DoubleClick Ad Exchange (AdX)

What is DoubleClick Ad Exchange (AdX)

DoubleClick Ad Exchange (AdX) is Google's premium programmatic advertising marketplace, now operated as part of Google Ad Manager (GAM). It is the supply side ad exchange where publishers expose their inventory to thousands of advertisers, demand side platforms (DSPs) and agency trading desks through real time bidding auctions. Each ad impression is auctioned in milliseconds while the page loads, and the winning advertiser's creative is served to the user. AdX is distinct from the legacy DoubleClick for Publishers (DFP) ad server and from the umbrella DoubleClick brand.

Cookies and identifiers used by AdX

AdX relies on third party advertising cookies set on doubleclick.net. The IDE cookie (about 13 months) is the main advertising identifier used to measure ad performance, cap frequency and personalize creatives. The id cookie performs similar functions on doubleclick.net. test_cookie (15 minutes) checks whether the browser accepts cookies. 1P_JAR is a Google cross product cookie linking activity for ad measurement. DSID associates browsing activity with a signed in Google account on non Google sites. Bid requests also transmit IP address, approximate location, device, user agent and TCF consent strings to participating bidders.

GDPR and ePrivacy obligations

Because AdX uses profiling cookies and builds cross site audience segments, the publisher must obtain prior, freely given, specific, informed and unambiguous consent under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) GDPR before any AdX tag fires. Legitimate interest is not a valid basis for advertising cookies or personalized advertising. The publisher and Google operate as joint controllers for certain processing under the Google Ad Manager terms, which requires a joint controller arrangement under Article 26 GDPR and transparent information to users.

International data transfers

Personal data is transferred to Google LLC in the United States. Google is certified under the EU US Data Privacy Framework (DPF), which constitutes a valid transfer mechanism for EU and UK personal data. For jurisdictions outside DPF coverage, Standard Contractual Clauses and a Transfer Impact Assessment apply. RTB bid requests can also reach bidders located in third countries, which requires additional contractual safeguards and disclosure in the privacy notice.

IAB TCF v2.2 and Google Consent Mode v2

Google Ad Manager and AdX integrate with the IAB Transparency and Consent Framework v2.2 and require Google Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization, analytics_storage). Publishers must deploy a Google certified CMP, pass a valid TC string to ad calls, and forward consent state through gtag or GTM. Without explicit consent, AdX falls back to non personalized advertising (NPA) where available, but many advanced features such as remarketing and audience targeting are disabled.

Risks and mitigations

Key risks include unlawful processing without valid consent (significant CNIL and EU regulator fines), bid stream data leakage to unvetted bidders, profiling of minors, and inadequate transparency. Mitigations include a robust CMP, strict tag gating until consent is captured, a documented DPIA, joint controller agreements with Google, transparent disclosure in the cookie policy, granular purpose level consent, regular vendor audits and consideration of contextual or server side alternatives for non consenting traffic.