Beeswax

Beeswax sets a third party cookie named bee that holds a pseudonymous user identifier with a typical lifetime of 13 months. It also writes shorter lived cookies for cookie syncing with partner SSPs. On mobile in app inventory, Beeswax reads device advertising identifiers (IDFA, AAID) instead of cookies. The full list of identifiers and durations is available in the Beeswax documentation and can be audited with browser developer tools.

Yes. Beeswax pixels and cookie sync calls store and read identifiers on the user device, which falls within Article 5(3) of the ePrivacy Directive. The 2022 IAB Europe decision also makes the bid stream itself a personal data flow. Prior, free, specific, informed and unambiguous consent must be obtained, signalled to Beeswax through a valid IAB TCF v2.2 TC string, before any pixel fires.

The legal basis is consent under Article 6(1)(a) GDPR. Legitimate interest cannot be relied on for advertising and audience targeting in this context, as confirmed by multiple supervisory authorities and by the Belgian DPA decision against IAB Europe. The consent must be granular per purpose and per vendor, and recorded in a TC string passed to Beeswax through the OpenRTB protocol.

Yes. Beeswax is a Comcast company headquartered in New York and processes bid stream data on US infrastructure. Transfers rely on the EU US Data Privacy Framework when applicable, otherwise on Standard Contractual Clauses combined with a Transfer Impact Assessment that addresses the risk of US government access requests under FISA 702 and Executive Order 12333.

Yes. The processing scores high on multiple criteria from the European Data Protection Board guidelines on DPIA: large scale processing, systematic monitoring through cross site tracking, automated decision making in bid logic, profiling and international transfers. A DPIA is therefore required under Article 35 GDPR.

Block all Beeswax tags by default, integrate a CMP certified for IAB TCF v2.2, route the TC string in every OpenRTB request, sign a Data Processing Agreement and SCCs with Beeswax, restrict purposes and vendors in your CMP configuration, document everything in your record of processing activities and your privacy notice, and set up a process for handling data subject requests forwarded by Beeswax.

Contextual DSPs that target page content rather than user identifiers, EU based programmatic platforms that keep data within the EEA, or direct deals with publishers using server side data clean rooms. These options reduce the dependence on third party cookies, on cross site tracking and on US transfers, lowering the GDPR risk profile.

List the bee cookie and the cookie syncing identifiers in your cookie table with provider, purpose and retention. Mention the role of the IAB TCF and the bid stream, the transfer to the United States and the legal mechanism. Increment the version of the cookie policy and trigger a fresh consent prompt for existing visitors so that previously stored consent is renewed against the new processing.