
OpenRTB Advisory – GDPR [pdf] - troydavis
https://iabtechlab.com/wp-content/uploads/2018/02/OpenRTB_Advisory_GDPR_2018-02.pdf
======
troydavis
Here's a quick primer on user data in ad bidding.

OpenRTB 2.x user object: [https://developers.google.com/ad-
exchange/rtb/openrtb-guide#...](https://developers.google.com/ad-
exchange/rtb/openrtb-guide#user-object). OpenRTB is used by publishers (Web
sites) to put ad impressions up for realtime bidding (RTB) on exchanges like
Rubicon and AppNexus. Ad-tech companies representing advertisers - often the
largest advertisers - then place bids. Depending on how one counts, 40-50% of
online display advertising occurs via RTB[1].

When people talk about how their personal data flows from publishers to
advertisers, for this ~half of ad placements, RTB is the method and OpenRTB
(particularly the user and geo objects) is often the protocol.

OpenRTB 3.0 signed bid requests from publishers:
[https://github.com/InteractiveAdvertisingBureau/openrtb/blob...](https://github.com/InteractiveAdvertisingBureau/openrtb/blob/master/ads.cert%201.0%20BETA.md#supported).
This is conceptually similar to DKIM for email sources, and is expected to
transport whether GDPR applies and consent has been obtained.

OpenRTB 3.0 full draft spec:
[https://github.com/InteractiveAdvertisingBureau/openrtb/blob...](https://github.com/InteractiveAdvertisingBureau/openrtb/blob/master/OpenRTB%203.0%20BETA.md)

[1]: [https://www.adweek.com/tv-video/programmatic-digital-
display...](https://www.adweek.com/tv-video/programmatic-digital-display-ads-
now-account-for-nearly-80-of-us-display-spending/)

