IAB Data Privacy and Consumer Consent Flashcards

What is third-party data in digital advertising?

Answer: Data collected by an entity other than the advertiser or the user, often aggregated and sold by data brokers

Third-party data is audience information collected, aggregated, and sold by companies that have no direct relationship with the consumer, such as data brokers and exchanges.

What has driven the industry shift toward cookieless advertising?

Answer: Browser restrictions on third-party cookies and growing privacy regulations like GDPR and CCPA

The deprecation of third-party cookies by major browsers and stricter privacy regulations have forced the industry to develop alternative targeting and measurement solutions.

What is a 'clean room' in digital advertising?

Answer: A privacy-safe environment where multiple parties can match and analyze first-party data without exposing raw user data

A data clean room is a secure environment where two parties—such as an advertiser and a publisher—can analyze overlapping audience data without either party accessing the other's raw data.

What does 'data minimization' mean under GDPR principles?

Answer: Collecting only the personal data that is necessary for a specified purpose

Data minimization is a GDPR principle requiring organizations to collect and process only the personal data that is adequate, relevant, and limited to what is necessary for its stated purpose.

What is a 'universal ID' solution in cookieless advertising?

Answer: A shared, persistent user identifier that works across publishers without relying on third-party cookies

Universal ID solutions (such as The Trade Desk's UID2) create a persistent, privacy-compliant identifier—often based on hashed emails—that enables audience targeting without third-party cookies.

Under GDPR, what is 'legitimate interest' as a legal basis for data processing?

Answer: A legal basis allowing data processing when a controller has a genuine business need that doesn't override users' rights

Legitimate interest is one of six lawful bases under GDPR, allowing data processing when the controller's interest is balanced against the individual's rights and does not unduly impact them.