Advertising networks, adtech and analytics vendors

• Regulation (EU) 2016/679 — GDPR, Article 27
• Directive 2002/58/EC — ePrivacy
• Regulation (EU) 2022/2065 — DSA advertising transparency
• Regulation (EU) 2019/1150 for platform intermediation

Who has to appoint one

Adtech vendors, analytics providers and SDK operators established outside the Union that process data about people in the Union. Most are controllers for their own purposes even when publishers call them processors, and that determination decides who needs a representative and who bears the accountability.

Thresholds and exemptions

No threshold. Processing pseudonymous identifiers at scale is precisely the large-scale monitoring Article 3(2) targets, and the Article 27(2) exemption cannot apply.

What must appear on the label

Publisher-facing and user-facing transparency: the representative's identity in the privacy notice, the purposes and the legal bases, the retention periods and the vendor list. Under the DSA, advertising must be identifiable as such with the advertiser named and the main profiling parameters disclosed.

Marketplace fields

Publishers demand contractual clarity on controller or processor status, and consent management platforms will not integrate vendors that cannot supply the required disclosures. Enforcement against the real-time bidding ecosystem has come from both regulators and litigation.

Documentation you must hold

Article 30 records mapping every data flow. The Article 27 designation. Legal basis analysis per purpose, since consent obtained by a publisher must actually cover your purposes and be transmitted to you. Data protection impact assessment. Standard contractual clauses and transfer impact assessments. Joint controller arrangements under Article 26 where responsibilities are shared with publishers.

Standards and testing

Not applicable, but traffic analysis is how enforcement begins: regulators and NGOs examine whether identifiers are transmitted before consent and whether the consent signal matches the actual processing.

Language requirements

Transparency information in the language of the users whose data is processed.

When it applies

The representative before processing begins. Consent must precede any read or write on the device, and a bid request containing an identifier sent before consent is already an infringement.

How long records are kept

Records for the life of the processing. Bid request data retention is a recurring finding, since data kept for analytics beyond the auction rarely has a documented basis.

What happens if you do not comply

Up to €20 million or 4% of turnover for unlawful processing, and €10 million or 2% for the missing representative. National ePrivacy fines are imposed separately and do not require proof of harm. This sector has produced some of the largest and most systemic enforcement decisions in the Union.

Who enforces it

Data protection authorities across the Union, since a controller without an EU establishment has no lead authority, and consumer protection authorities for dark patterns in consent interfaces.

Where the boundary lies

The controller-processor question is decisive and cannot be settled by contract wording alone: a vendor that determines purposes such as audience building or model training is a controller regardless of how the agreement is titled. Special-category inferences — health, sexuality, political views — drawn from browsing behaviour attract Article 9 obligations that consent for advertising does not satisfy.

Questions we are asked

Our publisher collects consent — is that enough for us?

Only if the consent genuinely covers your purposes, names you, and is transmitted to you before processing. Relying on a publisher's generic banner has repeatedly failed in enforcement.

Are pseudonymous identifiers personal data?

Yes. Cookie IDs, advertising IDs and hashed emails identify individuals for GDPR purposes, and treating them as anonymous is the most common structural error in this sector.