Authors
As the Adtech industry is constantly evolving, Reed Smith brings you a clear and concise dictionary that sets out key definitions and provides an introduction to each term to enhance your understanding of the latest industry jargon. This dictionary is a first of its kind in not just including general definitions but explanations focusing on the legal issues and legislation and covering U.S., Europe and Asia.
This dictionary has been updated as of September 2023.
AdChoices
AdChoices is a self-regulatory program initiated by the Digital Advertising Alliance for online interest based advertisements used mostly in the US and Canada. The AdChoices logo (recognisable as a triangle with an ‘i’ in the middle) is used by participating companies on websites and, when clicked on, gives users information about how their information is used for relevant advertising and opt out options.
Ad Exchange
A digital marketplace where Advertisers and Publishers are able to buy Ad Inventory. It is a real-time auction platform that does not favour the buyer or the seller, it merely acts as a platform to enable the trading of Ad Inventory.
Ad Fraud
A type of complex scam where fraudsters trick Advertisers by pretending to represent online advertisement Impressions, clicks, Conversion or data events to generate revenue. The fraudsters create fake traffic, fake leads or ineffective advertisement placements, which the Advertiser unsuspectingly purchases. There are various different types of Ad Fraud. Some examples include: (i) Pixel stuffing – stuffing one or more illegitimate advertisements into a Pixel to simulate the display of multiple advertisements on a single page to take CPM credit for serving those Impressions even though users are not actually seeing the advertisements; (ii) Domain Spoofing – impersonating a valuable Publisher site and selling “counterfeit” Ad Inventory on Ad Exchanges to Advertisers who believe they Traffic (NHT) – as further described below, an umbrella term for many versions of generating illegitimate or ‘invalid’ traffic intended to generate revenue by simulating live, measurable advertisement traffic.
Ad Inventory
The space for advertising available from the Publisher for sale to an Advertiser. Sometimes the term “media inventory” is used. The space will vary depending on where it appears – for example, on a mobile, website or TV etc., as well as on the type and the size.
Ad Network
A company that connects Advertisers (who want to place advertisements) with Publishers (who wish to host the advertisements). Publishers have the ability to sell and aggregate Ad Inventory from numerous sources in a single buying opportunity. An Ad Network can also help to create targeting capabilities and contains features similar to that of an Ad Exchange.
Addressability or Addressable Marketing
Refers to the ability to use media to target specific individuals, rather than large groups of anonymous third-parties.
Advanced Data Protection Control (ADPC)
A joint project between the Sustainable Computing Lab at the Vienna University of Economics and Business and NOYB for a proposed automated specification for the communication of users’ privacy decisions (particularly pursuant to GDPR and PECR), namely for users to give or refuse Consent, to withdraw Consents previously given, as well as to object to Processing. It provides an alternative to existing non-automated CMPs and functions using the exchange of http(s) headers or an equivalent JavaScript interface.
Advertiser
The brand which is the subject of the advertising.
Advertising Cookies
Cookies used to store or share information with third parties related to a user’s browsing activity to create an advertising profile and place relevant advertising on the website or third party websites.
Age-Appropriate Design Code (AADC)
The UK’s AADC (a statutory code) requires that Profiling – including for Behavioral Advertising – must be switched off by default for children (under 18s), unless a service can demonstrate a compelling reason for the Profiling to be on by default, taking into account a child’s best interests. Any Profiling must ensure that adequate safeguards are in place to prevent harm to the child, such as Consent, meaning children must choose to enable Targeted Advertising to be provided as part of an online service.
Analytic Cookies
Cookies used to analyse a user’s journey on the website to evaluate and improve performance. For example, a Google Analytic cookie is commonly used by companies to track and report website traffic volumes. Analytic Cookies are still caught by the PECR and GDPR regimes but there is some debate as to whether all types of Analytic Cookies are as invasive and when precisely Consent is needed, especially where First Party Analytic Cookies are deployed.
Application Program Interface (API)
An API essentially allows two applications to talk to each other. It connects web- site programs and software systems for the purpose of sharing data. Digital products and services are able to send and receive information through API. Examples would include a social media platform that has APIs to enable users to access the service on other devices or for value added services such as a single sign-on. APIs can be used for a variety of different things. Typically there will be standard terms that apply to the API and developer guidelines for coding and use around them.
