Privacy and Cookie Policy

Home
/
Privacy and Cookie Policy

(Last updated: August 2025)

1. INTRODUCTION
Who are we?	We are IAB Technology Laboratory, Inc., a company incorporated and registered in the United States of America, with registered office at 116 East 27th Street, 7th Floor, New York 10016. Where we decide the means or purpose of processing your personal data, we are the data “controller.”
Who is our EU and UK representative?	Since we are based in the United States, we have appointed: • Sheridans Solicitors (Germany) LLP as our EU representative; • Sheridans Solicitors LLP as our UK representative, pursuant to Article 27 of the GDPR / UK GDPR. You may contact Sheridans via: • the following email address: iabtechlabgdprrep@sheridans.co.uk Or • the following postal address: EU: FAO IAB Technology Laboratory, Inc., EU Representative, Sheridans Solicitors (Germany) LLP, Rosenstr. 2, 10178 Berlin, Germany. UK: FAO IAB Technology Laboratory, Inc., UK Representative, Sheridans Solicitors LLP, 76 Wardour St, London W1F 0UR.
What’s this policy about?	This policy explains how we process your personal data as a data controller as part of: • our provision of: o our website (https://iabtechlab.com/) (the “Website”), the IAB Tech Lab Tools Portal or other websites, locations or platforms from which we link to this policy; o our email news and marketing services; o our member services, including access to code repositories and tools, events, webinars, working groups and other services made available by us, depending on your, or your company’s, membership type; • our interaction with you (e.g., when you sign up to attend one of our working groups); (together, the “Services”). We update this policy from time to time so please check back in.
How do you contact us? (if you have questions about this policy or to exercise your rights)	Write to us at: support@iabtechlab.com – it will help us to get to your query sooner if you include “Privacy Policy” in the subject line. If you are dissatisfied with the way in which we handle your query and we cannot resolve this for you, you can get in touch with the data protection regulator in your jurisdiction. For example, if you are in the UK, you can get in touch with the Information Commissioner’s Office: https://ico.org.uk/concerns
What are your rights?	You have the following rights in respect of personal data, although these rights may be limited in some circumstances: • Ask us to send a copy of your data to you or someone else • Ask us to restrict, stop processing, or delete your data • Object to our processing of your data • Object to use of your personal data for direct marketing • Ask us to correct inaccuracies in your data If we rely on consent to process your data, or send direct marketing, you can withdraw consent by email to the address above.
Advertisers, Sponsors, and Third Party Links	Our Website may display information from third parties, such as promotions, offers, or links to third-party digital properties. Some of our Services, such as seminars, educational events, conferences, newsletters, and discussion groups, are sometimes sponsored by other companies that are not under our control. When you participate, register, or engage with certain of our Services, we may disclose your business contact information, such as name, email address, title, and country location, to our sponsors, subject to your use of any opt-out or other mechanism that we may provide to limit such sharing of information from us to those sponsors. We encourage you to be aware when you leave our Website or take advantage of advertised offers, links, or other references, many of which may direct you or your Internet browser to digital properties of a third party. Even if we have a relationship with a third party you may encounter or see on our Website, these third parties or any of their websites, advertising, technology, or other content, including any cookies or other technology they may use, are neither our responsibility nor under our control and they have their own terms, conditions, policies, and practices that apply to you, including those concerning processing of your information.

