Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
DoubleClick for Publishers (DFP), now part of Google Ad Manager, is the publisher side ad server that handles ad requests, auctions and rendering for European media. Through Google Publisher Tag it sets the IDE cookie on doubleclick.net, runs Open Bidding auctions and shares behavioural data with Google, which makes prior consent and a Google certified CMP mandatory under the GDPR and ePrivacy Directive.
DoubleClick for Publishers (DFP) is the publisher side ad server originally launched by DoubleClick and acquired by Google in 2008. In 2018 the product was rebranded as Google Ad Manager. DFP / Google Ad Manager handles direct sold campaigns, programmatic guaranteed deals and Open Bidding auctions for thousands of European media outlets. It is technically deployed via Google Publisher Tag (gpt.js) loaded from securepubads.g.doubleclick.net.
DFP relies on the IDE cookie set on doubleclick.net for behavioural targeting and frequency capping, the test_cookie before each request and the publisher side _gads and _gpi cookies. Open Bidding partners can also drop their own cookies through the auction. NID on google.com is used for cross device matching and personalised advertising.
DFP is a third party advertising stack. Article 5(3) ePrivacy requires prior consent before any cookie is read or written, and Article 6(1)(a) GDPR requires consent for the underlying behavioural advertising. The IAB TCF and the Belgian APD case have clarified that publishers acting as TCF participants are joint controllers with their adtech partners and must provide proper transparency.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Publishers monetising with Google Ad Manager must use a Google certified CMP and forward both the IAB TCF v2.2 string and the Google Additional Consent string for non TCF Google partners. If consent is refused, GAM can serve non personalised ads with the npa=1 parameter, but cookies must not be written without consent.
Ad requests, IP addresses, advertising identifiers and bid stream metadata are transferred to Google LLC in the United States. Google self certifies under the EU U.S. Data Privacy Framework, but the publisher remains responsible for documenting the transfer and informing visitors in the privacy policy.
Block GPT and DFP tags through your tag manager until consent. Use a Google certified CMP, propagate TCF v2.2 and Additional Consent, classify cookies in the banner with their real lifetime, and document the joint controller relationship with Google in your records of processing under Article 26 GDPR.
Websites using DoubleClick for Publishers (DFP) must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended because DFP processes large scale behavioural data, runs programmatic auctions involving many third parties, uses unique advertising identifiers and transfers data to the United States.
Sample consent text
We use Google Ad Manager (formerly DoubleClick for Publishers) to display ads on this site. With your consent, Google and its advertising partners may store advertising cookies on your device, build profiles of your interests and transfer data to Google LLC in the United States. You can refuse or withdraw your consent at any time from the cookie settings.
Third-party domains contacted
securepubads.g.doubleclick.netdoubleclick.netgoogletagservices.compagead2.googlesyndication.comadmanager.google.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| IDE | third_party | 13 months | Set on doubleclick.net by DFP / Google Ad Manager for behavioural targeting, frequency capping and conversion measurement. |
| test_cookie | third_party | 15 minutes | Set on doubleclick.net to verify that the browser supports cookies before serving an ad. |
| NID | third_party | 6 months | Set on google.com for ad personalisation and cross device matching. |
| gads | first_party | 13 months | Set on the publisher domain to deliver and measure ads served through Google Ad Manager. |
| gpi | first_party | 13 months | Set on the publisher domain to support ad personalisation and identify the user across pages. |
DoubleClick for Publishers (DFP) places tracking cookies for advertising — comply with GDPR using FlowConsent.
DFP / Google Ad Manager sets IDE on doubleclick.net for behavioural targeting, test_cookie before each request, NID on google.com for personalisation, and the publisher side _gads and _gpi cookies. Open Bidding partners can drop additional cookies during the auction.
Yes. DFP is a third party advertising stack that writes non essential cookies and shares behavioural data with Google and bidding partners, so prior, specific and informed consent is required under Article 5(3) ePrivacy and Article 6(1)(a) GDPR.
Consent is the only suitable legal basis. The processing is for cross site behavioural advertising and involves auctions with multiple US based partners, which require an opt in.
Yes. Ad requests, IP addresses, advertising identifiers and bid stream metadata are transferred to Google LLC in the United States under the EU U.S. Data Privacy Framework. The transfer must be disclosed in your privacy policy.
A DPIA is recommended given the scale of behavioural processing, the auctions with many third parties, the use of unique advertising identifiers and the US transfers. Joint controller arrangements with Google must also be assessed.
Block GPT and DFP through your tag manager until consent, use a Google certified CMP, propagate TCF v2.2 and Additional Consent, classify the cookies in the banner with their real lifetime, and document the joint controller relationship with Google.
Privacy friendlier publisher ad servers include Kevel, Revive Adserver, Smart AdServer (Equativ), or fully contextual setups that avoid behavioural cookies altogether. They typically offer less inventory liquidity than Google Ad Manager.
Add a section that names DoubleClick for Publishers / Google Ad Manager, lists the cookies (IDE, test_cookie, NID, _gads, _gpi) with purpose and duration, mentions Open Bidding partners and the transfer to Google LLC in the United States.