Attribution Reporting
The purpose of such reporting is to explain and show the Conversion path of the user – i.e. how or where can that Conversion be attributed to – for example, what advertising Campaign made the user take the action? It may measure a user’s actions on a website from the first time they enter to the time they become a customer.
Audience Overlap
A common issue marketers face when advertising on platforms that build native audiences or lookalikes. Essentially, Audience Overlap occurs where two separate ad campaigns end up directed at the same audience despite trying to target different audiences. Audience overlap leads to increased marketing costs.
[Audience] Suppression
The process of removing specific people or groups from an advertising campaign.
Behavioural Advertising
Advertising targeted to individuals based on observed behavior that has been tracked over time. Depending on applicable law, Consent and notice requirements related to the Processing of related data or the use of Cookies to access and store related data may vary.
Bot
A computer program that interacts with a website as if it was a real user. Another computer will see the Bot interaction as if it was from a user, unless that computer has been programmed to detect the Bot.
Brand Safety
A set of measures that work to protect the reputation of a brand from the negative or damaging effects of undesirable or inappropriate content when advertising online. These measures can include employing blocklists or allowlists, preventing ads from being displayed on websites in certain content categories (such as piracy, adult, hate speech, and known malware sites), partnering with third-party verification vendors.
Business
The primary regulated entity under the CCPA, defined as an entity that collects California consumers’ Personal Information, does business in California, and meets a relevant data collection or revenue threshold. The data collection threshold of 50,000 California residents or “consumers” set forth in the CCPA will double to 100,000 when the CPRA takes effect in 2023. Businesses are responsible for honoring consumer rights requests, disclosing how consumer Personal Information is collected, used, and shared, and contractually ensuring the compliance of Service Providers, Contractors, and other partners whom they provide with consumer data.
California Consumer Privacy Act 2018 (CCPA)
A California state privacy statute responsible for enhancing privacy rights and consumer protection for California residents. It will only apply to companies if certain thresholds are met in terms of revenues and/or numbers of users in California.
California Privacy Rights Act (CPRA)
A California state statute to protect the rights of residents of California by tightening Business regulations on the use of Personal Information. The CPRA established the CPPA and also amends some provisions of the CCPA. The CPRA is now fully effective, and enforcement will be able to look back as far as January 1, 2022.
California Privacy Protection Agency
A new agency, created by the CPRA, which has “full administrative power, authority, and jurisdiction to implement and enforce” the CCPA. The role was previously held by the California Attorney General.
Campaign
A group of advertisements across different mediums, all with the same shared message and desire to achieve the same overall outcome.
Campaign Optimization
Campaign Optimization encompasses actions by an organization to improve their performance across various digital marketing channels. Using key performance indicators like (i) return on ad spend; (ii) cost per click; and (iii) conversion rates, organizations ensure that they are getting the most out of the marketing efforts while increasing return on investment.
Clean Rooms
Secure environments built to allow parties to share and access insights from another party’s data sets in a privacy enhanced way since raw data does not leave the clean room and only aggregated data is shared.
Click-Through Rate (CTR)
A metric that will often be seen in advertising agreements and may help determine success or payment criteria. The CTR measures the success of online advertisements by determining the percentage of people that actually click on the advertisement, for example, to arrive at the hyperlinked website. Note, a CTR does not go as far as a Conversion Rate.
Colorado Privacy Act (CPA)
A Colorado state statute to protect the data privacy rights of Colorado residents by imposing obligations and restrictions on qualifying Businesses’ collection, use and sharing of Personal Data about Colorado residents. The CPA is very similar to the VCDPA in Virginia. Both laws employ terminology and principles that reflect the GDPR more than California’s CCPA – for example, the terms Personal Data (rather than Personal Information), Controllers and Processors are used.
Consent
The precise definition varies depending on the applicable law. Under the GDPR, consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as it is to give. In the U.S., consent standards vary depending on the context of the data Processing, as well as the type and sensitivity of the data which is Processed. Under the recently enacted CPRA and similar comprehensive privacy statutes in Virginia and Colorado (VCDPA and CPA, respectively), the definition of Consent will generally align with the GDPR’s freely given, specific, informed and unambiguous standard.