2. YOUR PERSONAL DATA AND HOW WE USE IT
Contact Data (information we may collect as part of your use or receipt of our Services) Name and title Email address Postal address Telephone number Company name Country of employer How long we keep it 7 years from membership termination or expiry, or if not a member, retention will be reviewed up to 3 years from your last engagement with us.	Purpose of processing We process this information: for customer relationship management purposes and administering your, or your company’s, membership; and to provide member Services to you (including to you as a representative of your company). Legal bases for processing We may process this information for these purposes on the basis of our legitimate interest in: managing our relationship with our current and prospective members in order to provide better service; and offering and providing our Services in order to promote the aims of our organisation. We may also process this information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you.	Sources We may collect this information directly from you. We may also receive this information from the company you work for and/or represent. Recipients We may share certain of this information with the following: All service providers listed as ‘suppliers and service providers’ section below.
Service Usage and Receipt Data (information that may be generated by your use or receipt of our Services as a representative of your company) Contact Data (described above) Previously attended events Enrolment for future events Working group membership Attendance at working groups Working group contributions Company membership status Historic membership status Poll / survey responses How long we keep it 7 years from membership termination or expiry, or if not a member, retention will be reviewed up to 3 years from your last engagement with us.	Purpose of processing We process this information: for customer relationship management purposes and administering your, or your company’s, membership; to provide member Services to you (including to you as a representative of your company); and to monitor, develop and improve our Services. Legal bases for processing We may process this information for these purposes on the basis of our legitimate interest in: managing our relationship with our current and prospective members in order to provide better service; offering and providing our Services in order to promote the aims of our organisation; and developing and improving our Services in order to better serve our current and prospective members and better promote the aims of our organisation in future. We may also process this information for these purposes on the basis of performance of our contract with you, or taking steps prior to entering into a contract with you.	Sources We collect this information directly from you, or from your use of our services. Recipients We may share certain of this information with the following: All service providers listed as ‘suppliers and service providers’ section below.
Event Data (information we may collect in relation to your attendance at our in-person or virtual events, in each case as a representative of your company) Contact Data (described above) Contributions to events and transcripts Service Usage Data (described above) Accessibility requirements (where relevant / required) Dietary requirements (where relevant / required) How long we keep it Retention reviewed up to 1 year following event.	Purpose of processing We process this information in order to facilitate your attendance at our events / use of Interactive Services. Legal bases for processing In circumstances where we need to process your special category personal data for these purposes (such as where your dietary requirements relate to a health condition, or where we need information about your accessibility requirements to facilitate your attendance), we process this special category personal data on the basis of your consent. You may withdraw your consent at any time, though please note if you do, we may not be able to account for your accessibility or dietary requirements. We may process (non-special category) information for these purposes on the basis of our legitimate interest in offering events and interactive Services as part of our service package and ensuring that our current / prospective members’ experiences of such Services are the best they can be. We may also process this (non-special category) information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you.	Sources We collect this information directly from you, or from your use of our services. Recipients We may share certain of this information with the following: IAB US, AWS, Zoom, Dropbox, (To the extent necessary) the venue in which our event is being held, Event or Service sponsors.
Enquiry Data (information we may receive when you get in touch) Contact Data (described above) Service Usage Data (described above) Other personal data you send to us as part of enquiries. How long we keep it Retention reviewed up to 3 years from your last engagement with us.	Purpose of processing We process this information to respond to your enquiries and requests for information or support. Legal bases for processing We may process this information for these purposes to pursue our legitimate interest, including: Our interest in responding to enquiries to ensure smooth operation of our organisation and Services and/or facilitation of onboarding of new members; and To understand our current and prospective members, and improve our Services, by taking on-board your feedback. We may also process this information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you. Please note, you may be required to provide us with certain information for us to respond to your enquiries.	Sources We collect this information directly from you, or from your use of our services. Recipients We may share certain of this information with the following: IAB US AWS HubSpot SurveyMonkey Salesforce
Payment Data (information we may receive when you pay for our Services) Contact Data (described above) Services being paid for Amounts paid and payable Bank details including cardholder name, account number, and sort code. Please note, in circumstances where a company is purchasing our Services, this may not constitute personal data. How long we keep it 7 years from membership termination or expiry.	Purpose of processing We process this information to take payment for our Services, such as where you buy tickets to an event we are running. Legal bases for processing We process this information for these purposes on the basis of our legitimate interests in charging for our Services and enabling our customers, members and prospective members to purchase those Services.	Sources We collect this information directly from you. Recipients We may share certain of this information with the following: IAB US AWS Stripe Blackthorn Intuit QuickBooks Online Tray.ai
Marketing Data (information we may process as part of marketing our Services) Contact Data Service Usage Data Marketing preferences How long we keep it Retention reviewed up to 3 years from your last engagement with us.	Purpose of processing We process this information in order to keep you updated with information on news, offers and updates about us and our activities. Legal bases for processing We only process this information for these purposes where you interact with us as a representative of your company – i.e. on a ‘B2B’ basis. Our legal basis for processing this information is our legitimate interest in promoting our activities and organisation. We may also obtain consent, where necessary, under local law (consent here refers to local laws applicable to direct marketing). If you would like to be removed from our mailing list, please let us know by clicking unsubscribe at the bottom of any email you receive from us or by completing this form.	Sources We collect this information directly from you, or from your use of our services. Recipients We may share certain of this information with the following: IAB US AWS HubSpot SurveyMonkey Salesforce Auth0 + OKTA Event or Service sponsors.
Analytics Data (information about how you interact with our Services) Session statistics: number of times you interact with our Services; actions taken on our Services; pages that you visit; average amount of time you spend on our Services; average number of pages you view during a session; whether you leave our Services after viewing only one page. Approximate geolocation Browser and device information: browser, device, operating system and screen resolution you are using to access / view our Services. How long we keep it 18 months from collection.	Purpose of processing We use cookies or similar technologies (e.g., pixels) to collect this information and we use the information to understand how you use our Services and in order to improve, maintain, and develop our Services. Legal basis for processing We process analytics data if you have given your consent. More information You can find out more about how: Google processes analytics data by clicking here; and HubSpot processes analytics data by clicking here. You can withdraw your consent for Google Analytics by using the following link: Google Analytics Opt-out Add-on (by Google) – Chrome Web Store. We disclaim all responsibility for, and do not control, any opt-out mechanisms provided by any third party. You can also withdraw your consent to the placement of cookies and similar technologies from our Services by interacting with the cookies tool we use. You can do so by clicking on the ‘C’ icon and adjusting the available sliders to ‘On’ or ‘Off’, then clicking ‘Save and close’. You may need to refresh your page for your settings to take effect.	Sources We use third party-provided cookies and technologies to collect this information from you, including those provided by Google through ‘Google Analytics’ and HubSpot. Recipients Google HubSpot

