Yahoo Advertising

Yahoo Advertising sets advertising cookies that carry pseudonymous identifiers, including A1 and A3 used for targeting, B used for advertising and analytics, and IDSYNC used to sync identifiers with partner platforms. These cookies enable behavioural targeting and measurement across Yahoo properties and partners. They are non essential and require consent before being set.

Yes, Yahoo Advertising places non essential advertising cookies and profiles users, so it requires consent under ePrivacy Art. 5(3) and GDPR Art. 6(1)(a). The tags must not load before the visitor actively accepts advertising purposes. Consent is normally collected through a consent management platform that supports the IAB Europe TCF.

The legal basis is consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3), gathered through the IAB Europe TCF. Legitimate interest is not an adequate basis for behavioural advertising of this kind because of its intrusiveness and scale. Without valid consent, you cannot lawfully load the Yahoo advertising tags.

Yes, advertising data is processed in the United States and shared with advertising partners, so using Yahoo Advertising involves transfers of personal data to a third country. These transfers rely on Standard Contractual Clauses, supplemented where appropriate by additional safeguards. You should document these flows in your records of processing and disclose them in your privacy notice.

Yes, a DPIA is strongly recommended because Yahoo Advertising involves large scale behavioural profiling, cross site tracking, and transfers to the United States, which are high risk. The assessment should weigh the profiling, the sharing of identifiers with partners, the transfer safeguards, and the validity of TCF consent. It should also confirm prior blocking, data minimisation, and clear retention limits.

Deploy a TCF compatible consent management platform, gate all Yahoo tags so they only fire after consent, and register Yahoo and its purposes in your vendor list. Configure prior blocking so nothing loads beforehand, and pass the correct TCF consent string to Yahoo. Document the US transfers and Standard Contractual Clauses, and complete a DPIA before launch.

Alternatives include other demand side platforms and ad networks such as Google Display and Video 360, The Trade Desk, or Amazon DSP, all of which raise similar consent and transfer questions. Privacy friendlier options include contextual advertising that does not rely on behavioural profiling or cross site identifiers. The right choice depends on your risk appetite and reach requirements.

List the Yahoo advertising cookies such as A1, A3, B, and IDSYNC, with their purposes and durations, and classify them as advertising cookies requiring consent. Explain that data is processed in the United States and shared with partners under Standard Contractual Clauses. Link to Yahoo privacy resources and keep the policy aligned with the categories presented in your consent banner.