Sovrn

What is Sovrn

Sovrn is an independent advertising and content technology platform headquartered in Boulder, Colorado. Founded in 2014 from the merger of Lijit Networks, Federated Media, and ad.ly, it now serves more than 60,000 publishers. Sovrn provides three core products: //Ad Management (header bidding and SSP), //Commerce (affiliate link rewriting, formerly VigLink) and //Data (audience and measurement).

On publisher websites, Sovrn is integrated through Prebid.js, the Sovrn Beacon (sovrn.js) or via the //Commerce script. Once loaded, it participates in OpenRTB auctions and may rewrite outbound product links to include commerce affiliate parameters.

What data does Sovrn process

On the SSP side, bid requests include IP, User Agent, page URL, ad slot data, viewport, approximate geolocation, advertising identifier (ljt_reader on lijit.com), and the TCF v2.2 consent string. On the //Commerce side, every outbound link click is logged for affiliate tracking with HTTP referrer and target URL.

Cookies on sovrn.com and lijit.com: ljt_reader (visitor ID, 1 year), uid (cookie sync, 1 year). The Sovrn //Commerce script also stores click data temporarily in localStorage.

GDPR, ePrivacy and TCF v2.2

Sovrn is registered in the IAB Europe TCF v2.2 Global Vendor List for the advertising component. The //Commerce component is not strictly an advertising vendor but it does rewrite links and capture clicks, which qualifies as Art. 5(3) ePrivacy processing in many EU jurisdictions and requires consent.

The Belgian DPA TCF decision and CJEU ruling C 252/21 apply. Consent is the only safe Art. 6 GDPR basis for the SSP and audience purposes.

Data transfers and Schrems II

Sovrn Inc. is a US controller, processing data primarily on US infrastructure under SCCs and the EU US Data Privacy Framework. A Transfer Impact Assessment is required, and the //Commerce affiliate link processing must be documented as a separate purpose with its own legal basis.

List Sovrn and its downstream DSP recipients in your privacy notice. //Commerce partner brands receiving click data should also be disclosed.

DPIA and dual purpose considerations

A DPIA is required for any non trivial Sovrn deployment, covering both advertising (SSP) and commerce (link rewriting) purposes. Document audience categorisation, retention, sub processors, US transfers, and the dual use of cookies across both products.

Recent DPA enforcement places clear responsibility on the publisher for the full chain, including affiliate networks like Sovrn //Commerce.

Practical compliance checklist

Register Sovrn in your TCF v2.2 CMP. Sign the Sovrn DPA covering both //Ad Management and //Commerce. Defer the sovrn.com and lijit.com calls until consent. If using //Commerce, present it as a separate consent purpose distinct from advertising.

Audit your Prebid bidder list. Document Sovrn in your privacy notice with both purposes and the US transfer chain. Implement Global Privacy Control. Review the DPIA at least annually.