Bidmatic
Bidmatic is a header bidding wrapper and SSP that helps publishers monetise their inventory by connecting them to dozens of DSPs in real time. It places third party cookies on bidmatic.io and synchronises cookies with multiple ad partners, enabling cross site auctions and audience targeting. Because it relies on third party advertising cookies and cookie syncing, prior consent is mandatory under GDPR and the ePrivacy Directive in Europe.
What does Bidmatic do?
What is Bidmatic?
Bidmatic is a header bidding wrapper, supply side platform (SSP) and ad ops partner for publishers worldwide. It exposes publisher inventory simultaneously to dozens of DSPs and SSPs (Google AdX, Index Exchange, OpenX, Pubmatic, Magnite, Criteo) through Prebid or Bidmatic proprietary client and server side bidding. Publishers use Bidmatic to maximise programmatic yield with minimal latency.
Cookies and data collected
Bidmatic places third party cookies (bm_uid, bm_session) on bidmatic.io and triggers cookie syncing with each connected DSP or SSP, propagating pseudonymous identifiers across dozens of advertising domains. The wrapper sends bid requests including IP address, user agent, geolocation, page URL, page categories, IAB TCF consent string and audience segments where consented.
GDPR and ePrivacy implications
Header bidding is one of the most regulated advertising mechanisms under GDPR. The Belgian DPA APD ruled in 2022 that the IAB TCF was not GDPR compliant in its previous form, prompting TCF v2.2. Bidmatic must propagate a valid TC string for every bid request and respect signal in real time. Without consent, no bid request can be sent.
Consent requirements
Use a TCF v2.2 certified CMP, gate the Bidmatic wrapper behind consent for purposes 1, 2, 3, 4, 7, 9 and 10 and the relevant vendors. Configure the wrapper to send TCF strings in the OpenRTB bid request and propagate gdpr=1, gdpr_consent=<TC string> on cookie sync calls. The CMP must offer reject as easily as accept.
International data transfers
Bidmatic operates from the US with EU edge nodes and routes bid requests to global DSPs. Transfers rely on the EU US Data Privacy Framework where Bidmatic and partners are certified, and on SCCs as fallback. A Transfer Impact Assessment is recommended given exposure to US surveillance laws.
Practical compliance steps
Sign the Bidmatic DPA, register Bidmatic and its connected vendors in your record of processing, configure CMP for vendor list, gate the wrapper behind consent, monitor for bid requests fired without TC string and run a yearly DPIA review on cookie sync risks. Maintain a fallback path for users who refuse consent (contextual or no ad delivery).
Bidmatic and the GDPR
Bidmatic is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) is required for Bidmatic header bidding cookies, cookie syncing with DSPs and audience identifiers. Legitimate interest is not a valid basis.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, IAB TCF v2.2, EU US DPF, CCPA
Impact assessment (DPIA)
A DPIA is mandatory. Header bidding cookie syncing distributes pseudonymous identifiers to dozens of DSPs and SSPs, generating systematic large scale monitoring of behaviour under Article 35 GDPR.
Sample text for your banner
We use Bidmatic and partner ad networks to monetise our content. With your consent, this places third party cookies and shares pseudonymous identifiers with our advertising partners for personalised ads and frequency capping. You can manage your preferences in the cookie settings.
What Bidmatic sets and contacts
- Tracking method
- Header bidding wrapper and SSP, programmatic monetisation, third party cookies, cookie syncing with multiple DSPs, IAB TCF v2.2 vendor
- Server location
- United States with EU edge nodes (Bidmatic operates from Tortola, BVI / Delaware, USA with global ad infrastructure)
- Data transferred outside the EU
- Data is processed in the United States and other locations through Bidmatic SSP partners. Transfers rely on the EU US Data Privacy Framework when Bidmatic and partners are certified, and on SCCs as fallback.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| bm_uid | persistent | 12 months | Persistent third party identifier set by Bidmatic on bidmatic.io used for cross site auctions and cookie syncing with connected DSPs and SSPs. |
| bm_session | session | Session | Session level cookie tying ad auction context to the visitor browser while the Bidmatic wrapper is active on a page. |
| bm_cap | persistent | 6 months | Frequency capping cookie limiting how often a creative is delivered to the browser within a campaign window. |
Third-party domains contacted (4)
bidmatic.iocdn.bidmatic.iosync.bidmatic.iortb.bidmatic.io
Frequently asked questions about Bidmatic
Can't find your question? Write to us, we answer fast.
What cookies does Bidmatic set?
Bidmatic places persistent third party cookies on bidmatic.io (bm_uid, bm_session) and triggers cookie syncing with each DSP and SSP it connects to, propagating pseudonymous identifiers across many ad domains.
Does Bidmatic require GDPR consent?
Yes. Header bidding wrappers write non essential third party cookies and share identifiers with multiple advertising vendors. Article 5(3) ePrivacy and Article 6(1)(a) GDPR require prior, granular and informed consent.
What legal basis applies to Bidmatic?
Consent is the only valid basis for Bidmatic and the connected DSPs/SSPs. Legitimate interest is excluded for advertising cookies and cookie syncing per EDPB and CNIL guidance.
Does Bidmatic transfer data outside the EU?
Yes. Bidmatic operates from the US with EU edge nodes. Bid requests are routed globally to DSPs. Transfers rely on the EU US Data Privacy Framework when Bidmatic and partners are certified, and SCCs otherwise.
Do I need a DPIA for Bidmatic?
Yes. Header bidding distributes pseudonymous identifiers across dozens of vendors, qualifying as systematic large scale monitoring of behaviour under Article 35 GDPR.
How do I implement Bidmatic compliantly?
Use a TCF v2.2 certified CMP, gate the wrapper on consent for relevant purposes and vendors, propagate the TC string in OpenRTB requests and cookie sync calls, sign the Bidmatic DPA, document vendors in your record of processing.
Are there alternatives to Bidmatic?
Alternatives include Prebid.js (open source, deployable on EU servers), Magnite, Pubmatic, OpenX, AdNuntius (NO), Smart AdServer (FR). EU based wrappers reduce US transfer exposure.
How do I update my cookie policy for Bidmatic?
List Bidmatic as a header bidding processor, name cookies bm_uid and bm_session, retention up to 12 months, IAB TCF vendor reference, list of connected DSPs/SSPs, US data residency, EU US DPF and SCC reference, and link to the Bidmatic privacy policy.
ADFOX
ADFOX is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ADFOX enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ADFOX empowers marketing teams to achieve measurable growth.
ContextBar
ContextBar is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ContextBar integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ContextBar helps organizations maintain robust websites that meet user expectations and technical requirements.
Aniview Video Ad Player
Aniview Video Ad Player is a video hosting and streaming platform that helps businesses deliver high-quality video content to their audiences. It provides adaptive bitrate streaming, customizable players, and content management tools. Aniview Video Ad Player supports live streaming, on-demand playback, and video analytics. With CDN-powered delivery and responsive embeds, Aniview Video Ad Player ensures smooth playback across all devices and network conditions for engaging video experiences.
eBay Partner Network
eBay Partner Network is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. eBay Partner Network supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, eBay Partner Network ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
DTScout
DTScout is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. DTScout enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, DTScout empowers marketing teams to achieve measurable growth.
Streamlyne
Streamlyne is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Streamlyne enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Streamlyne empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.