses special consent strings that pack all user permissions into a single format:

• TCF (Transparency and Consent Framework) is an encoded string passed in the user.ext.consent field that notifies ad networks whether the user has consented to profiling, location usage, and so on.
• GPP (Global Privacy Platform) is the priority standard in OpenRTB 2.6. The regs.gpp and regs.gpp_sid enable sending privacy settings for multiple regions at once within a single object.

Data minimization

This standard encourages and technically supports the masking of sensitive information:

• IP addresses are often passed in a truncated format (IPv4 with the last octet masked).
• Version 2.6 actively implements User-Agent Client Hints (UA-CH) to replace the legacy User-Agent string, which allowed for overly precise device identification ("fingerprinting").
• Location coordinates can be rounded to a specific decimal place to mask the user's exact location.

Processing "Do Not Sell" signals (US Privacy)

To comply with the US market, the regs object includes a us_privacy string. This notifies everyone in the chain (DSPs and SSP) whether a user has opted out of the sale of their personal data under CCPA.

User IDs

OpenRTB 2.6 supports alternative IDs (Universal IDs), such as UID2 or ID5, via the user.ext.eids array. With user consent, ad networks can identify users via hashed and secure data without relying on third-party cookies.