Content Optimisation System (COS)
A software platform that acts as a content management system and provides users with a personalised website interaction experience.
Conversion
A defined action showing the success of an advertisement. For example, signing up to a newsletter or making a purchase.
Conversion Rate
Similar to a CTR, the Conversion Rate is another metric for looking at the success or Conversion of advertisements.
Cookie
A Cookie is a text file of data that is placed on a user’s device when they are browsing a website. They may have various purposes (see, for example, Analytic Cookie or Advertising Cookie) but have in common that they identify individual behaviour. Even though Cookies will not generally directly identify an individual, the data is treated as Personal Data for the purposes of GDPR and is subject to PECR. Other laws may specify that Cookies are only subject to them if they collect Personal Data. Care is needed with the term “Cookie” since it can be used quite broadly to cover other similar technologies which aren’t strictly Cookies – for example, Pixels.
Cookie or Consent Management Platform (CMP)
Most commonly CMP stands for a Consent Management Platform but sometimes more narrowly relating to a Cookie Management Platform. Essentially, it is a means to collect Consents for Cookies or similar technologies under PECR or GDPR, or other comprehensive privacy legislation. Typically, companies will licence a CMP and there are various vendors who provide these, although there is nothing to stop a company creating and operating its own CMP. CMPs come in different forms – for example, some may specifically be IAB and TCF compliant. They are most commonly seen on websites but can also be engaged for the collection and management of permissions in mobile apps and even in CTV environments.
Cost per Click (CPC)
Used to determine the price paid each time a user has clicked on the relevant advertisement.
Cost per Mille / Cost per Thousand (CPM)
The cost an Advertiser pays for one thousand views or Impressions of an advertisement.
Cross- Context Behavioural Advertising (CCBA)
A California-specific legal term referring to the targeting of advertising to a consumer based on the consumer’s Personal Information obtained from the consumer’s activity across Businesses, distinctly-branded websites, applications, or services, other than the Business, distinctly-branded website, application, or service with which the consumer intentionally interacts. See also Targeted Advertising.
Custom Audience
An advertising technique to target advertisements at a particular defined audience or audience segment. It generally involves an Advertiser providing certain data of its customers – for example, an email, postcode or IP address, to a third party which, via a matching process, then determines which of those customers are also users of the third party and should then be targeted with the advertisement. For example, an Advertiser may provide data to a social media platform so that the social media platform can serve a promotional advertisement in the feed of customers that the Advertiser knows will likely be interested to see it. Sometimes an independent third party entity may be used for the matching service.
Customer Data Platforms (CDPs)
A collection of software which help companies stitch together data from different sources to create a unified, persistent customer profile that provides data transparency and granularity at the known, individual level.
Dark Pattern
A user interface designed or manipulated with the intention of subverting or impairing user autonomy, decision making or choice. There are multiple regulations that discuss Dark Patterns, including under consumer law, GDPR, DSA and DMA. In particular, the use of Dark Patterns can prevent effective Consent if it is not deemed to be freely given.
Data Aggregation
The combination of sets of data for the purpose of statistically analysing data trends while protecting individual privacy by using groups of individuals with similar characteristics rather than isolating one individual at a time. According to the IAPP, effective Data Aggregation requires: (i) use of a large population of individuals; (ii) categories of data that create broad sets of individuals; and (iii) not including data that would be unique to a single individual in the data set.
Data Analytics
The exercise of examining large raw data sets to unearth patterns and user preferences to draw a conclusion or insights. It may enable Advertisers to target their advertisements to the right user or to draw insights as to what techniques or Campaigns are the most successful.
Data Broker
Legal definitions may vary, but a Data Broker is generally an entity that collects, aggregates and/or sells individuals’ Personal Data, derivatives and inferences from disparate public or private sources, often without a direct relationship to the affected individuals. As of February 2022, two US states, Vermont and California, have enacted laws requiring qualifying Data Brokers to register with state regulators.
Data Controller
A term under the GDPR and UK GDPR and other data protection legislation, including Virginia’s VCDPA and Colorado’s CPA, which means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
Data Management Platform (DMP)
A data platform used to collect and organise data, which is made available to other platforms such as DSPs, SSPs, and Ad Exchanges, to be used for Targeted Advertising, personalisation and content customisation.
