Advally

What is Advally and how it works

Advally is a programmatic advertising platform that helps publishers optimise their ad inventory through header bidding, dynamic floor pricing, and yield management. When integrated on a website, Advally injects JavaScript that participates in real time bidding auctions, collects performance signals, and exchanges identifiers with demand side platforms. The result is higher fill rates and improved CPMs, but the technology depends on persistent identifiers and shared user data, which places it firmly inside the scope of the GDPR and the ePrivacy Directive.

Cookies and identifiers set by Advally

Advally relies on first party cookies that store a pseudonymous user identifier, session metadata, and bid history. It also reads and writes third party cookies belonging to its bidding partners, including Google Ad Manager, AppNexus (Xandr), and various supply side platforms. These identifiers are not strictly necessary for the website to function, so they require prior consent under Article 5(3) of the ePrivacy Directive and the case law of the European Court of Justice in Planet49.

Legal basis under the GDPR

Because Advally enables behavioural advertising, profiling, and onward sharing with bidders, the only realistic legal basis is the user's explicit, granular, freely given consent under Article 6(1)(a) of the GDPR. Legitimate interest is not appropriate because the European Data Protection Board has repeatedly stated that behavioural advertising and tracking cookies cannot rely on Art. 6(1)(f). You must obtain consent before the Advally script is loaded, document that consent, and provide an equally easy way to withdraw it.

International data transfers

Bid requests and impression data may be transmitted to demand side platforms hosted in the United States or other third countries. Advally relies on Standard Contractual Clauses and, where applicable, the EU, US Data Privacy Framework to legitimise these transfers. As a controller, you remain responsible for documenting the chain of recipients and informing users that their personal data, including IP address and identifiers, may leave the European Economic Area.

Consent management and IAB TCF v2.2

Advally supports the IAB Europe Transparency and Consent Framework (TCF) v2.2. To stay compliant you must integrate a registered Consent Management Platform (CMP), pass the TC string to Advally before any auction starts, and respect global opt out signals such as the Global Privacy Control. Without a valid TC signal, Advally and its partners must default to a no consent state and refrain from setting non essential cookies.

Practical compliance steps

Load the Advally tag only after a positive consent signal, declare every vendor activated through the platform in your cookie policy, keep an up to date record of consent for at least the duration of the cookies, and review the partner list every quarter. Pair Advally with a CMP that supports TCF v2.2, configure cookie expiration in line with the CNIL recommendation of thirteen months, and audit your site regularly with a tool such as Cookiebot scanner or the CNIL Cookieviz utility.