How do I ensure my automated media buying with a demand-side platform is compliant with brand safety and data rules?

To keep automated media buying through a DSP compliant with brand safety and data/privacy rules, set it up as a governed process—not just a media tactic. Here’s a practical framework:

1) Build a policy baseline first

Define, in writing:

• Approved inventory types: open exchange, PMP, PG, curated marketplaces
• Blocked categories: hate, violence, adult, piracy, illegal downloads, misinformation, etc.
• Contextual exclusions: sensitive news, tragedy, political content, user-generated content if needed
• Audience/data rules: what data sources are allowed, what personal data is prohibited, retention limits
• Geographic rules: GDPR/UK GDPR, CCPA/CPRA, other local requirements
• Brand suitability thresholds: “safe” is not enough; decide what’s suitable for your brand

Document these as a brand safety and data governance policy and make compliance ownership clear.

2) Use DSP controls aggressively

Most DSPs support controls that should be turned on and reviewed:

• Third-party brand safety segments
  Use vendors like DoubleVerify, Integral Ad Science, or MOAT equivalents for:

  • pre-bid blocking
  • post-bid verification
  • contextual classification

• Supply-path and seller controls

  • whitelist approved domains/apps only where possible
  • block low-quality resellers
  • use ads.txt / app-ads.txt / sellers.json / SupplyChain object checks
  • prefer direct or curated supply paths

• Inventory and placement filtering

  • exclude made-for-advertising (MFA) sites
  • block specific apps, domains, pages, and placements
  • exclude sensitive content categories and unsafe page types
  • apply strict viewability and fraud filters

• Frequency and recency controls These are less about safety and more about governance, but they help prevent overexposure and poor user experience.

3) Treat data compliance as a consent and purpose issue

For audience targeting and measurement:

• Only use lawful data

  • Ensure every audience segment has a valid legal basis to be used where required
  • Verify consent signals for EU/UK traffic
  • Avoid using sensitive personal data unless you have explicit legal justification and consent where required

• Minimize data collection

  • Use the least granular data needed
  • Prefer contextual targeting when possible
  • Don’t upload customer data unless necessary

• Contractually restrict partners Make sure DSPs, data providers, and measurement vendors:

  • act as processors/service providers where applicable
  • do not repurpose your data
  • have clear deletion, retention, and security obligations

• Respect user rights Have a process for:

  • access/deletion requests
  • opt-out handling
  • honoring “Do Not Sell/Share” and global privacy controls where applicable

4) Control first-party and third-party data usage

If you use CRM, site/app, or offline data:

• Hash and secure customer data before upload
• Use only data that is collected and shared under proper notice/consent
• Segment by purpose, and avoid broad reuse
• Set retention and refresh rules for segments
• Ensure suppression lists are maintained for opted-out users

For third-party data:

• vet source provenance
• confirm consent chain and usage rights
• reject segments with unclear collection methods

5) Put human approvals around automation

Automation should not be fully hands-off.

Set approval steps for:

• new campaigns
• new data segments
• new inventory sources
• new creative formats
• geography expansion
• high-risk categories like news, UGC, political, alcohol, finance, or health

Create an escalation path for:

• unsafe placement findings
• policy violations
• anomalous performance spikes
• invalid traffic or fraud concerns

6) Monitor continuously

Brand safety and privacy compliance are ongoing, not one-time.

Track:

• where ads actually ran
• blocked vs. allowed placements
• brand safety violations
• viewability and IVT/fraud
• data source usage
• consent coverage by region
• vendor reports and discrepancy rates

Run regular audits:

• weekly placement reviews
• monthly vendor and segment reviews
• quarterly policy updates
• annual legal/compliance review

7) Maintain evidence

If regulators or clients ask, you need proof.

Keep records of:

• policy documents
• vendor due diligence
• consent and privacy notices
• campaign settings and exclusions
• placement reports
• incident logs and remediation
• DPAs, SCCs, and other data transfer documentation where relevant

8) Align legal, media, and security teams

Compliance works best when these teams coordinate:

• Legal/privacy: lawful basis, consent, data transfer, contracts
• Media: inventory strategy, exclusions, targeting logic
• Security/IT: access control, data handling, vendor security
• Brand team: suitable contexts, sensitive topics, reputational risk

9) Add safer defaults

If you want a simpler operating model, start with:

• contextual targeting over identity-based targeting
• private marketplace or curated deals over open exchange
• pre-bid brand safety blocking
• strict domain/app whitelists
• no sensitive-category audience targeting
• no third-party data unless clearly approved

10) Test before scaling

Before full launch:

• run a small pilot
• review actual placements manually
• test consent handling in different regions
• verify blocked categories are truly blocked
• compare DSP logs with verification vendor logs

---

A simple compliance checklist

Use this as a launch gate:

• Written brand safety policy approved
• Privacy/legal basis confirmed for all targeting data
• Consent signals working by region
• Approved DSP settings configured
• Brand safety vendor enabled
• Ads.txt/app-ads.txt and supply-path checks active
• Inventory/domain/app blocklists in place
• Sensitive categories excluded
• Data retention and suppression processes defined
• Vendor contracts and DPAs signed
• Monitoring and escalation process live
• Audit trail enabled

If you want, I can turn this into a DSP launch checklist, a policy template, or a risk-control matrix for your team.