Data Processor
A term under the GDPR and UK GDPR and other data protection legislation, including Virginia’s VCDPA and Colorado’s CPA, which means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Data Controller.
Data Protection Act 2018 (DPA)
The UK legislation embodying GDPR which regulates how Personal Data is used by businesses, organisations and the government.
Data Protection and Digital Information (No. 2) Bill
The UK’s draft bill aims to introduce certain changes to the UK GDPR, DPA and PECR, in particular with updates to the Cookie requirements, exempting so-called lower risk Cookies from requiring a banner or Consent mechanism. Consent, however, will still be necessary to carry out Targeted Advertising.
Data Protection Impact Assessment (DPIA)
A DPIA is required in some circumstances under GDPR (notably where Processing is high risk) and under other international privacy legislation to assess the potential risks of Processing individuals’ Personal Data. It is an important part of the GDPR’s and other data protection legislation’s accountability requirements and is often used in the context of extensive Profiling and targeted marketing.
Data Sharing Code
The UK data protection regulator’s statutory Data Sharing Code of practice which came into force on 5 October 2021 as updated or amended from time to time. It sets out guidelines and expectations around data sharing which is particularly relevant in the context of adtech, where Personal Data may be shared between multiple different stakeholders.
Data Visualisation Platform
Software that collates numerous data outputs from systems – for example, advertising performance and website analytics. The collated data is analysed into a graphical representation, which highlights patterns, trends and correlations.
Demand-side platform (DSP)
A technology platform that enables Advertisers to buy Ad Inventory from Publishers. The platform utilises many real-time bidding (RTB) capabilities.
Deterministic Matching
Deterministic Matching is the process of identifying an exact match of records. In media, this is often used to identify the same consumer across different devices by matching the same user profiles together.
Device Fingerprinting
A tracking technique to identify devices and therefore user interactions and behaviours. This is often used for Targeted Advertising. Even where Cookies are not used, Device Fingerprinting may still fall under the requirements for Consent under privacy legislation such as the PECR and GDPR in the EU and UK depending on the configuration and set up.
Device ID
A unique, string of numbers and letters that identifies individual smartphones or tablets, such as the Google Advertising ID (GAID).
Digital Advertising Alliance (DAA)
An adtech industry self-regulatory association that maintains and enforces the principle-based AdChoices program and publishes a series of self-regulatory principles related to several forms of online advertising, including mobile advertising, political advertising, and online Behavioural Advertising.
Digital Markets Act (DMA)
A new piece of EU legislation that is now in force. The DMA places a ban on tracking end users outside of a qualifying gatekeeper’s core platform service for the purpose of Targeted Advertising, without effective Consent having been given. Gatekeepers must also perform an independent audit covering all the Profiling methods used across core platform services and send this to the European Commission, as well as making an overview of the audit report publicly available.
Digital Services Act (DSA)
A new EU regulation that becomes fully effective in February 2024. The DSA introduces a strict prohibition on carrying out Profiling based on special categories of personal data (such as health, religion, sexuality or ethnicity data) or the personal data of those aged under 18 for the purposes of Targeted Advertising. The DSA also introduces several advertising-specific obligations which relate to information provision, ad transparency, content reporting, illegal ads and repositories, as well as a ban on the use of Dark Patterns on online interfaces.
Dynamic Ad Insertion (DAI)
A technology that allows the insertion of advertisements into linear, live or video-on-demand content in a way that is targeted – i.e. a viewer in one household won’t necessarily see the same advertisement as a viewer in another.
Editorial Adjacency Guidelines
Advertisers can impose contractual Editorial Adjacency Guidelines to control what content is placed adjacent to their advertisement – for example, to prevent against harmful or inappropriate content. The IAB publish model guidelines from time to time. It can be challenging to monitor the implementation of such content restrictions.
Federal Trade Commission (FTC)
An independent US government agency responsible for enforcement of civil US antitrust law and the promotion of consumer protection.
Federated Learning of Cohorts (FLoC)
This concept used to be a key component of the GPS proposals, the ideal being to group people into “cohorts” based on their browsing history and then Advertisers are able to advertise to their chosen cohorts. The cohorts change regularly. The concept has now been replaced with Topics.
