Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Yahoo Advertising is Yahoo behavioural advertising stack, including Yahoo DSP and Yahoo Native, formerly Verizon Media DSP. It supports audience targeting, programmatic buying, and measurement across Yahoo properties and partner sites. It relies on advertising cookies and identifiers and processes data in the United States.
Yahoo Advertising is the advertising stack operated by Yahoo, comprising tools such as Yahoo DSP and Yahoo Native, which were formerly part of Verizon Media DSP. It lets advertisers reach audiences with behavioural targeting and programmatic buying across Yahoo owned properties and a wide network of partner sites. It also provides measurement and attribution to report on campaign performance.
Yahoo Advertising relies on advertising cookies and online identifiers to build audience profiles and to measure impressions and conversions. Cookies such as A1, A3, and B carry pseudonymous identifiers, while cookie sync mechanisms like IDSYNC match identifiers with partner platforms. This processing involves browsing behaviour, device data, and inferred interests, which are personal data under the GDPR.
Because it places non essential cookies and processes personal data for behavioural advertising, Yahoo Advertising requires consent under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) of the GDPR. Consent is typically gathered through the IAB Europe Transparency and Consent Framework, where Yahoo participates as a vendor. The high risk profile reflects extensive profiling, audience sharing, and international data flows.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Yahoo advertising tags must not load until the visitor has given specific, informed, and freely given consent for advertising and related purposes. A consent management platform that supports the IAB TCF should pass the appropriate consent signals to Yahoo as a registered vendor. Visitors must be able to refuse as easily as they accept, and you must honour withdrawal of consent.
Advertising data is processed in the United States and shared with advertising partners, so deploying Yahoo Advertising involves transfers of personal data to a third country. These transfers rely on Standard Contractual Clauses as the safeguard, supplemented where appropriate by additional measures. Controllers should review Yahoo transfer documentation and reflect these flows in their records and privacy notice.
Gate all Yahoo advertising tags behind a TCF compatible consent banner, configure prior blocking so nothing fires before consent, and list Yahoo and its purposes in your vendor disclosures. Document the US transfers and the Standard Contractual Clauses in your records of processing and privacy notice. Given the high risk, complete a data protection impact assessment before going live.
Websites using Yahoo Advertising must obtain user consent under GDPR regulations.
DPIA considerations
Yahoo Advertising is high risk and a DPIA is strongly recommended because it involves large scale behavioural profiling and cross site tracking. The assessment should address (1) the extent of profiling and audience building from browsing behaviour, device data, and inferred interests; (2) the sharing of identifiers with advertising partners through cookie syncing such as IDSYNC; (3) transfers of personal data to the United States and reliance on Standard Contractual Clauses with supplementary measures; (4) the validity of consent collected through the IAB Europe TCF, including granularity and the ease of refusal and withdrawal; and (5) prior blocking so no advertising tags fire before consent, together with data minimisation and retention limits.
Sample consent text
We use advertising cookies from Yahoo and partners to show you relevant ads and measure campaigns, which may involve transfers to the United States. Click Accept to allow advertising cookies or Reject to keep only essential ones. You can change your choice at any time.
Third-party domains contacted
yahoo.comads.yahoo.comadvertising.comadtech.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| A1 | Advertising | Up to 1 year | Stores a pseudonymous identifier used for behavioural ad targeting and frequency capping across Yahoo properties and partners. |
| A3 | Advertising | Up to 1 year | Holds an advertising identifier used to personalise ads and support audience targeting. |
| B | Advertising | Up to 1 year | Used for advertising and analytics, including ad delivery, measurement, and traffic analysis. |
| IDSYNC | Advertising | Up to 1 year | Synchronises Yahoo identifiers with partner advertising platforms to match audiences across services. |
Yahoo Advertising places tracking cookies for advertising — comply with GDPR using FlowConsent.
Yahoo Advertising sets advertising cookies that carry pseudonymous identifiers, including A1 and A3 used for targeting, B used for advertising and analytics, and IDSYNC used to sync identifiers with partner platforms. These cookies enable behavioural targeting and measurement across Yahoo properties and partners. They are non essential and require consent before being set.
Yes, Yahoo Advertising places non essential advertising cookies and profiles users, so it requires consent under ePrivacy Art. 5(3) and GDPR Art. 6(1)(a). The tags must not load before the visitor actively accepts advertising purposes. Consent is normally collected through a consent management platform that supports the IAB Europe TCF.
The legal basis is consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3), gathered through the IAB Europe TCF. Legitimate interest is not an adequate basis for behavioural advertising of this kind because of its intrusiveness and scale. Without valid consent, you cannot lawfully load the Yahoo advertising tags.
Yes, advertising data is processed in the United States and shared with advertising partners, so using Yahoo Advertising involves transfers of personal data to a third country. These transfers rely on Standard Contractual Clauses, supplemented where appropriate by additional safeguards. You should document these flows in your records of processing and disclose them in your privacy notice.
Yes, a DPIA is strongly recommended because Yahoo Advertising involves large scale behavioural profiling, cross site tracking, and transfers to the United States, which are high risk. The assessment should weigh the profiling, the sharing of identifiers with partners, the transfer safeguards, and the validity of TCF consent. It should also confirm prior blocking, data minimisation, and clear retention limits.
Deploy a TCF compatible consent management platform, gate all Yahoo tags so they only fire after consent, and register Yahoo and its purposes in your vendor list. Configure prior blocking so nothing loads beforehand, and pass the correct TCF consent string to Yahoo. Document the US transfers and Standard Contractual Clauses, and complete a DPIA before launch.
Alternatives include other demand side platforms and ad networks such as Google Display and Video 360, The Trade Desk, or Amazon DSP, all of which raise similar consent and transfer questions. Privacy friendlier options include contextual advertising that does not rely on behavioural profiling or cross site identifiers. The right choice depends on your risk appetite and reach requirements.
List the Yahoo advertising cookies such as A1, A3, B, and IDSYNC, with their purposes and durations, and classify them as advertising cookies requiring consent. Explain that data is processed in the United States and shared with partners under Standard Contractual Clauses. Link to Yahoo privacy resources and keep the policy aligned with the categories presented in your consent banner.