What Is GDPR?

What is GDPR?

GDPR stands for General Data Protection Regulation. It is a privacy law in the European Union that controls how companies collect, store, and use personal data.

It applies when:

• The user is in the EU
• A website or app has EU users
• An SSP or DSP processes EU user data

What counts as personal data under GDPR?

In AdTech, GDPR affects many common identifiers and signals:

So GDPR mainly affects targeted advertising.

GDPR vs COPPA

GDPR in OpenRTB

In an OpenRTB bid request, GDPR is usually represented like this:

"regs": {
  "gdpr": 1
},
"user": {
  "ext": {
    "consent": "TCF_STRING"
  }
}

Two important fields matter most:

This consent string is usually called a TCF string, based on the Transparency and Consent Framework.

What is a consent string?

When an EU user visits a website, they often see a consent popup asking whether they allow cookies, personalized ads, and measurement. This popup is managed by a CMP, or Consent Management Platform.

Common CMP examples include:

• OneTrust
• Quantcast CMP
• Sourcepoint
• TrustArc

User choices usually look like:

That choice is converted into a consent string and sent with the bid request.

GDPR flow in AdTech

EU User visits website
        ↓
CMP popup appears
        ↓
User gives consent or rejects
        ↓
Consent string generated
        ↓
Ad request sent to SSP
        ↓
SSP sends to DSP with:
        regs.gdpr = 1
        user.ext.consent = string
        ↓
DSP reads consent
        ↓
DSP decides:
    If consent = yes -> personalized ads
    If consent = no -> contextual ads only

Example: with consent

A bid request may look like:

{
  "regs": { "gdpr": 1 },
  "user": {
    "id": "abc123",
    "ext": {
      "consent": "BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA"
    }
  },
  "device": {
    "ifa": "AEBE52E7-03EE-455A-B3C4-E57283966239"
  }
}

The DSP sees:

• GDPR applies
• Consent = yes
• Device ID present
• User ID present

The DSP can usually do:

• Retargeting
• Audience targeting
• Frequency capping
• Lookalike targeting
• Behavioral targeting

Example: without consent

A request may look more like:

{
  "regs": { "gdpr": 1 },
  "user": {
    "ext": {
      "consent": "BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA"
    }
  },
  "device": {
    "ifa": null
  }
}

The DSP sees:

• GDPR applies
• No consent for personalization
• No device ID

The DSP must:

• Disable audience targeting
• Disable retargeting
• Use contextual targeting only

This is often called limited ads.

DSP behavior table

SSP responsibilities under GDPR

• Show the consent popup through a CMP
• Store user consent
• Send the consent string in the bid request
• Remove IDs if consent is not present
• Send regs.gdpr = 1
• Pass the consent string to DSPs

If the SSP fails to do this correctly, there can be legal and platform risk.

DSP responsibilities under GDPR

• Read the consent string
• Check whether the vendor is allowed
• Check whether the purpose is allowed, such as personalization, measurement, and frequency capping
• If not allowed, do not use personal data
• Bid contextual ads only when consent is not sufficient

Real example

Scenario: a user in Germany opens a news website.

The CMP popup appears and the user clicks Reject.

Now the bid request effectively behaves like this:

regs.gdpr = 1
device.ifa = null
user.id = null
context.category = news

Example DSP decisions:

So fill rate often drops, but it does not always fall to zero.

GDPR impact on revenue

So GDPR usually reduces revenue if the user rejects consent, because user-level targeting becomes unavailable.

COPPA vs GDPR vs CCPA

OpenRTB privacy flags summary

Interviewers love this comparison.

One-line summary

Final DSP decision logic

IF COPPA = 1
    -> Contextual ads only

ELSE IF GDPR = 1 AND Consent = Yes
    -> Personalized ads allowed

ELSE IF GDPR = 1 AND Consent = No
    -> Contextual ads only

ELSE
    -> Normal targeting

Real problems you will see in AdOps, SSP, or DSP work