Rubicon Project

What Rubicon Project / Magnite is

Rubicon Project was founded in 2007 and was one of the original independent Supply Side Platforms. In 2020 it merged with Telaria, a connected TV ad platform, to form Magnite Inc. (NASDAQ: MGNI). In 2021 Magnite acquired SpotX and CTV start up SpringServe, becoming the largest independent SSP for CTV and a major player across display, video and audio inventory. Publishers integrate Magnite through Prebid.js header bidding adapters, the Magnite/Rubicon RTB tag, or server side header bidding. Magnite is registered as IAB Europe TCF v2.2 Vendor ID 52.

What data Rubicon/Magnite processes

For each ad request, Magnite receives the visitor's IP address, user agent, page URL, referrer, device type, viewport, time zone, language, the IAB TCF v2.2 consent string and any user IDs propagated by the publisher. Magnite writes cookies including khaos, rpb (Rubicon Project broker), rpx (Rubicon Project exchange), ruids (Rubicon user ID) and put_ on the rubiconproject.com domain, with lifetimes typically of 1 year. For CTV inventory, Magnite also processes smart TV device IDs (Roku, Samsung, LG) and IP addresses associated with the household.

GDPR and ePrivacy implications

Because Rubicon/Magnite writes persistent cookies and processes personal data for advertising, ePrivacy Art. 5(3) requires prior informed consent before the Magnite tag may run. Under the GDPR, consent under Art. 6(1)(a) is the appropriate basis. Publishers using Magnite must rely on a TCF v2.2 CMP that gates Vendor 52 behind the granted purposes. The Belgian APD ruling on IAB Europe TCF applies to Magnite by extension.

CTV and household level identifiers

With its CTV inventory, Magnite processes smart TV device IDs (TIFA on tvOS, Roku Advertising ID, Samsung TIFA), household IP addresses and viewing context. This is a sensitive data combination because it can be linked back to physical households and to family members rather than individual users. EU regulators (in particular Spain's AEPD and Germany's DSK) have flagged CTV tracking as a high risk processing area. A DPIA is strongly recommended for any publisher monetising CTV inventory through Magnite.

Cross site identity and unified IDs

Magnite supports the major post cookie identity solutions: Unified ID 2.0 (The Trade Desk), ID5, LiveRamp ATS, Adform ID Fusion and Magnite's own Magnite Universal ID. These IDs are propagated alongside the bid request and joined on the Magnite servers, enabling cross site reach as third party cookies disappear. Each unified ID has its own consent and transfer profile, which the publisher must document.

Practical compliance steps

Configure the publisher CMP so Magnite (TCF Vendor 52) fires only with granted purposes. Sign the Magnite DPA and SCCs. Run a Transfer Impact Assessment addressing US CLOUD Act and FISA 702 exposure. Document Magnite in the record of processing including the bid request data, the CTV identifiers if applicable, the legal basis and the transfer mechanism. List Magnite cookies in the cookie policy under marketing/advertising. For CTV inventory, run a DPIA covering household level processing.