Section 12 Glossary

A/B Testing: An experiment to assess the impact of two (or even more) different versions of a system, such as a website or an app.

Adblocker: Refers to software programs, often browser extensions, that users can use to block ads.

Ad Impression: Displaying an online ad once on a publisher’s property, such as a website or an app. The number of ad impressions refers to how often an online ad was shown.

Ad Exchange: A marketplace where advertisers or demand-side platforms purchase the opportunity to show ad impressions to users from publishers or supply-side platforms.

Ad Inventory: The collection of ad slots of a publisher at a specific point in time.

Ad Server: Web server (i.e., a computer) that stores advertising content (e.g., banner ads) and sends the specific ad for display to the publisher’s property.

Ad Slot: A specific space on a publisher’s property, such as a website or an app, where an ad appears. The ad slot has characteristics, such as the size of the ad or the location on the publisher’s property.

Advanced Data Protection Control (ADPC): A tool initiated by NOYB that considers user privacy preferences and reduces the annoyance of repetitive cookie banners.

Advertiser: A firm that advertises an offering. Ad Wastage: Ads shown to consumers who are not interested in the offer to which the ad refers.

Anonymous Data: Any data that neither directly nor indirectly identify natural persons.

Application Programming Interface (API): A connection that enables computer programs to exchange information.

Audience: A collection of consumers that share a particular characteristic such as a demographic, interest, or purchase intention.

Attribution Modeling: The process of assessing which ads (or marketing actions) contributed how much toward a specific goal (e.g., purchasing an offering).

Behavioral targeting: Using information about the users’ behavior (e.g., their previous browsing behavior) to show specific ads. In an extreme setting, each user would see a different ad.

Bid Request: The call of the seller in an auction to potential buyers to place a bid. The ad exchange usually asks advertisers to place a bid for purchasing one ad impression in online advertising.

Browser Extension: A software extension for a browser providing additional functionalities to the user, such as “Ghostery,” which represents an adblocker.

California Consumer Privacy Act (CCPA): The privacy law applicable to California became effective on January 1st, 2020.

Click-Through Rate: The number of times users click on an ad divided by the number of ad impressions, i.e., the number of times the advertiser showed the ad. The click-through rate describes the share of users who clicked on an ad.

Consent: Under the GDPR, it is one of the two most common legal bases for personal data processing for online advertising. It describes the active permission of a user that the firm can process personal data. Loosely speaking, it represents a user’s opt-in for personal data processing.

Consent Log: A list of all decisions of user permission decisions regarding the processing of personal data.

Consent Management Platform (CMP): An actor of the online advertising market that helps publishers to collect users’ permission for personal data processing activities.

Consent Rate: The number of times users consented to personal data processing divided by the number of times users consent to or deny personal data processing. So, it is the share of users providing consent. The consent rate can differ across platforms, websites, and apps.

Consumer Privacy: The degree of users’ control over their data and personal data processing. Contextual Targeting: The approach to show consumers ads based upon the context of the publisher’s property they currently visit.

Cookies: A small piece of data sent from a server to a browser and stored in the browser on the user’s device.

Cookie Banner: A pop-up display on a publisher’s property that informs the users about personal data processing activities and asks for permission for personal data processing.

Cookie Banner Layer: A cookie banner might consist of one or more layers. The user sees the first layer immediately but must make one or more clicks to see the second or other layers. Usually, the first layer provides fewer details than the other layers.

Cookie Paywalls: A publisher forcing a user to choose between (i) providing permission for personal data processing or (ii) paying for not providing permission for personal data processing.

Data Breach: A situation where non-authorized entities have access to (personal) data.

Data Controller: A term under the GDPR that describes a firm that decides why and how to process personal data.

Data Processor: A term under the GDPR that describes a firm that processes personal data on behalf of the data controller.

Data Protection Authority (DPA): Independent public authorities supervising the application of the data protection law through investigative and corrective powers.

Data Management Platform (DMP): An actor of the online advertising market that supports the collection, storage, and usage of data.

Demand-side Platform (DSP): An actor of the online advertising market that helps advertisers to purchase ad impressions on ad exchanges.

Digital Fingerprinting: The process of identifying a user based on the specific configuration of the user’s device.

Digital Markets Act (DMA): A proposal of the European Union aiming to ensure competition in European digital markets.

Digital Services Act (DSA): A proposal of the European Union aiming to enhance, among others, the transparency of online advertising and to avoid illegal consent and disinformation.

Display Advertising: A graphical ad on a publisher’s property, such as a website or an app.

Feature: A term under the Transparency and Consent Framework (TCF) that refers to the means (e.g., “Link different devices” to determine that two or more devices belong to the same user) to reach a specific goal.

First-party Data: The kind of data a firm collects on its property, such as a website or an app.

Frequency Capping: An approach to limit the number of times a specific user sees the same ad.

General Data Protection Regulation (GDPR): A privacy law of the European Union applicable to all European firms and all firms processing personal data of European citizens adopted on May 25, 2016, and enacted on May 25, 2018.

