Question 1

What cookies does MGID set?

Accepted Answer

MGID sets a primary persistent tracking cookie (commonly named mgid or a hashed variant) on the mgid.com domain with a lifetime of up to 13 months, storing a pseudonymous user identifier. Additional cookies manage session tracking, frequency capping (counting how many times a user sees a specific ad) and click-through attribution. Cookie-matching pixels may also set short-lived cookies on third-party domains during user-identifier synchronisation with data partners. All these cookies require prior consent under the ePrivacy Directive.

Question 2

Is consent required to load MGID widgets?

Accepted Answer

Yes, explicit consent is required before any MGID JavaScript or pixel loads. MGID sets tracking cookies and processes personal data for behavioural profiling and targeted advertising, both of which require prior informed consent under ePrivacy Directive Article 5(3) and GDPR Article 6(1)(a). Legitimate interest is not a valid legal basis for cross-site behavioural advertising. The MGID widget must be technically blocked until a valid IAB TCF v2.2 consent string confirming the user's consent for MGID's purposes is received.

Question 3

What legal basis applies to MGID processing?

Accepted Answer

The only permissible legal basis is consent under GDPR Article 6(1)(a) and ePrivacy Directive Article 5(3). MGID builds cross-site behavioural profiles and delivers targeted native advertising, which the EDPB has confirmed cannot rely on legitimate interest. Consent must be freely given (not pre-ticked), specific to MGID's purposes (at minimum Purposes 1, 2, 3, 4 and 7 in the IAB TCF framework), informed and documented. Publishers should collect consent via a TCF v2.2-certified CMP with MGID listed as a vendor.

Question 4

Does MGID transfer data to the United States?

Accepted Answer

Yes. MGID Inc. is incorporated in Delaware, USA, and processes personal data on US infrastructure in addition to EU nodes. Data may also be shared with US-based advertising technology partners during cookie synchronisation. Transfers from the EEA to the US are conducted under Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). Publishers must disclose these transfers to users in their privacy notices before collecting consent, and the DPIA must assess the adequacy of the transfer safeguards in place.

Question 5

Do we need a DPIA before deploying MGID?

Accepted Answer

Yes. MGID conducts systematic large-scale behavioural profiling across multiple publisher sites, which triggers the mandatory DPIA requirement under GDPR Article 35(3)(b). The DPIA must address the scope of cross-site tracking, cookie-matching with third-party data providers, the US transfer of personal data, the absence of a cookieless alternative, data retention periods, and user rights. The DPO must approve the DPIA before go-live and update it whenever MGID changes its data processing scope or partner list.

Question 6

How do we deploy MGID compliantly?

Accepted Answer

Compliant deployment requires: using a TCF v2.2-certified CMP with MGID listed as a vendor, with full purpose disclosures for Purposes 1, 2, 3, 4 and 7; technically blocking the MGID tag until a valid consent string is received (use a tag manager or consent wrapper); completing a DPIA approved by the DPO; updating the privacy policy and cookie notice to describe MGID cookies and US data transfers; implementing a functional consent withdrawal mechanism; and maintaining records of processing activities for MGID operations.

Question 7

What are the alternatives to MGID native advertising?

Accepted Answer

Contextual advertising networks (which target based on page content rather than user behaviour) do not require consent and are fully GDPR-compliant. In-house content recommendation systems that do not track users across sites avoid the cross-site profiling risk entirely. If native advertising revenue is essential, publishers can consider alternative TCF-registered networks with stricter data minimisation policies. Any replacement should be evaluated for its own GDPR compliance posture before deployment.

Question 8

How should we update our cookie policy for MGID?

Accepted Answer

The cookie policy must include a dedicated MGID section describing: the cookie name (mgid or equivalent) and its domain (mgid.com), the 13-month duration, the purpose (cross-site behavioural profiling and native ad targeting), the controller (MGID Inc., USA), the fact that data is transferred to the US and shared with advertising partners, and the user's right to withdraw consent. The policy must be live before MGID is deployed and updated within 30 days of any material change to MGID's data processing terms.

Name	Type	Duration	Purpose
mgid	persistent	13 months	Primary pseudonymous user identifier used by MGID for cross-site behavioural profiling, native ad targeting and frequency capping
mgid_sess	session	Session	Session-level tracking cookie used by MGID to attribute page views and clicks within a single browsing session
mgid_ab	persistent	30 days	A/B test allocation and ad variant selection cookie used by MGID to route traffic between content recommendation algorithm variants
mgiduid	persistent	13 months	User identifier cookie written during cookie-matching synchronisation with third-party demand and data partners on jsc.mgid.com
mgid_fc	persistent	30 days	Frequency capping counter cookie recording how many times a user has been shown a specific advertiser campaign within the MGID network

MGID Native Advertising

What does MGID Native Advertising do?

What Is MGID and How Does It Track Users

Data and Cookies Collected by MGID

GDPR and ePrivacy Implications

Consent Requirements Under IAB TCF v2.2

International Data Transfers

Practical Compliance Steps for Publishers