Vendors can: Store and access information on the device such as cookies and device identifier presented to a user.

Amazon Web Service (AWS)

Local Authorities (Council)

National Crime Agency (NSA)

His Majesty Revenue Customs (HMRC)

Client Money Protection Regulator (CMPR)

Property Ombudsman Scheme

Financial institutions

Payment Merchant

To do basic ad selection vendors can: Use real-time information about the context in which the ad will be shown, to show the ad, including information about the content and the device, such as: device type and capabilities, user agent, URL, IP address. Use a user’s non-precise geolocation data. Control the frequency of ads shown to a user. Sequence the order in which ads are shown to a user. Prevent an ad from serving in an unsuitable editorial (brand-unsafe) context Vendors cannot: Create a personalised ads profile using this information for the selection of future ads without a separate legal basis to create a personalised ads profile. N.B. Non-precise means only an approximate location involving at least a radius of 500 meters is permitted.

To create a personalised ads profile vendors can: Collect information about a user, including a user's activity, interests, demographic information, or location, to create or edit a user profile for use in personalised advertising. Combine this information with other information previously collected, including from across websites and apps, to create or edit a user profile for use in personalised advertising.

To select personalised ads vendors can: Select personalised ads based on a user profile or other historical user data, including a user’s prior activity, interests, visits to sites or apps, location, or demographic information.

To create a personalised content profile vendors can: Collect information about a user, including a user's activity, interests, visits to sites or apps, demographic information, or location, to create or edit a user profile for personalising content. Combine this information with other information previously collected, including from across websites and apps, to create or edit a user profile for use in personalising content.

To select personalised content vendors can: Select personalised content based on a user profile or other historical user data, including a user’s prior activity, interests, visits to sites or apps, location, or demographic information.

To measure ad performance vendors can: Measure whether and how ads were delivered to and interacted with by a user. Provide reporting about ads including their effectiveness and performance. Provide reporting about users who interacted with ads using data observed during the user's interaction with that ad. Provide reporting to publishers about the ads displayed on their property. Measure whether an ad is serving in a suitable editorial environment (brand-safe) context. Determine the percentage of the ad that had the opportunity to be seen and the duration of that opportunity. Combine this information with other information previously collected, including from across websites and apps Vendors cannot: Apply panel- or similarly derived audience insights data to ad measurement data without a Legal Basis to apply market research to generate audience insights.

To measure content performance vendors can: Measure and report on how content was delivered to and interacted with by users. Provide reporting, using directly measurable or known information, about users who interacted with the content. Combine this information with other information previously collected, including from across websites and apps. Vendors cannot: Measure whether and how ads (including native ads) were delivered to and interacted with by a user. Apply panel- or similarly derived audience insights data to ad measurement data without a Legal Basis to apply market research to generate audience insights

To apply market research to generate audience insights vendors can: Provide aggregate reporting to advertisers or their representatives about the audiences reached by their ads, through panel-based and similarly derived insights. Provide aggregate reporting to publishers about the audiences that were served or interacted with content and/or ads on their property by applying panel-based and similarly derived insights. Associate offline data with an online user for the purposes of market research to generate audience insights if vendors have declared to match and combine offline data sources. Combine this information with other information previously collected including from across websites and apps. Vendors cannot: Measure the performance and effectiveness of ads that a specific user was served or interacted with, without a Legal Basis to measure ad performance. Measure which contents a specific user was served and how they interacted with it, without a Legal Basis to measure content performance

To develop new products and improve products vendors can: Use information to improve their existing products with new features and to develop new products. Create new models and algorithms through machine learning Vendors cannot: Conduct any other data processing operation allowed under a different purpose under this purpose

Vendors can: Collect and process precise geolocation data in support of one or more purposes. N.B. Precise geolocation means that there are no restrictions on the precision of a user’s location; this can be accurate to within several meters.

Vendors can: Create an identifier using data collected via actively scanning a device for specific characteristics, e.g., installed fonts or screen resolution. Use such an identifier to re-identify a device.

Vendors can: Create an identifier using data collected via actively scanning a device for specific characteristics, e.g., installed fonts or screen resolution. Use such an identifier to re-identify a device.

To ensure security, prevent fraud and debug vendors can: Ensure data are securely transmitted. Detect and prevent malicious, fraudulent, invalid, or illegal activity. Ensure correct and efficient operation of systems and processes, including to monitor and enhance the performance of systems and processes engaged in permitted purposes Vendors cannot: Conduct any other data processing operation allowed under a different purpose under this purpose. Note: Data collected and used to ensure security, prevent fraud, and debug may include automatically sent device characteristics for identification, precise geolocation data, and data obtained by actively scanning device characteristics for identification without separate disclosure and/or opt-in.

To deliver information and respond to technical requests vendors can: Use a user’s IP address to deliver an ad over the internet. Respond to a user’s interaction with an ad by sending the user to a landing page. Use a user’s IP address to deliver content over the internet. Respond to a user’s interaction with content by sending the user to a landing page. Use information about the device type and capabilities for delivering ads or content, for example, to deliver the right size ad creative or video file in a format supported by the device Vendors cannot: Conduct any other data processing operation allowed under a different purpose under this purpose.

Vendors can: Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.

Vendors can: Deterministically determine that two or more devices belong to the same user or household. Probabilistically determine that two or more devices belong to the same user or household. Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification.

Vendors can: Create an identifier using data collected automatically from a device for specific characteristics, e.g., IP address, user-agent string. Use such an identifier to attempt to re-identify a device. Vendors cannot: Create an identifier using data collected via actively scanning a device for specific characteristics, e.g., installed font or screen resolution without users’ separate opt-in to actively scanning device characteristics for identification. Use such an identifier to re-identify a device.

This cookie allows us to distinguish you anonymously from other users of the website and helps us to provide you with a good experience when you browse our site. It is essential for various sections of this site to work for you. This cookie will expire automatically when you close your browser.

This cookie is a security measure and helps protect the website from unauthorised data submissions. This cookie will expire automatically when you close your browser.

This cookie is used to determine if the current user has logged in to their account and has been authorised. This cookie will expire automatically when you close your browser.

This cookie is used to determine if the banner describing cookie use in this website has been hidden by the user. This cookie will expire after one year.

This cookie is used to determine if you have opted to use the full site even when browsing from a mobile device. This cookie will expire after 7 days.

This cookie is used to determine your language preference for our translation tool. This cookie will expire after 30 days.

These cookies are used by Google Analytics to track user activity on the website. None of the above cookies are used for any advertising purposes. You may delete and block cookies in your browser should you wish, by activating the setting on your browser that allows you to refuse the setting of all or some cookies, but you will then be unable to access some section of this website.