How do I ensure my OOH campaign measurement with a measurement platform is compliant?

To make OOH campaign measurement compliant, focus on privacy-by-design, vendor due diligence, and data minimization. Here’s a practical checklist:

1) Define the data you actually need

• Use the minimum data necessary to measure reach, frequency, impressions, visits, or attribution.
• Prefer aggregated, anonymized, or pseudonymized data over raw device or person-level data.
• Avoid collecting sensitive personal data unless you have a clear legal basis and explicit consent where required.

2) Check the legal basis for measurement

Depending on where you operate, ensure you have a valid lawful basis under applicable privacy laws:

• Consent where required, especially for tracking technologies or precise location data in some jurisdictions.
• Legitimate interest may be possible in some cases, but requires balancing and documentation.
• Make sure the basis aligns with how the platform collects and uses data.

3) Review how the platform collects data

Ask the measurement vendor:

• What data sources are used?
• Is data collected via mobile SDKs, apps, cookies, GPS, Wi-Fi, Bluetooth, or partner data?
• Is location data precise or coarse?
• Is data de-identified before you receive it?
• Can individuals opt out?

If the platform uses mobile location data, it’s especially important to confirm:

• Proper consent is obtained by the original app/data source
• Data is not repurposed beyond what users agreed to
• Data is not shared in a way that could re-identify people

4) Put the right contracts in place

You may need:

• A Data Processing Agreement (DPA)
• Controller/processor terms clarified
• Standard Contractual Clauses (SCCs) or other transfer mechanisms if data crosses borders
• Restrictions on vendor use of data for their own purposes
• Security and deletion commitments

5) Conduct a privacy impact assessment

For campaigns involving location or behavioral data, perform a:

• DPIA / PIA to assess risks
• Document necessity, proportionality, retention, and safeguards
• Confirm whether your campaign triggers special regulatory obligations

6) Be transparent

Update or confirm:

• Your privacy notice
• Any consent language on your site/app
• Ad-tech disclosures about measurement partners
• Opt-out mechanisms where applicable

7) Limit retention and downstream sharing

• Set clear data retention periods
• Ensure measurement data is deleted or aggregated when no longer needed
• Restrict sharing with third parties unless they’re contractually bound and legally permitted

8) Verify security

Require:

• Encryption in transit and at rest
• Access controls and logging
• Incident response and breach notification procedures
• Regular security reviews or certifications if relevant

9) Check regional rules

Compliance varies by region. For example:

• EU/UK: GDPR, ePrivacy rules, data transfer restrictions
• US: state privacy laws (e.g., California CPRA), location data restrictions, consumer opt-out rights
• Other regions: local marketing, telecom, and data protection laws may apply

10) Document everything

Keep records of:

• Vendor assessments
• Legal basis decisions
• DPIA/PIA outcomes
• Consent/opt-out flows
• Data maps and retention policies

Quick vendor questions to ask

1. What exact data do you collect and from where?
2. Do you use precise location data?
3. How do you obtain user consent?
4. Is the data shared with any subcontractors or partners?
5. Can data be linked back to an individual device or person?
6. What retention/deletion policies do you follow?
7. What regions is the data stored or processed in?
8. Can you support DSARs, opt-outs, and deletion requests?

If you want, I can turn this into a one-page compliance checklist for your team or tailor it to GDPR, UK, or US state privacy laws.