Frequency Capping
A software that limits how many times a given advertisement will be shown to the same person during a session or within a specified time period.
First Party Cookies
Cookies set directly by the host, i.e. the first website that is visited by the user, to help understand users’ online behaviours. They are sometimes seen as less invasive for users since they don’t automatically involve data sharing as the website may only use them for its own purposes.
First Party Data
Data that an organisation collects directly from a user usually from direct interactions – for example, customers who have registered with them. The data could be anything and does not have to be specific to Cookies.
FLEDGE
A component of the GPS proposals that relates to Remarketing / Retargeting and is designed so that it “cannot be used by third parties to track user browsing behaviour across sites”.
Functional Cookies
Cookies used to provide a personalised experience and to make the website easier to use. For example, remembering log-in details to make it easier to log-in next time the user accesses the website.
General Data Protection Regulation (GDPR)
The primary piece of legislation relating to privacy in the EU and also implemented in the UK. It came into force in May 2018. Where adtech involves Personal Data, it will be caught by and needs to comply with GDPR.
General Invalid Traffic (GIVT)
Traffic that is generated by known industry crawlers or that is otherwise readily-detectible – for example, activities like switching websites every five seconds for twelve straight hours.
Global Privacy Control (GPC)
A proposed specification initiated by various stake- holders in the US to enable individuals to notify online services of their privacy preferences. It can take the form of a setting within a browser or an extension that an individual can install. When enabled, it sends a signal communicating the individual’s preferences about the sale or sharing of their data to each site. The current legal status of GPCs in the US is unclear. The technical specifications of a universally enforceable GPC remain undefined, but this has not stopped the California Attorney General’s Office from stating its intention to require Businesses to honor GPCs as valid opt out signals, and the CPRA seeks to give Businesses the option of honoring GPCs in lieu of providing other opt out functionality.
Google Privacy Sandbox (GPS)
An initiative led by Google to create website standards for websites to access user information without compromising privacy. Its core purpose is to facilitate online advertising without the use of Third Party Cookies.
Identifier For Advertisers (IDFA)
Created by Apple for iOS devices. IDFA is similar to a standard Cookie but IDFA is linked to the device rather than the browser. It enables Advertisers to be notified when a user clicks on an advertisement, installs, uses or interacts with the advertisement within the app.
Identity Graph
Database that houses all the known identifiers that correlate with individual customers. An identity graph collects personal identifiers such as email addresses, physical addresses, mobile phone numbers, device IDs, and account usernames and connects them to a customer’s profile and any related data points, including behavioral data like browsing activity or purchase history.
Identity Resolution
The process of integrating identifiers across available touchpoints and devices with behavior, transaction, and contextual information into a cohesive and addressable consumer profile.
Identifier-Based Protocols
Using an identifier to collect an individual’s preference and transmit it to other market participants. Depending on the specific solution, once an individual provides their data, they can then set their preferences about its use. The identifier may be further Processed and also shared with other organisations.
Impression
The number of times an advertisement is displayed – for example, an advertisement appearing in a user’s social media feed. It is not the same as an active click or view.
Insertion Order
An agreement between a Publisher and Advertiser to run a Campaign.
Interactive Advertising Bureau (IAB)
The industry body for digital advertising, with offices in the UK, Europe, North America, and Southeast Asia and India. The IAB promotes industry collaboration to develop standards, best practices, and critical research and provide educational resources.
International Association of Privacy Professionals (IAPP)
A non-profit membership association for professionals with access to resources on global privacy information. Founded in 2000 in the US with an office in Belgium and an Asia-Pacific support line.
Interim Measures on Administration of Internet Advertisements
A major piece of legislation relating to online advertisements and supplemental to the China Advertisement Law. It was adopted on 4 July 2016 and came into effect on 1 September 2016. It sets out the controls attached to online advertising. Where adtech involves the carrying out of advertising activities via the Internet, it will be caught by and need to comply with the regulation. A draft amendment has been published and the amended legislation is expected to be promulgated in 2022.
Location Data
Definitions may vary under applicable law but, generally, Location Data indicates the geographical position of a device (or device user), including data relating to the latitude, longitude, or altitude of the device, the direction of travel of the user, or the time the location information was recorded.
