Index Exchange

What is Index Exchange

Index Exchange is one of the largest independent supply side platforms (SSPs) in programmatic advertising. Headquartered in Toronto, Canada, it was founded in 2003 (originally as Casale Media), which is why its cookies still live on the casalemedia.com domain. It serves thousands of publishers worldwide and processes hundreds of billions of bid requests per day.

On publisher websites, Index Exchange is typically integrated via Prebid.js or via a direct tag. Once loaded, it sends bid requests through OpenRTB to demand side platforms and returns winning creative for ad rendering.

What data does Index Exchange process

Each bid request includes the IP address, User Agent, page URL, page metadata, approximate geolocation, viewport size, ad slot information, the user advertising identifier (CMID), and the TCF v2.2 consent string. Audience segment IDs, content categories, and authenticated user identifiers (UID 2.0, ID5, RampID) may also be transmitted depending on the publisher configuration.

Cookies on casalemedia.com are: CMID (persistent advertising identifier, 1 year), CMPS (sync state, 30 days), CMPRO (preferences, 1 year), CMRUM (real user monitoring). All are third party cookies and are used across the network of Index Exchange partners.

GDPR, ePrivacy and TCF v2.2

Index Exchange is registered in the IAB Europe TCF v2.2 Global Vendor List. Publishers must transmit a valid TC string with consented purposes 1 to 4 and 7 to 10. Without these purposes consented, Index Exchange must not be loaded or sent bid requests.

The Belgian DPA decision against IAB Europe and the CJEU ruling C 252/21 against legitimate interest for behavioural advertising both apply. Consent is the only safe basis for the audience targeting purposes powered by Index Exchange.

Data transfers, Canada adequacy and US flows

Index Exchange Inc. is a Canadian controller. Canada has a partial EU adequacy decision (PIPEDA, 2001), so EU to Canada transfers do not require additional safeguards for commercial entities covered by PIPEDA. However, Index Exchange routinely sends bid stream data to US based DSPs and partners, which then triggers SCCs and a Transfer Impact Assessment.

List Index Exchange and its downstream DSP recipients in your privacy notice. The TCF v2.2 vendor list helps but is not a substitute for a publisher specific record.

DPIA and audience considerations

A DPIA is generally required given the systematic monitoring and large scale profiling. It must address the audience categorisation (special category content under Art. 9 GDPR), the OpenRTB fan out, vendor list governance, retention, and any automated decisions triggered by bid outcomes (Art. 22 GDPR).

Recent enforcement and supervisory authority guidance (CNIL, ICO, AEPD) place clear responsibility on the publisher for the full chain, not only for the immediate processor.

Practical compliance checklist

Register Index Exchange in your TCF v2.2 CMP. Sign the Index Exchange DPA. Defer casalemedia.com requests until explicit consent. Audit your Prebid configuration to restrict bidders. Document Index Exchange in your privacy notice, including the Canada and US transfer chain.

Implement Global Privacy Control handling and ad slot level consent in Prebid. Exclude Index Exchange entirely on sensitive content pages. Review the configuration and the DPIA at least annually.