TripleLift

What is TripleLift

TripleLift is a US advertising technology company founded in 2012 in New York, specialising in native programmatic advertising. It uses computer vision and creative reshaping to transform standard ad creative into native, in feed, and out stream video formats that match the look and feel of publisher content. In 2020, Vista Equity Partners acquired a majority stake. The company also expanded into connected TV (CTV) advertising.

TripleLift integrates with publishers via Prebid.js, direct tags, or server side integrations. Bid requests are sent to demand side platforms in real time, and winning creatives are returned in the appropriate native, video, or display format.

What data does TripleLift process

Each bid request contains the visitor IP, User Agent, page URL, ad slot data, viewport, approximate geolocation, content categorisation, the user advertising identifier (tluid), and the TCF v2.2 consent string. Authenticated identifiers (UID 2.0, ID5, RampID) may be transmitted depending on the publisher configuration.

Cookies on triplelift.com: tluid (persistent advertising identifier, 1 year), tlsync (sync state), and several auxiliary cookies for partner mapping. All are third party cookies and require consent.

GDPR, ePrivacy and TCF v2.2

TripleLift is registered in the IAB Europe TCF v2.2 Global Vendor List. Publishers must transmit a valid TC string with the relevant purposes consented before loading TripleLift or sending bid requests.

The Belgian DPA decision on TCF and the CJEU ruling C 252/21 on legitimate interest both apply. Consent is the only safe Art. 6 GDPR basis for the advertising purposes powered by TripleLift, including in native and CTV contexts.

Native and CTV specific considerations

Native ads must be clearly labelled under the Digital Services Act (Art. 26 DSA) and consumer protection law. TripleLift native creatives should be tagged with a clear sponsored or advertising marker to avoid misleading the user.

CTV inventory introduces additional concerns: device level identifiers (IFA, Roku ID, etc.) can identify households rather than individuals, raising specific Art. 9 GDPR risks if the household is profiled around sensitive content (health, religion).

Data transfers and Schrems II

TripleLift LLC is a US controller. EU to US transfers rely on SCCs and the EU US Data Privacy Framework. A TIA is required, and supplementary measures (IP truncation, restricted property pushes) are recommended.

List TripleLift and its downstream DSP recipients in your privacy notice. The TCF v2.2 vendor list provides standard categories but does not absolve the publisher from its own disclosure obligation.

Practical compliance checklist

Register TripleLift in your TCF v2.2 CMP. Sign the TripleLift DPA. Defer triplelift.com calls until consent. Restrict your Prebid bidder list. Ensure clear native ad labelling under DSA. Document TripleLift in your privacy notice with US transfer details.

Implement Global Privacy Control handling. For sensitive content pages or vulnerable audience contexts, disable TripleLift loading entirely. Review the DPIA at least annually.