PubMatic

What is PubMatic

PubMatic is a publicly traded independent SSP founded in 2006 and headquartered in Redwood City, California, with major engineering and operations teams in Pune, India. It powers programmatic auctions for thousands of publishers across display, video, mobile, and CTV, and offers the OpenWrap open source header bidding wrapper.

On publisher websites, PubMatic is typically integrated via Prebid.js, OpenWrap, or direct integration. Once loaded, it sends OpenRTB bid requests to demand side platforms and returns winning creative for ad rendering.

What data does PubMatic process

Each bid request includes the IP, User Agent, page URL, ad slot data, viewport, approximate geolocation, the user advertising identifier (KADUSERCOOKIE), and the TCF v2.2 consent string. Audience segments, content categories, and authenticated user IDs (UID 2.0, LiveRamp ID, ID5) may also be transmitted.

Cookies set by PubMatic on pubmatic.com: KADUSERCOOKIE (persistent advertising identifier, 30 days), PugT (sync state, 30 days), KRTBCOOKIE_* (per buyer mapping cookies), KTPCACOOKIE (preferences). All are third party cookies and shared across the PubMatic partner network.

GDPR, ePrivacy and TCF v2.2

PubMatic is registered in the IAB Europe TCF v2.2 Global Vendor List. Publishers must transmit a valid TC string with the required purposes consented. Without consent for the relevant purposes, PubMatic must not be loaded or sent bid requests.

The Belgian DPA decision on TCF and the CJEU ruling C 252/21 on legitimate interest both apply. Consent is the only defensible Art. 6 GDPR basis for the advertising activation purposes powered by PubMatic.

Data transfers and Schrems II

PubMatic Inc. is a US controller, certified under the EU US Data Privacy Framework. SCCs apply where DPF is not sufficient. India based engineering teams may access data under additional intra group agreements. A Transfer Impact Assessment by the publisher is required and should document the chain from PubMatic to downstream DSPs.

List PubMatic and its downstream DSP recipients in your privacy notice. The TCF v2.2 framework provides standard categories but the publisher remains responsible for the disclosure.

DPIA and audience considerations

A DPIA is generally required given the systematic large scale monitoring. It must address audience categorisation (Art. 9 GDPR content exclusions), the OpenRTB fan out, vendor list management, retention, and Art. 22 GDPR implications for automated bidding decisions.

Recent DPA enforcement places clear responsibility on the publisher for the full programmatic chain, not just for the immediate processor.

Practical compliance checklist

Register PubMatic in your TCF v2.2 CMP. Sign the PubMatic DPA. Defer pubmatic.com requests until explicit consent. Audit your Prebid / OpenWrap configuration to restrict bidders. Document PubMatic in your privacy notice with purposes, lifetimes, and US transfer information.

Implement Global Privacy Control handling, configure ad slot level consent, and review the DPIA annually. For sensitive content categories, exclude PubMatic loading entirely on those pages.