How do I ensure my header bidding integration with a supply-side platform is compliant?

To keep a header bidding integration with a supply-side platform (SSP) compliant, focus on privacy, user consent, contractual terms, and technical implementation. Here’s a practical checklist:

1) Confirm legal/privacy requirements

Make sure your setup complies with applicable laws and frameworks, such as:

• GDPR / UK GDPR
• ePrivacy / cookie consent rules
• CCPA/CPRA
• Any local privacy or ad-tech regulations that apply to your traffic

Key point: many header bidding setups involve sharing data with multiple vendors, so you need a clear legal basis for doing so.

2) Use a proper Consent Management Platform (CMP)

If you serve users in regions with consent requirements:

• Implement a CMP that supports the relevant frameworks, especially IAB TCF 2.2 for GDPR regions
• Ensure bidding calls are gated on consent signals
• Pass consent strings correctly to the SSP and demand partners
• Respect user opt-out/Do Not Sell/Share signals where applicable

3) Minimize data sharing

Only send the data needed for the auction:

• Avoid transmitting unnecessary personal data
• Use publisher-level controls for sensitive categories if relevant
• Confirm whether the SSP acts as a processor/service provider or independent controller, and adjust data handling accordingly

4) Review contracts and vendor terms

Check:

• Your publisher agreement with the SSP
• Any data processing agreement (DPA)
• Required data protection addenda
• Restrictions on bidstream data usage, retention, and onward sharing

Make sure the SSP contract matches your actual implementation.

5) Verify bidder and vendor disclosures

Your privacy policy and consent notices should disclose:

• That you use header bidding / real-time bidding
• Categories of data collected/shared
• Categories of vendors receiving data
• How users can exercise rights or opt out

6) Control cookie and identifier usage

Ensure:

• Cookies/local storage are not dropped before consent when required
• Any IDs used in bidding are covered by consent or another lawful basis
• Retargeting or audience-matching partners are properly disclosed and configured

7) Set up geo-based behavior

Use regional logic to:

• Show consent banners in required jurisdictions
• Restrict or delay bidding until consent in those regions
• Apply state-specific opt-out handling in the U.S.

8) Audit the actual network traffic

Don’t rely only on documentation:

• Inspect bid requests in dev tools or logs
• Confirm no prohibited fields are sent
• Check that consent strings, opt-outs, and publisher restrictions are being honored
• Validate that third-party scripts are not firing prematurely

9) Maintain security and access controls

• Secure APIs and keys
• Limit who can change bidder settings
• Keep records of changes and vendor approvals

10) Document everything

Keep evidence of:

• CMP configuration
• Consent logic
• Vendor contracts
• Data maps
• Testing and QA results
• Compliance reviews

Common pitfalls

• Triggering bids before consent is collected
• Sending too much user/device data in bid requests
• Missing vendor disclosure in privacy notices
• Using an SSP configuration that conflicts with your contract
• Failing to honor opt-outs or “Do Not Sell/Share” signals

Best practice

Have both:

1. Legal review of privacy notices, consent flows, and contracts
2. Technical QA of the actual auction calls and data flow

If you want, I can give you a compliance checklist for GDPR/TCF 2.2 or a technical header bidding audit template.