Purpose 1: Store and/or access information on a device
Vendors can:
Store and access information on the device such as cookies and device identifiers presented to
a user.
Purpose 2: Select basic ads
To do basic ad selection vendors can:
Use real-time information about the context in which the ad will be shown, to show the ad,
including information about the content and the device, such as: device type and capabilities,
user agent, URL, IP address
Use a user’s non-precise geolocation data
Control the frequency of ads shown to a user.
Sequence the order in which ads are shown to a user.
Prevent an ad from serving in an unsuitable editorial (brand-unsafe) context
Vendors cannot:
Create a personalised ads profile using this information for the selection of future ads.
N.B. Non-precise means only an approximate location involving at least a radius of 500 meters
is permitted.
Purpose 3: Create a personalised ads profile
To create a personalised ads profile vendors can:
Collect information about a user, including a user's activity, interests, demographic
information, or location, to create or edit a user profile for use in personalised advertising.
Combine this information with other information previously collected, including from across
websites and apps, to create or edit a user profile for use in personalised advertising.
Purpose 4: Select personalised ads
To select personalised ads vendors can:
Select personalised ads based on a user profile or other historical user data, including a user’s
prior activity, interests, visits to sites or apps, location, or demographic information.
Purpose 5: Create a personalised content profile
To create a personalised content profile vendors can:
Collect information about a user, including a user's activity, interests, visits to sites or apps,
demographic information, or location, to create or edit a user profile for personalising
content.
Combine this information with other information previously collected, including from across
websites and apps, to create or edit a user profile for use in personalising content.
Purpose 6: Select personalised content
To select personalised content vendors can:
Select personalised content based on a user profile or other historical user data, including a
user’s prior activity, interests, visits to sites or apps, location, or demographic information.
Purpose 7: Measure ad performance
To measure ad performance vendors can:
Measure whether and how ads were delivered to and interacted with by a user
Provide reporting about ads including their effectiveness and performance
Provide reporting about users who interacted with ads using data observed during the course
of the user's interaction with that ad
Provide reporting to publishers about the ads displayed on their property
Measure whether an ad is serving in a suitable editorial environment (brand-safe) context
Determine the percentage of the ad that had the opportunity to be seen and the duration of
that opportunity
Combine this information with other information previously collected, including from across
websites and apps
Vendors cannot:
Apply panel- or similarly-derived audience insights data to ad measurement data without a
Legal Basis to apply market research to generate audience insights (Purpose 9)
Purpose 8: Measure content performance
To measure content performance vendors can:
Measure and report on how content was delivered to and interacted with by users.
Provide reporting, using directly measurable or known information, about users who
interacted with the content
Combine this information with other information previously collected, including from across
websites and apps.
Vendors cannot:
Measure whether and how ads (including native ads) were delivered to and interacted with by
a user.
Apply panel- or similarly derived audience insights data to ad measurement data without a
Legal Basis to apply market research to generate audience insights (Purpose 9)
Purpose 9: Apply market research to generate audience insights
To apply market research to generate audience insights vendors can:
Provide aggregate reporting to advertisers or their representatives about the audiences
reached by their ads, through panel-based and similarly derived insights.
Provide aggregate reporting to publishers about the audiences that were served or interacted
with content and/or ads on their property by applying panel-based and similarly derived
insights.
Associate offline data with an online user for the purposes of market research to generate
audience insights if vendors have declared to match and combine offline data sources (Feature
1)
Combine this information with other information previously collected including from across
websites and apps.
Vendors cannot:
Measure the performance and effectiveness of ads that a specific user was served or
interacted with, without a Legal Basis to measure ad performance.
Measure which content a specific user was served and how they interacted with it, without a
Legal Basis to measure content performance.
Purpose 10: Develop and improve products
To develop new products and improve products vendors can:
Use information to improve their existing products with new features and to develop new
products
Create new models and algorithms through machine learning
Vendors cannot:
Conduct any other data processing operation allowed under a different purpose under this
purpose
Special Purpose 1: Ensure security, prevent fraud, and debug
To ensure security, prevent fraud and debug vendors can:
Ensure data are securely transmitted
Detect and prevent malicious, fraudulent, invalid, or illegal activity.
Ensure correct and efficient operation of systems and processes, including to monitor and
enhance the performance of systems and processes engaged in permitted purposes
Vendors cannot:
Conduct any other data processing operation allowed under a different purpose under this
purpose.
Special Purpose 2: Technically deliver ads or content
To deliver information and respond to technical requests vendors can:
Use a user’s IP address to deliver an ad over the internet
Respond to a user’s interaction with an ad by sending the user to a landing page
Use a user’s IP address to deliver content over the internet
Respond to a user’s interaction with content by sending the user to a landing page
Use information about the device type and capabilities for delivering ads or content, for
example, to deliver the right size ad creative or video file in a format supported by the device
Vendors cannot:
Conduct any other data processing operation allowed under a different purpose under this
purpose
Feature 1: Match and combine offline data sources
Vendors can:
Combine data obtained offline with data collected online in support of one or more Purposes
or Special Purposes.
Feature 2: Link different devices
Vendors can:
Deterministically determine that two or more devices belong to the same user or household
Probabilistically determine that two or more devices belong to the same user or household
Actively scan device characteristics for identification for probabilistic identification if users
have allowed vendors to actively scan device characteristics for identification (Special Feature
2)
Feature 3: Receive and use automatically-sent device characteristics for identification
Vendors can:
Create an identifier using data collected automatically from a device for specific
characteristics, e.g. IP address, user-agent string.
Use such an identifier to attempt to re-identify a device.
Vendors cannot:
Create an identifier using data collected via actively scanning a device for specific
characteristics, e.g. installed font or screen resolution without users’ separate opt-in to
actively scanning device characteristics for identification.
Use such an identifier to re-identify a device.
Special Feature 1: Use precise geolocation data
Vendors can:
Collect and process precise geolocation data in support of one or more purposes. N.B. Precise
geolocation means that there are no restrictions on the precision of a user’s location; this can
be accurate to within several meters.
Special Feature 2: Actively scan device characteristics for identification
Vendors can:
Create an identifier using data collected via actively scanning a device for specific
characteristics, e.g. installed fonts or screen resolution.
Use such an identifier to re-identify a device.