Microsoft Advertising (Bing Ads)

The UET tag sets MUID (Microsoft cross site identifier under bat.bing.com, 13 months), _uetsid (session identifier under your domain, 24 hours) and _uetvid (visitor identifier under your domain, 13 months). Microsoft properties also set MR and ANON cookies that link UET activity to the visitor Microsoft account.

Yes. The UET tag is an advertising cookie technology that European regulators (CNIL, DSK, AEPD, Garante) consider non strictly necessary. Prior, freely given, specific, informed and unambiguous consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR is required before it executes.

Consent under Article 6(1)(a) GDPR is the only lawful basis for storing the UET cookies and joining them with Microsoft account data. Legitimate interest does not apply because the processing involves cross site profiling and a third country transfer. Aggregated analytics from Microsoft Universal Event Tracking can not be re framed as legitimate interest after the fact.

Yes. Microsoft Corporation processes UET data on global Azure infrastructure with the United States as the primary region. Microsoft self certifies under the EU US Data Privacy Framework. Standard Contractual Clauses are also included in the Microsoft Products and Services DPA.

A DPIA is recommended whenever UET is used at scale for behavioural retargeting, audience network campaigns combining offline conversions with online identifiers, or when sensitive verticals (health, finance, minors) are involved. Document the profiling logic, the third country transfer and the consent flow.

Sign the Microsoft Products and Services DPA, document the US transfer, integrate Consent Mode v2, gate the UET tag behind a consent management platform, anonymise IP at server level where possible, use the Enhanced Conversions API to send hashed identifiers server side only after consent, and keep a consent log per visitor as accountability evidence.

For lower risk measurement you can run server side conversions through the Microsoft Advertising Conversion API without dropping browser cookies, use the offline conversions import for CRM matched conversions, or invest in EU based contextual networks (Outbrain Europe, Adform DSP) that rely less on cross site profiling.

Add a dedicated entry for the UET tag listing MUID, _uetsid and _uetvid with name, domain, duration and purpose. Disclose the third country transfer to the United States and the EU US Data Privacy Framework certification. Link to the Microsoft Privacy Statement and to the Microsoft Personalised Advertising opt out page.

The UET tag relies on first party cookies (_uetsid for session, _uetvid for visitor, 1 year) plus third party cookies from bing.com (MUID, MR, ANON, SRCHUSR). MUID is the global Microsoft user identifier shared across Microsoft services. The exact set varies depending on Consent Mode signals.

Yes. The UET tag is a third party advertising tracker that builds remarketing audiences and feeds conversions back to Microsoft. Both article 5(3) ePrivacy and article 6 GDPR require prior consent before the tag fires in identified mode.

Consent (article 6(1)(a) GDPR) and consent under article 5(3) ePrivacy for the cookie placement. Microsoft and the publisher are joint controllers for the audience and conversion measurement processing.

Microsoft Advertising data is processed on Azure infrastructure including US servers. Transfers rely on Microsoft EU Data Boundary commitments, EU SCCs and Microsoft DPF certification. Microsoft is certified under the EU US Data Privacy Framework.

A DPIA is recommended whenever you run large scale remarketing, enable enhanced conversions with hashed personal data, sync audiences across Microsoft Clarity and LinkedIn Ads, or advertise in sensitive verticals (health, finance, political content).

Block UET until consent. Use Consent Mode v2 to allow cookieless ping behaviour when ad_storage is denied. Disable enhanced conversions unless you have explicit consent to send hashed identifiers. Limit remarketing list duration. Sign the Microsoft Advertising joint controller agreement and the DPA.

For search advertising: Google Ads (with the same consent requirements), Qwant Search Ads, Ecosia, Yandex Ads (subject to Russia related restrictions). For display: AdRoll, Criteo (Paris based), RTB House (Warsaw based), Smartclip and StackAdapt. Direct deals with EU publishers also reduce the third party tracking footprint.

List the MUID, _uetsid, _uetvid, MR, ANON and SRCHUSR cookies with their domains, durations and purpose. In the privacy notice, identify Microsoft Corporation as joint controller, describe the audience targeting and conversion measurement, the US transfers and the safeguards (DPF, SCCs, EU Data Boundary). Link to the Microsoft privacy statement.