Lookalike Audience
A tool that dissects followers and user characteristics – for example, interests, how they look and actions taken. The tool looks for commonalities within users to create a Lookalike Audience. This enables Advertisers to target Lookalike Audiences that they would not normally have been able to reach.
Media Trading Desk
A service provided by an agency or a third party software solution. It is situated between the advertiser and the supply and demand platforms, and networks to purchase media to provide planning, management, and optimization of programmatic advertising campaigns.
Network Advertising Initiative (NAI)
A self-regulatory organisation in the US whose members agree to adhere to higher than-legally- mandated standards of consumer choice and consumer knowledge in online advertising. The NAI publishes a code of conduct that members agree to adhere to and which covers interest based advertising, advertisement delivery and reporting, and Retargeting / Remarketing, among other topics. The NAI monitors its member’s compliance, works with allegedly non-complaint members to suggest recommended improvements, and reserves the right to refer matters to the FTC.
NOYB – European Centre for Digital Rights
Based in Austria, NOYB promotes public awareness of freedom, democracy and consumer protection in the digital sphere with a focus on consumer rights, privacy rights, self-determination, data protection, freedom of expression, freedom of information, human rights and the fundamental right to an effective remedy.
Non-Human Traffic (NHT) Online Tracking
NHT generally refers to Bot traffic and other visits to a website that are not generated by a human being. Bot traffic accounts for a substantial percentage of all web- site traffic, and many forms of NHT are non-fraudulent and serve benign purposes like indexing pages for search engines or testing website functionality and performance. In the advertisement measurement context, however, NHT is at best a form of statistical “noise” and in many instances refers to intentional, fraudulent efforts to generate false ad Impressions or clicks that inflate apparent site traffic or ad click rates. Fraudulent forms of NHT include both GIVT and SIVT.
Online Safety Bill (OSB)
A draft bill by the UK government, which is expected to receive royal assent later this year. The OSB includes provisions for criminalizing fraudulent advertisements, as well as obligations to remove content that is illegal (or prohibited by the terms of use) and content that is harmful to children. The OSB will also give adult users the ability to tailor the types of legal but harmful content they are offered by an online service.
Online Tracking
The practice by which operators of websites and third parties collect, store and share data about users and their interactions online.
Performance Marketing
A type of digital marketing where brands only pay marketing service providers once their business goals are met or when specific actions are completed, such as a click, sale, or lead.
Personal Data
Defined in the GDPR and under other international privacy legislation to cover information relating to an identified or identifiable living individual. Under the GDPR, specifically, it includes obvious data such as a name, email address, identification number, and Location Data, but in the specific context of adtech also covers identifiers such as IP address, Cookie or advertising ID.
Personal Data Breach
Defined in the GDPR, it covers a breach of security leading to the accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to, the Personal Data or unavailability of Personal Data. Materially similar definitions appear in the laws of jurisdictions in Asia that have enacted mandatory data breach notification laws, for example Singapore, the Philippines and Australia.
Personal Data Privacy Ordinance (PDPO)
The primary piece of legislation relating to data protection in Hong Kong. It was passed in 1995 and took effect in December 1996 save for certain provisions. Where adtech involves Personal Data, it will be caught by and need to comply with the PDPO.
Personal Data Protection Act 2012 (2020 Rev. Edition) (PDPA)
The primary piece of legislation relating to data protection in Singapore. It was passed in 2012 and came into full force in July 2014. The PDPA was revised substantially in 2021 to include new and expanded exceptions to Consent, enhance restrictions on direct marketing, and introduce mandatory breach notifications (among others). Where adtech involves Personal Data, it will be caught by and need to comply with the PDPA.
Personal Information
Under California’s CCPA and CPRA, Personal Information is broadly defined as any “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Personal Information is similar in breadth and scope to Personal Data as defined in other comprehensive privacy laws in other US states (e.g. Virginia and Colorado), as well as under the GDPR in Europe and the UK.
Personal Information Protection Law (PIPL)
The primary piece of legislation relating to personal information protection and privacy in the People’s Republic of China. It was adopted on 20 August 2021 and came into effect on 1 November 2021. Where adtech involves Personal Data, it will be caught by and need to comply with the PIPL.
