Privacy for OpenRTB Buyers

Privacy signals, redaction behavior, and data-handling responsibilities for CloudX buyer integrations.

CloudX carries publisher and device privacy signals into OpenRTB requests and can remove or reduce user-level data before the request reaches you. Your endpoint must still evaluate every request and apply its own legal and policy controls.

Signal paths

For SDK-session redaction before the auction, CloudX evaluates the TCF EU v2 section (GPP SID 2), US National section (SID 7), and US California section (SID 8), plus the legacy US Privacy string.

How CloudX handles the data

1. The publisher’s consent management platform or manual SDK settings provide privacy signals.
2. CloudX binds those signals to the SDK session and builds the OpenRTB request.
3. When an applicable privacy rule restricts processing, CloudX can remove mobile advertising identifiers and user identifiers, anonymize IP addresses, and reduce geo precision.
4. CloudX forwards the remaining data and privacy signals to eligible buyers.

Identifiers can also be absent because the device did not provide them, the platform limited access, or the publisher did not configure them. An absent identifier is not a replacement for consent evaluation.

Children and sensitive data

CloudX does not support child-directed inventory. The Publisher Policy prohibits properties directed at children, and the Demand Partner Policy prohibits ads directed to children and processing children’s data.

CloudX mobile SDKs do not detect or set regs.coppa, so its absence is not proof that traffic is not child-directed. Do not bid when it is 1; the flag never grants permission. If you otherwise believe a request represents child-directed traffic, do not bid and notify CloudX.

CloudX policies also prohibit partners from supplying sensitive personal data. Do not return or place sensitive data, raw personal data, consent strings, or credentials in creative markup, notification URLs, or tracking parameters.

Data roles, retention, and rights

The CloudX Data Terms describe CloudX and each customer as independent controllers for the processing they perform. They also describe the advertising-data categories, permitted processing, security duties, and international-transfer terms.

The CloudX Privacy Policy uses purpose-based retention rather than publishing one universal auction-data period. Your agreement can specify additional retention terms. Do not assume data can be retained indefinitely because no duration appears in the bid request.

Direct data-rights requests concerning CloudX-controlled data to privacy@cloudx.io. Buyers remain responsible for requests concerning data they control.

Buyer checklist

• Parse the privacy paths for the OpenRTB version configured on your endpoint.
• Evaluate regs.gpp together with regs.gpp_sid; do not decode sections that are not listed.
• Honor Sec-GPC, device.lmt, device.dnt, and applicable US Privacy signals.
• Treat missing, invalid, or conflicting consent conservatively.
• Minimize user-level logging and apply your documented deletion and retention controls.
• Test consent, opt-out, missing-signal, and limited-tracking requests before launch.
• Keep your public privacy notice and CloudX contract contacts current.