AdRoll

The AdRoll pixel sets __adroll (first party identifier under the advertiser domain, 1 year), __ar_v4 (cross site identifier under d.adroll.com, 1 year), roundtrip (campaign measurement cookie, 1 year) and various sync cookies (xuid, NID) when AdRoll synchronises with third party DSPs.

Yes. The AdRoll pixel performs cross site behavioural profiling and is explicitly out of scope of the strictly necessary exemption. The CNIL, DSK, AEPD and Garante all require prior, freely given, specific, informed and unambiguous consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR.

Consent under Article 6(1)(a) GDPR is the only lawful basis for AdRoll pixel processing. NextRoll Inc. is a joint controller with the advertiser for certain audience activities, requiring an Article 26 GDPR joint controller arrangement that allocates responsibilities and transparency duties.

Yes. NextRoll Inc. is based in the United States and processes pixel events on Amazon Web Services and Google Cloud Platform US regions. NextRoll self certifies under the EU US Data Privacy Framework. Standard Contractual Clauses are included in the NextRoll DPA as an additional safeguard.

A DPIA is recommended whenever AdRoll is used at scale for behavioural retargeting, audience extension, cross device tracking or campaigns targeting sensitive verticals. Document the profiling logic, the IAB TCF supply path, the US transfer and the consent collection mechanism.

Sign the NextRoll DPA, conclude the Article 26 joint controller arrangement, register a TCF certified consent management platform, gate the AdRoll pixel behind the consent string, anonymise IPs where possible, document the US transfer, and provide a public privacy notice that links to the NextRoll Privacy Notice and the AdRoll opt out page.

Alternatives include EU based DSPs (Adform, RTB House Europe, M6 Publicite for video), contextual networks (Seedtag, Outbrain Europe) that rely less on cookies, and first party retargeting via Meta and Google Ads connected through your own consent gated pixels. Server side conversions APIs can also reduce the cookie footprint.

Add a dedicated AdRoll section listing __adroll, __ar_v4, roundtrip and the sync cookies with name, domain, duration and purpose. Disclose the joint controllership with NextRoll Inc., the third country transfer to the United States and the EU US Data Privacy Framework certification, and link to the NextRoll Privacy Notice and the AdRoll opt out page.

AdRoll drops third party cookies on adroll.com: __adroll (visitor ID), __adroll_fpc (fallback first party), __ar_v4 (audience segments, 1 year), __asc (session) and __auc (initial user creation, 1 year). It can also drop helper cookies for ITP workarounds.

Yes. AdRoll is a third party advertising cookie that builds cross site behavioural profiles. Both article 5(3) ePrivacy and article 6 GDPR require prior, opt in consent before loading the AdRoll pixel.

Consent (article 6(1)(a) GDPR). Legitimate interest does not work for cross site behavioural advertising, as confirmed by the EDPB and the CNIL.

NextRoll Inc. is based in the US and runs AdRoll on US AWS infrastructure. Transfers rely on the NextRoll DPA, EU Standard Contractual Clauses and the EU US Data Privacy Framework when NextRoll is DPF certified.

A DPIA is recommended whenever AdRoll is the central retargeting tool, when audiences sync with multiple DSPs and SSPs, when custom audiences contain personal data uploaded from a CRM, or when targeting sensitive verticals.

Block the AdRoll pixel inside your CMP. Forward the IAB TCF v2.2 string. Limit retargeting list retention. Avoid uploading sensitive personal data into custom audiences. Honour opt out via the AdRoll opt out endpoint and via the IAB TCF user signal.

Criteo (Paris, EU based), RTB House (Warsaw), Smartclip, Outbrain Onyx, Taboola, StackAdapt (with EU data residency option), or pure first party retargeting via Meta Conversions API and Google Ads Customer Match limited to consenting users.

List the AdRoll cookies with their domains, durations and purposes. Identify NextRoll Inc. as joint controller in the privacy notice. Describe the US transfers and the safeguards (DPF, EU SCCs). Provide links to the NextRoll privacy notice and to the AdRoll opt out page.