How do I ensure my header bidding integration with a supply-side platform is compliant?

To ensure your header bidding integration with a supply-side platform (SSP) is compliant, focus on privacy, consent, data-sharing, contracts, ad quality, and platform policy alignment. The exact requirements depend on your region, SSP, ad tech partners, and whether you operate a website, app, or CTV environment.

1) Map your data flow

Document:

• What user data is collected
• What identifiers are used (cookies, MAIDs, IP, user IDs)
• Which partners receive it
• Whether data leaves the EEA/UK/US states/other jurisdictions
• Whether any data is enriched, matched, or stored by the SSP or bidders

This is the foundation for compliance reviews.

2) Obtain valid consent where required

For users in regulated regions:

• Use a proper consent management platform (CMP)
• Ensure consent is captured before bidding starts, if required
• Pass consent signals to header bidding and SSPs correctly
• Respect opt-outs and withdrawal of consent

Common frameworks:

• GDPR/UK GDPR + ePrivacy in the EU/UK
• TCF v2.2 if your partners rely on it
• US state privacy laws where applicable, especially for “sale/share” or targeted advertising signals

3) Honor privacy choices and limitations

Make sure your integration:

• Stops or limits personalized ads when consent is absent
• Respects “Do Not Sell or Share” / opt-out signals
• Supports Global Privacy Control where applicable
• Suppresses data sharing for sensitive categories or minors as required

4) Use contracts and DPAs

Review and execute the right agreements:

• Data Processing Agreements (DPAs)
• Controller/processor terms
• Publisher/SSP agreements
• Standard Contractual Clauses (SCCs) or other transfer mechanisms if data moves internationally

Confirm:

• Who is controller vs. processor vs. independent controller
• Data retention limits
• Subprocessor disclosures
• Security obligations
• Breach notification duties
• Audit/right-to-review provisions

5) Minimize data shared in bid requests

Only send what’s necessary for monetization and measurement:

• Limit user IDs and demographic fields
• Avoid sending sensitive data
• Apply data minimization and purpose limitation
• Use floor rules and targeting controls to avoid over-sharing

6) Check the SSP and bidder policies

Each SSP and demand partner may have rules on:

• Allowed ad formats
• Viewability and fraud standards
• Brand safety
• Incentivized traffic
• Made-for-advertising content
• CTV/app tracking and identifiers
• Frequency capping and user matching

Violations can lead to account suspension or revenue clawbacks.

7) Ensure ad quality and anti-fraud controls

Implement:

• Bot/fraud detection
• Domain/app bundle verification
• Ads.txt / app-ads.txt / sellers.json / schain support
• Viewability and traffic-quality monitoring
• Disallowing invalid traffic or non-human traffic

8) Be careful with technical implementation

Common compliance mistakes:

• Firing bidder calls before consent is resolved
• Passing personal data without lawful basis
• Not propagating user opt-outs to all vendors
• Misconfiguring TCF/GPP strings
• Using unauthorized vendors or appending extra parameters
• Letting tags load from unapproved domains

Test in staging and production.

9) Keep transparent disclosures

Update:

• Privacy policy
• Cookie notice
• “Do Not Sell/Share” page if relevant
• Vendor lists and purposes
• Cookie/identifier descriptions

Explain:

• What ad tech you use
• Why data is processed
• How users can opt out
• How consent can be changed or withdrawn

10) Maintain records and monitoring

Set up:

• Integration logs for consent and privacy signals
• Vendor review process
• Periodic compliance audits
• Change management for new bidders/SSPs
• Incident response procedures

11) Get legal review for your specific setup

This area is highly jurisdiction-specific. Have counsel review:

• Your consent model
• Data transfer structure
• Ad tech contracts
• Cross-border data flows
• Whether you are subject to sector-specific rules, such as children’s privacy or health-related content

Practical checklist

Before going live:

• CMP configured correctly
• Consent captured before ad requests where required
• Privacy/opt-out signals passed to all partners
• Vendor list reviewed and approved
• Data processing terms signed
• Ads.txt / app-ads.txt / sellers.json / schain updated
• Personal data minimized in bid requests
• Fraud/brand safety controls enabled
• Privacy policy updated
• QA tests completed in real user scenarios

If you want, I can also give you:

1. a GDPR/TCF compliance checklist for header bidding,
2. a US privacy-law checklist, or
3. a technical implementation checklist for Prebid + SSPs.