Personalisation Engine
A software that powers an Advertiser’s website, mobile app, email to enable them to deliver customised experiences for users based on the users previous activity. This allows data to be tailored to the user.
Pixel
A graphic embedded in banner advertisements, emails, and website to track user behavior and interactions with the website, similar to a Cookie.
Predictive Analytics
This uses marketing and advertising data to preempt what users are most likely to do next. It enables the ability to gain a more informed view of users to customise future advertisements.
Privacy and Electronic Communications Regulations (PECR) / ePrivacy Directive
PECR is sometimes also referred to as the ePrivacy Directive. This is old EU legislation dating back to 2012 but it is still valid (although currently under review) and sets out the privacy rights of individuals in relation to electronic communication including, in the context of adtech, key rules around direct marketing and Cookies. The EU Directive was implemented into EU Member State laws and therefore there are variations between countries. The UK, despite having left the EU now, continues to enforce through the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2003.
Processing, Processes, Processed, Process
Any activity that involves the use of Personal Data. It includes, but is not limited to, any operation or set of operations which is performed on the Personal Data or on sets of the Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring the Personal Data to third parties.
Probabilistic Data
A group of users that have been accurately Profiled so that they can be correctly targeted.
Probabilistic Matching
The process of identifying what is likely a match of records through the use of models and other statistical methods.
Profiling
Defined in the GDPR as any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability behavior and location of movements. However, outside of the GDPR, the term is widely used with this general meaning in the industry.
Programmatic Buying
Automatic process of buying and selling of digital advertisement placements. Sometimes, but not always, this is through RTB.
Reach & Frequency
Publisher An owner and supplier of digital advertisement space online. They provide Advertisers with the ability to purchase and display their advertisements on the Publisher’s website or other content mediums.
Real -Time Bidding (RTB)
The number of people an advertiser reached with an ad. Frequency is the number of times an ad reaches a particular consumer. Advertising buyers bid for advertising space for a defined audience and, if the bid is won (i.e. the price is highest), the buyer’s advertisement is (nearly) instantly displayed on the Publisher’s site, without the user being aware of the auction.
Retargeting / Remarketing
A digital marketing tactic serving advertisements to consumers who have previously engaged via site visits or email sign-ups, where the prior engagement did not result in a sale or Conversion. For example, a user may have been browsing holidays on one site and then, moving to a new site, they see advertisements for holidays from that original site there.
Second Party Data
One organisation’s First Party Data that another organisation purchases/licences.
Sell, Selling, Sale of Personal Information
A California-specific term under the CCPA and CPRA referring to the sharing of consumer Personal Information in exchange for money “or other valuable consideration”. The scope of application of the definition has been debated in the adtech industry since the enactment of the CCPA due to disagreement about many species of Third Party Data transfers: some have maintained that virtually any transfer of data that permits a Third Party to use consumer Personal Information for its own commercial purposes constitutes a “sale” under the CCPA; others have drawn the line more narrowly, depending on the nature of the contractual consideration. CPRA attempts to moot this debate in the adtech context by introducing a complementary definition for “sharing” that covers most Third Party exchanges of data for CCBA purposes, irrespective of whether there is monetary or other valuable consideration.
Service Provider (and Contractor)
Under the CCPA and CPRA, a Service Provider is an entity that receives consumer Personal Information from a Business and Processes that data on the Business’s behalf for specific, contractually enumerated purposes. Like Contractors, consumers cannot opt out of a Business’s transmission of data to a Service Provider, so long as appropriate contractual controls are in place between the Service Provider and Business. The primary difference between Contractors and Service Providers is that a Contractor is an entity to which a Business makes consumer data available (though not for the Contractor’s own commercial purposes), while a Service Provider is an entity that Processes data on the Business’s behalf. Additionally, Businesses’ agreements with Contractors must contain some additional terms to certify and ensure Contractors’ ongoing compliance with applicable law.
Sophisticated Invalid Traffic (SIVT)
Fraudulent traffic patterns that are designed to avoid simple, detectible patterns and which often require advanced analysis and significant human intervention to detect.
