Skip to end of metadata
Go to start of metadata

Index Exchange (IX) solutions promote trust and transparency in the digital advertising ecosystem by empowering the advertising industry to invest with confidence.

What is GDPR?

The General Data Protection Regulation (GDPR) is effective as of May 25, 2018. It replaces the existing Data Protection Directive (Directive 95/46/ EC) and seeks to substantially harmonize data privacy requirements across the European Economic Area (EEA). It gives Data Subjects (i.e. users) autonomy over their Personal Data: the right to know when their information is collected, how it’s used, and who it’s shared with. Furthermore, it provides Data Subjects with the right to access any information stored about them by corporations and request to have their Personal Data deleted or transferred. It’s all about increasing transparency and empowering the user.

In the digital world, the definition of Personal Data has expanded, and now includes any identifiers (pseudonyms or otherwise) that can lead to the identification of an individual. Personal Data is now considered any information that can identify a specific Data Subject, including (but not limited to):

  • IP address

  • Home address

  • Location data (e.g., location provided by a mobile phone)

  • Name (with surname)

  • Email address

  • Cookie ID

Who does this Affect?

GDPR affects everyone across the ad tech industry who offers goods/services to EEA Data Subjects (users) and/or monitors their behavior. This includes all publishers and buyers with properties available to EEA Data Subjects. 

By law, every player in the ad tech ecosystem is individually and jointly subject to GDPR and must adjust their current practices to comply with these regulations by May 25, 2018. This includes publishers, ad exchanges, advertisers and DSPs. Everyone who collects or processes Personal Data of European residents is affected.

The ad tech industry uses Personal Data to serve personalized advertisements. Our products are re-engineered to be consent-ready and to incorporate the new GDPR requirements. A key piece of the regulation is consent: consent must be explicit and not captured in a hidden fashion. At IX, we consider it incredibly important that publishers obtain consent and that buyers process it properly. Learn more about our stance on consent.


This content is provided for general information purposes only and does not constitute legal or other professional advice. Readers are advised to seek specific legal advice from their own legal counsel. Index Exchange does not warrant or guarantee the quality, accuracy, or completeness of any information in this document.


  • No labels