Advertising privacy
Ad360 Privacy Signal Handling
The signals Ad360 reads on each bid request, how it resolves conflicts, and the processing modes that result. Written for technical partners and auditors.
- Effective date
- June 4, 2026
- TCF Vendor ID
- IAB Europe TCF v2.2 · Vendor 1071
Overview
Ad360 computes a single deterministic privacy decision from the privacy signals on each OpenRTB bid request, immediately after parsing. That decision governs every subsequent stage of the bidder. This page describes the signals it reads and the modes it resolves to.
Signals interpreted
- TCF (TC string) — IAB Europe Transparency & Consent Framework v2.2, for EU, EEA, UK, and Swiss traffic. Read against the permissions for Vendor 1071.
- GPP — IAB Global Privacy Platform string and applicable section IDs.
- US Privacy String — the legacy IAB US privacy signal (transmitted as us_privacy), now superseded by GPP.
- Global Privacy Control (GPC) — browser opt-out signal, treated as an opt-out of sale and sharing where applicable.
- Google privacy signals — regs.ext.gdpr (GDPR-applies), Google privacy treatments, non-personalised and limited-ads indicators, and child-directed treatment.
Precedence and conflict resolution
Where multiple signals apply or conflict, Ad360 applies the stricter outcome. A Google or regulatory restriction that is stricter than the TC string takes precedence. US signals (the US Privacy String, GPP, GPC) are resolved stricter-of.
Fail-closed behaviour
The default is fail-closed. A missing, expired, malformed, or ambiguous signal does not receive the benefit of the doubt: Ad360 suppresses personal-data processing — identifiers, profile updates, audience use, cookie matching, precise geolocation, and user-level tracking — and proceeds only with contextual or limited bidding where that is explicitly safe, otherwise it does not bid.
Processing modes
| Mode | Region | Behaviour |
|---|---|---|
| Personalised (consented) | EU/EEA/UK/CH | Full consented processing: identifiers, profiles, audiences, measurement, personalised bidding, subject to retention. |
| Contextual only | EU/EEA/UK/CH | No user identifiers or profiles; bidding on contextual and request-level signals only. |
| Limited ads only | EU/EEA/UK/CH | Limited, non-personalised processing where explicitly safe; no profile building. |
| No bid (privacy) | EU/EEA/UK/CH | No safe processing path; Ad360 returns no bid. |
| Personalised | US | Personalised processing where no applicable opt-out is present. |
| Contextual only | US | Opt-out present; contextual bidding and permitted operational processing only. |
| Restricted processing | US | Restricted processing applies; personalised uses suppressed. |
| No bid (privacy) | US | No safe processing path; no bid. |
Enforcement and observability
The decision is enforced at each stage of the bidder: line-item eligibility, request normalisation (identifiers, precise geo), audience and AI filters, creative and tracking-URL generation, and event logging. Observability records the privacy mode and a reason code for each request, without including user identifiers in metrics.
Contact
Technical or audit questions may be directed to privacy@ad360.media.