GDPR, ePrivacy, CCPA alignment

This page describes how AdPriva handles data today, as input to your own compliance review. It is not legal advice. For consent certificates, the processor terms, sub-processors and retention rules are on the Data-Processor Posture page.

What the tag collects

  • No cookies and no cross-site identifier.
  • A low-detail device snapshot (screen and viewport size, platform, colour depth). The server uses only the platform value, to classify the device type, and does not store the snapshot. It is not used to recognise a returning visitor.
  • Aggregate interaction counts (dwell time, scrolls, clicks, pointer speed), automation hints, the page path and the referrer, sent once per page load.
  • Never: keystrokes, form field values, absolute pointer positions.

What AdPriva keeps

  • The proof record: page URL, referrer, timestamps, validity score and verdict.
  • The IP address and user agent of each request. They are used for scoring and to derive a country, device class, browser and OS. The raw values are emptied after 30 days; hashes of both are kept.
  • The signals behind each verdict, emptied after 180 days.

The retention windows on this page are the current production settings.

What is published

The public Explorer and the public API show a proof’s opaque id, type, timestamps, status, Merkle data, validity score and verdict. They never show the publisher, site, page, IP address, user agent or a visitor reference. Only Merkle roots, which are hashes, are written to the blockchain.

GDPR

  • Data minimisation (Art. 5(1)(c)). The tag sends aggregates, not raw interaction streams. Consent certificates keep a hash of the consent wording, not the wording itself, and never the values typed into the form.
  • Storage limitation (Art. 5(1)(e)). Raw IP addresses and user agents are emptied after 30 days, and scoring signals after 180 days. Consent-certificate retention is described in Data-Processor Posture §4.
  • Access requests (Art. 15). Publishers can list the consent certificates filed under a person’s pseudonymous subject_ref. See Data-Processor Posture §6.
  • Integrity (Art. 32). Every proof is sealed with an HMAC, so AdPriva can detect a later change to its sealed fields. Each batch root is anchored on Horizen, so anyone can detect a proof being added to or dropped from an anchored batch. For consent certificates the root also covers the sealed content; for view proofs it does not cover the score or verdict.

ePrivacy

The tag sets no cookies. It reads page interaction and basic device properties to judge whether a visit is human. Publishers decide whether their use of the tag needs consent under the ePrivacy rules that apply to them. If it does, they can set the tag’s consent mode to tcf (it follows an IAB TCF v2 banner’s purpose 1 consent) or manual (the page grants and withdraws consent). The tag then sends nothing before consent and stops when consent is withdrawn. The one exception is opt-in per consent form: a form marked data-adpriva-record-without-consent is recorded without consent, holding only the hash of the consent wording, the Legal Bundle, the checkbox states, the page address and the time, with no behaviour or device signals. It is meant for the exemption for what is strictly necessary to prove the consent the publisher collects (record-only evidence). They can also load the tag only after consent is given.

CCPA

AdPriva does not sell visitor data. Traffic data is used to score and verify the publisher’s traffic, and pseudonymous copies are used to improve the scoring models.

Tools for your compliance file

← Previous Data-Processor Posture (DPA, retention, minimization) Next → Data Flows for your DPIA