Oniad

Yes. ONiAD writes first-party measurement cookies, third-party advertising cookies, and similar identifiers used for cookie syncing with demand side and supply side partners. These identifiers are stored on the visitor device and used for cross site advertising and audience building, so ePrivacy Article 5(3) applies and consent is required before they are written or read.

Yes. ONiAD operates programmatic advertising and audience profiling through real time bidding, which the AEPD, CNIL, and EDPB consider non essential and dependent on consent. The platform must be loaded only after the visitor has accepted advertising and audience measurement purposes, and the IAB TCF v2.2 signal must reflect that choice and travel with each bid request.

Advertising, profiling, and audience building rely on Article 6(1)(a) GDPR consent. Some narrow purposes such as frequency capping or ad fraud detection can rely on Article 6(1)(f) legitimate interest if the controller has documented a balancing test. The AEPD cookie guidance and the EDPB direct marketing guidelines warn against using legitimate interest for personalised advertising at large scale.

Yes, regularly. Real time bidding integrates demand side platforms, supply side platforms, and verification vendors located in the United States, the United Kingdom, Israel, and Asia. Transfers must rely on Standard Contractual Clauses and, where applicable, the EU: US Data Privacy Framework. Controllers are expected to complete a transfer impact assessment and to limit the personal data sent in the bidstream as recommended by the EDPB.

Yes. The combination of large scale advertising profiling, real time bidding with multiple recipients, cross site tracking, and transfers outside the EEA matches several criteria from the EDPB DPIA guidelines and the Spanish AEPD list. Document the bidstream recipients, the categories of data, the consent and legitimate interest decisions, and the residual risk after mitigations.

Use a consent management platform certified within the IAB Europe Transparency and Consent Framework v2.2, configure it to refuse all advertising and audience purposes by default, and set ONiAD scripts to load only after consent. Make the refuse choice as accessible as the accept choice, and propagate the consent string to all downstream partners through the GVL TC string.

When consent is refused, switch ONiAD to a non personalised, contextual advertising mode that does not rely on identifiers from the visitor device. You can sell context based inventory by language, content category, and page metadata, use server side frequency capping based on aggregated counters, and avoid loading cookie syncing pixels. Reporting can be aggregated and identifier free.

List ONiAD as the controller of advertising profiling activities and describe the cookies it sets, their duration, and purpose. Provide a clear list of downstream partners, including the IAB TCF Global Vendor List entry, and describe the categories of data shared. Mention the legal basis, the use of Standard Contractual Clauses and the EU: US Data Privacy Framework, and the channels for exercising data subject rights.