OpenX

What OpenX is

OpenX is a Supply Side Platform (SSP) and ad exchange, operated by OpenX Software Ltd. with headquarters in Pasadena California. Founded in 2008 and one of the largest independent SSPs in the world, OpenX runs server side real time auctions in which publishers expose their advertising inventory to demand side platforms (DSPs), agency trading desks and ad networks. Publishers integrate OpenX through Prebid.js header bidding wrappers, the OpenX RTB tag, or server side header bidding (Prebid Server). OpenX is registered as IAB Europe TCF v2.2 Vendor ID 69.

What data OpenX processes

For each ad request, OpenX receives the visitor's IP address, user agent, page URL, referrer, device type, viewport, time zone, language, the IAB TCF v2.2 consent string and any user IDs propagated by the publisher (Unified ID 2.0, ID5, LiveRamp ATS, etc.). OpenX writes cookies on the openx.net and op-mobile-ads.com domains including i (OpenX visitor ID, 1 year lifetime), mt_mop (multi touch frequency capping), OX_u (audience graph segments) and OX_sd (subdomain mapping). The full bid request payload is broadcast to dozens of demand side platforms simultaneously, expanding the personal data audience considerably.

GDPR and ePrivacy implications

Because OpenX writes persistent cookies and processes personal data for advertising, ePrivacy Art. 5(3) requires prior informed consent before the OpenX tag may run. Under the GDPR, consent under Art. 6(1)(a) is the appropriate basis. Publishers using OpenX must rely on a TCF v2.2 CMP that gates Vendor 69 behind the granted purposes, and they should configure the bidding workflow so that no bid requests are issued before consent. The Belgian APD ruling on IAB Europe TCF applies to OpenX by extension, and operators should follow the IAB Europe Action Plan compliance updates.

Cross site identity graph

OpenX maintains an audience graph that links the OpenX cookie ID with third party DSP and DMP identifiers, enabling cross site retargeting and audience extension. The graph is processed primarily on US infrastructure. EU publishers should treat this as a high risk processing activity, with the relevant transfer mechanism (DPF or SCCs) and a Schrems II Transfer Impact Assessment. Cookieless alternatives such as Google's Topics API and pure contextual targeting are gaining adoption but are not a default in OpenX.

Header bidding architecture choices

Client side header bidding via Prebid.js loads OpenX tags directly in the visitor's browser. Server side header bidding via Prebid Server moves the bid logic to the operator's backend, which reduces client side cookie reliance but does not eliminate the personal data sharing with OpenX (IP, page context, identifiers). Both modes require consent. Operators should pick the mode that best balances revenue, latency and privacy risk.

Practical compliance steps

Configure the publisher CMP so OpenX (TCF Vendor 69) fires only with the granted purposes. Sign the OpenX DPA and SCCs. Run a Transfer Impact Assessment addressing US CLOUD Act and FISA 702 exposure. Document OpenX in the record of processing, including the cookies, the bid request data, the legal basis and the transfer mechanism. List OpenX cookies in the cookie policy under marketing/advertising. Use server side header bidding if it fits the architecture, and consider gradually reducing reliance on user level identifiers in favour of contextual signals.