Strictly Necessary Cookies
Cookies that are necessary to enable the basic features of the website to function. For example, providing secure log-in or remembering how far a user is through an online order. In the UK and EU, Consent is not required for Strictly Necessary.
Supply-side platform (SSP)
A technology platform that helps Publishers manage their Ad Inventory while maximising potential revenue. SSPs allow Publishers to manage their inventory in real-time, prioritising their own direct buys first (which net them more money), and then uploading their unsold inventory to the Ad Exchanges. SSP reporting capabilities also provide insight into what inventory is selling best and at what price point.
Tag
A piece of code inserted within a webpage that triggers an http(s) request to an Advertising Server, providing information such as the Cookie, page URL, screen resolution, and browser information, and allows for an advertisement to load.
Targeted Advertising
A Colorado and Virginia-specific term referring to the display of advertisements to a consumer where the advertisement is selected based on Personal Data obtained from that consumer’s activities over time and across non-affiliated web- sites or online applications to predict such consumer’s preferences or interests. See also CCBA.
Taxonomy
A way of organising and classifying data into categories and subcategories to enable greater segmentation and filtering.
Third Party
Under the CCPA and CPRA, a Third Party is a catch- all term for entities that receive consumer Personal Information from a Business, but which do not meet the definitions of Contractor (CPRA only) or Service Provider (both CCPA and CPRA). Third Parties are typically entities that receive consumer Personal Information with the intention of using or onward sharing that data for their own commercial purposes, rather than to perform discrete, contractually limited services on behalf of the Business (e.g. a Data Broker or aggregator, rather than a cloud storage provider). Under the CCPA, Businesses are not required to have specific agreements in place with Third Parties. However, under the CPRA, Businesses will be required to enter agreements with all Third Party partners specifying, among other things, the specific, limited purposes for which data is Sold or otherwise disclosed.
Third Party Cookies
Cookies set by a separate company through the website being visited by the user.
Third Party Data
Data purchased from organisations that were not the original collectors of the data, such as Data Brokers or aggregators.
The Trade Desk
An independent media buying platform (DSP) where Advertisers can purchase digital advertisements. Founded in 2009 in the US, with offices across the US and also in London, Asia, Australia and Europe.
Topics
A key concept of GPS, a proposed new system for interest based advertisements with 5 key ‘Topics’ used to identify user interests based on web browsing activity from participating websites each week.
Transparency and Consent Framework (TCF)
The TCF for digital marketing and advertising, developed by IAB Europe, aims to communicate an individual’s preferences between online services and other participants within the advertising data supply chain. It provides a means of transmitting signals of Consent from a user to vendors working with Publishers using a CMP.
Trust Tokens
A GPS proposal that intends to enable websites to convey a limited amount of information from one browsing context to another to help combat Ad Fraud.
Unified ID 2.0 (UID 2.0)
A universal Cookie ID proposal developed by The Trade Desk that utilises a user’s email address to create an encrypted, rotating, randomised numerical ID as a substitute for Third Party Cookies that is intended to work across all mobile operating systems.
User-Agent Reduction
A GPS proposal that intends to limit browser data shared to remove sensitive information and reduce Device Fingerprinting.
Unique User / Device ID (UDID)
An identifier assigned to a device or user that lasts until the device is reset or the account is deleted.
Unique Visitor
A Unique Visitor is someone who visits a site more than once within a period of time.
Video Ad Serving Template (VAST)
A standardised set of specifications developed by the IAB that define the requirements for serving advertisements to video playback sources online. The specifications are delivered in the form of a script which allows video players to interpret information about the advertisement being served.
Video Player Ad Serving Interface Definition (VPAID)
An advertisement template that allows a rich interactive user experience within stream video advertisements.
Virginia Consumer Data Protection Act (VCDPA)
A Virginia state statute to protect the data privacy rights of Virginia residents by imposing obligations and restrictions on qualifying Businesses’ collection, use and sharing of Personal Data about Virginia residents. The VCDPA is very similar to the CPA in Colorado. Both laws employ terminology and principles that reflect the GDPR more than California’s CCPA – for example, the terms Personal Data (rather than Personal Information), Controllers and Processors are used.
Walled Garden
A closed platform or closed ecosystem where the technology provider has significant control over the hardware, applications, or content.
Authors