Global Vendor List (GVL): A term under the Transparency and Consent Framework (TCF) that describes the list of vendors participating in the Transparency and Consent Framework (TCF).

Interactive Advertising Bureau (IAB): An association of digital marketing and advertising firms. Interactive Advertising Bureau Europe refers to the European part of the association.

ID: A unique combination of letters or numbers that identify an entity such as a user or a cookie.

Legal Basis: Under the GDPR, it describes the legal argument for an activity processing personal data.

Legitimate Interest: Under the GDPR, it is one of the two most common legal bases for personal data processing for online advertising. It weighs the firm’s interest in personal data processing against the user’s interest in not processing it. Loosely speaking, it represents the user’s opt-out approach for personal data processing.

Legitimate Interest Assessment (LIA): The assessment between a firm’s interest in personal data processing and a user’s interest in not processing it.

Local Storage: Storage in the user’s browser.

None Of Your Business (NOYB): A non-profit organization aiming to enforce user rights on the internet.

Opt-in: Refers to a proactive decision of the user to provide consent for personal data processing.

Opt-out: Refers to a proactive decision of the user to not provide consent for personal data processing.

Personal Data: Refers to any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Piggyback Tracker: A tracker that hides within another tracker, aiming to track consumers across the internet.

Premium Publisher: A publisher with a property, such as a website or an app, that has a good brand reputation, thus offering an attractive space to show ads.

Personal Data Processing: Refers to any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal Information Management Services (PIMS): A software automatically detecting and responding to data requests, such as consent requests. In such a case, the user of the software only needs to provide the user’s privacy preferences once in the PIMS and update it if the privacy preferences of the user change. Such an update then automatically notifies and updates all other actors that process the user’s data.

Profiling: Often, actors of the online advertising industry use the data collected about a user (e.g., the browsing behavior) to derive insights into the user’s demographics, interests, and purchase intentions. This process is called profiling.

Programmatic Advertising: The automatic selling of an ad impression. It often refers to the publisher selling one ad impression in real-time in an auction to an advertiser. It is also referred to as real-time bidding (RTB), real-time advertising (RTA), or programmatic buying.

Pseudonymous Data: Data that does not directly but indirectly identify natural persons.

Publisher: The owner of the property on the internet, which users visit. In the advertising context, the publisher represents the seller of the space where users see ads.

Publisher Restriction: A term under the Transparency and Consent Framework (TCF) that describes the publisher’s decision upon the purpose and the legal basis for processing personal data. It restricts the vendor’s choice of a purpose or a legal basis.

PUR Model: Another label for “Cookie Paywalls,” see Cookie Paywalls

Purpose of Personal Data Processing: The goal of personal data processing (e.g., “Create a personalized ads profile” to profile users) that the data controller aims to achieve via a specific feature or means.

Purpose Specification: Refers to the process of identifying legitimate purposes for personal data processing and specifying these purposes in a clear (explicit) manner.

Real-time Bidding: Another label for “Programmatic Advertising.” See Programmatic Advertising.

Recency Capping: An approach to only show a user the same ad again if a minimum amount of time has passed.

Retargeting: Also referred to as remarketing or behavioral retargeting. It uses information about the previous behavior of the user to target the user with an ad that is specific to the previous behavior. For example, retargeting reminds a user of a product that the user put into the shopping basket but did not purchase.

Search Engine Ads: Ads that occur on search engines such as Google or Bing.

Second-party Data: The kind of data a firm receives from another firm that belongs to the same owner.

Special Feature: A term under the Transparency and Consent Framework (TCF) that describes a more privacy intrusive feature that a firm can only use if the user provides consent.

Special Purpose: A term under the Transparency and Consent Framework (TCF) that describes a technically necessary purpose so that a firm can serve ads.

Stack: A term under the Transparency and Consent Framework (TCF) that describes the grouping of (Special) Purposes and (Special) Features to decrease the number of user decisions for personal data processing.

Supervising Authority: An authority that oversees the compliance of firms with privacy laws such as the GDPR. Supply-side Platform (SSP): An actor of the online advertising market that publishers use to sell the opportunity to show ad impressions via ad exchanges.

Targeting: The process of showing ads to a group of users that fulfill specific criteria.

Third-party Data: The kind of data a firm receives from another firm that does not belong to the same owner.

Tracking: The process of collecting data about users. Tracking-Free Ads Coalition: An association of European politicians, citizens, and firms aiming to end tracking on the internet.

Transparency and Consent Framework (TCF): An industry initiative developed by IAB Europe assisting firms in addressing the challenges of getting and managing user permission for personal data processing.

TCF Purpose: A term under the Transparency and Consent Framework (TCF) that describes the pre-defined goals of personal data processing.

TC String: A term under the Transparency and Consent Framework (TCF) that describes how to store the user’s consent decision. Verification Provider: An actor of the online advertising industry that verifies that an ad appears on the correct publisher’s property, such as a particular website or app.

Vendor: A term under the Transparency and Consent Framework (TCF) that describes an actor of the online advertising industry. Usually, these actors provide technologies to either advertisers or publishers.