Tapsell

What Tapsell is

Tapsell is the leading mobile advertising network in Iran, headquartered in Tehran. It offers publishers and advertisers an SDK for Android and iOS, plus web placements, that serve banner, interstitial, native, video and rewarded formats. Tapsell handles auctioning, targeting and conversion tracking through its own platform, and is widely used inside Iran where Google AdMob and Meta Audience Network have limited availability. For European publishers, the relevance is mainly when their app or site reaches Iranian users or when they integrate Tapsell to monetise that audience.

Data and identifiers it processes

The Tapsell SDK reads the Google Advertising ID on Android, the Apple Identifier for Advertisers on iOS where allowed by App Tracking Transparency, and a Tapsell internal device identifier. It also collects model, operating system, locale, carrier, screen size, language, IP address, coarse geolocation, app package name and a stream of impression and click events. On the web, Tapsell sets first and third party cookies for attribution and retargeting and may receive a hashed user identifier from the publisher.

GDPR and ePrivacy implications

Advertising identifiers and IP addresses are personal data, so Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive apply. The processing aims at personalised advertising, which the EDPB and most regulators treat as requiring opt in consent that is informed, specific and freely given. Profiling and the absence of a legitimate interest balance for targeted ads make consent the only realistic legal basis, alongside compliance with the Apple ATT and Google Privacy Sandbox rules.

Transfers to Iran and Schrems II

Iran is not covered by an adequacy decision and is not part of the EU US Data Privacy Framework. Standard Contractual Clauses are difficult to enforce and Iranian law allows broad governmental access. The most defensible transfer ground for EU data is Article 49(1)(a) GDPR explicit consent, used only for occasional and clearly explained transfers, combined with strong supplementary measures such as data minimisation, pseudonymisation and contractual restrictions. For most EU publishers, the safer option is to disable Tapsell for European traffic.

Consent and configuration in the EU

If Tapsell is loaded for any EU or UK user, block the SDK and any web tag until consent is given through your CMP under the advertising and personalisation purposes. The notice must clearly mention Iran as the destination country, the absence of adequacy and the use of explicit consent under Article 49. Provide an easy refusal and withdrawal path that immediately stops all SDK calls and clears related cookies. Keep auditable logs of the consent string and the country of the user.

Practical compliance steps

Document Tapsell as a separate processor in your records, including transfer to Iran, the categories of data, the retention applied by Tapsell, and the legal basis. List Tapsell cookies and identifiers in your cookie policy, expose Tapsell as a recipient in the privacy notice and add a country specific warning. Implement geofencing so the SDK only initialises for non EU traffic where possible, and re prompt users when the data flow or sub processors change.