FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Advertising

Prebid

MarketingOfficial website

Prebid is an open source header bidding library managed by Prebid.org that runs in the visitor browser. It sends bid requests to many advertising demand partners and stores advertising identifiers in cookies and local storage. Because Prebid is only a wrapper, the actual data recipients are the bidders each publisher configures, so they must be documented case by case.

Block Prebid until consentScan my site
Overview

What does Prebid do?

What Prebid is

Prebid is an open source header bidding framework managed by Prebid.org that publishers add to their pages to run a real time auction for ad space. It executes client side in the visitor browser and is essentially a wrapper that orchestrates requests to many demand partners. Prebid itself does not decide who receives data; the publisher configures which bidders participate, so the recipient list varies from site to site.

Data and cookies involved

Prebid stores advertising user identifiers in cookies and in browser local storage, including a shared first party identifier and user id modules. During each auction it sends bid requests that can include identifiers, page context, device data, and approximate location to the configured demand partners. These partners, such as supply side platforms and exchanges, may also run their own cookie syncing.

GDPR and ePrivacy considerations

Header bidding involves storing identifiers in the browser and sharing personal data for advertising, which engages both the ePrivacy storage rule and the GDPR. The lawful basis is consent, and the configured bidders frequently act as independent or joint controllers for their own purposes. Because many partners are involved, transparency and a clear vendor list are essential.

Consent and the IAB TCF

Prebid supports the IAB Europe Transparency and Consent Framework, reading the consent string and passing it to bidders so they can honour the user choice. No advertising identifiers or bid requests should fire before valid consent is captured. Publishers should ensure their consent platform and vendor list match the bidders actually configured in Prebid.

International data transfers

Bid requests and identifiers are shared with numerous demand partners, many located outside the EEA including the United States. Each such transfer needs its own safeguard, typically Standard Contractual Clauses with supplementary measures. Because the partner set is publisher specific, the transfer mapping has to be maintained per configuration rather than assumed.

Practical compliance steps

Document the exact bidders configured, gate all auctions behind consent, and integrate a TCF compliant consent platform. Maintain a vendor and transfer list that matches your Prebid setup and review it whenever bidders change. Disclose header bidding clearly in your privacy and cookie notices and provide an easy way to withdraw consent.

Compliance

Prebid and the GDPR

Prebid is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (GDPR Art. 6(1)(a) and ePrivacy Art. 5(3)), signalled to bidders via the IAB Europe TCF
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, IAB Europe TCF v2.2

Impact assessment (DPIA)

A data protection impact assessment is strongly recommended because header bidding involves large scale sharing of advertising identifiers with many third parties. Key points to assess are (1) the full list of demand partners configured for the site, since Prebid is only a wrapper and recipients vary per publisher; (2) the categories of data in bid requests, including identifiers, device data, and approximate location; (3) the lawful basis, which is consent, and how the IAB TCF string is captured and passed to bidders; (4) international transfers to the United States and other third countries and the safeguards used for each partner; and (5) the controller relationships, as many bidders act for their own purposes, requiring clear allocation of responsibility.

Sample text for your banner

We work with advertising partners who use cookies and identifiers to show relevant ads and measure performance. These load only if you accept. You can change or withdraw your choice at any time.
Cookies and trackers

What Prebid sets and contacts

Tracking method
Client-side header bidding with advertising identifiers in cookies and local storage
Server location
Client-side library; bid requests are sent to globally distributed demand partners
Data transferred outside the EU
Bid requests and identifiers are shared with numerous demand partners, many outside the EEA including the United States; transfers rely on Standard Contractual Clauses.

Cookies set (4)

NameTypeDurationPurpose
_pubcidMarketing1 yearShared first party advertising identifier used to coordinate bidding across demand partners.
pbjs_useridMarketingPersistent (local storage)Local storage entries holding user id module values passed to bidders during the auction.
uidsMarketing1 yearBidder cookie sync cookie that matches identifiers between the page and a demand partner.
euconsent-v2Functional1 yearStores the IAB TCF consent string so that the user choice can be read and passed to bidders.

Third-party domains contacted (3)

  • cdn.jsdelivr.net
  • ib.adnxs.com
  • prebid.org
Questions

Frequently asked questions about Prebid

Can't find your question? Write to us, we answer fast.

What cookies and storage does Prebid set?

Prebid stores advertising identifiers in cookies and browser local storage, including a shared first party identifier and user id module values, plus a consent state entry. Configured bidders typically set their own cookie sync cookies as well. The exact set depends on which user id modules and bidders the publisher enables.

Is consent required for Prebid?

Yes, consent is required because Prebid stores advertising identifiers and shares personal data with partners for targeted advertising. No identifiers or bid requests should fire before the user opts in. Prebid reads the consent string and passes it to bidders so they can honour the choice.

What is the legal basis for Prebid?

The legal basis is consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3), signalled to bidders through the IAB Europe TCF. Legitimate interests is generally not appropriate for this kind of cross site advertising. The configured bidders often act as independent or joint controllers for their own processing.

Does Prebid transfer data to the United States?

Yes, because bid requests and identifiers are shared with many demand partners, a number of which are based in the United States and other third countries. Each transfer requires its own safeguard, typically Standard Contractual Clauses with supplementary measures. Since the partner set is publisher specific, you must map transfers against your own configured bidders.

Is a DPIA needed for Prebid?

A DPIA is strongly recommended because header bidding involves large scale sharing of advertising identifiers with many third parties. The assessment should list every configured bidder, since Prebid is only a wrapper and recipients vary per site. It should also cover the data in bid requests, consent capture, transfers, and controller roles.

How do we implement Prebid compliantly?

Integrate a TCF compliant consent platform and ensure no auction runs until consent is captured and passed to bidders. Document the exact bidders and user id modules you enable and keep a matching vendor and transfer list. Disclose header bidding in your privacy and cookie notices and review the configuration whenever partners change.

Are there alternatives to Prebid?

Alternatives include Google Open Bidding, Amazon Transparent Ad Marketplace, and other server side or managed header bidding solutions. Server side setups can reduce browser storage but still share data with partners. Whichever you choose, the same consent, transparency, and transfer duties apply because the underlying advertising data flows are similar.

How should we update our cookie policy?

Disclose that header bidding runs on your site and list the cookies and local storage Prebid uses, along with the configured bidders and their roles. Because the partner list varies, document it specifically for your setup rather than relying on a generic statement. State that advertising identifiers load only after consent and link to your vendor list.

Same category

More services: Advertising

See the whole category

Ezoic

Ezoic is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Ezoic provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Ezoic helps deliver the right message to the right audience at the right time.

Marketing

LiveRamp DPM

LiveRamp DPM is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. LiveRamp DPM supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, LiveRamp DPM enables organizations to unify their data infrastructure and drive informed decision making.

Marketing

Sortable

Sortable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Sortable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Sortable helps deliver the right message to the right audience at the right time.

Marketing

Bento

Bento is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bento enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bento empowers marketing teams to achieve measurable growth.

Marketing

Appcast

Appcast is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Appcast supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Appcast ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Upstack Data

Upstack Data is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. Upstack Data supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, Upstack Data enables organizations to unify their data infrastructure and drive informed decision making.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site