2. YOUR PERSONAL DATA AND HOW WE USE IT

Your data

How we use it and legal bases

Sources and recipients (see ‘suppliers and service providers’ section below for further information on recipients)

Contact Data (information we may collect as part of your use or receipt of our Services)

Name and title
Email address
Postal address
Telephone number
Company name
Country of employer

How long we keep it

7 years from membership termination or expiry, or if not a member, retention will be reviewed up to 3 years from your last engagement with us.

Purpose of processing

We process this information:

for customer relationship management purposes and administering your, or your company’s, membership; and
to provide member Services to you (including to you as a representative of your company).

Legal bases for processing

We may process this information for these purposes on the basis of our legitimate interest in:

managing our relationship with our current and prospective members in order to provide better service; and
offering and providing our Services in order to promote the aims of our organisation.

We may also process this information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you.

Sources

We may collect this information directly from you.
We may also receive this information from the company you work for and/or represent.

Recipients

We may share certain of this information with the following:

All service providers listed as ‘suppliers and service providers’ section below.

Service Usage and Receipt Data (information that may be generated by your use or receipt of our Services as a representative of your company)

Contact Data (described above)
Previously attended events
Enrolment for future events
Working group membership
Attendance at working groups
Working group contributions
Company membership status
Historic membership status
Poll / survey responses

How long we keep it

7 years from membership termination or expiry, or if not a member, retention will be reviewed up to 3 years from your last engagement with us.

Purpose of processing

We process this information:

for customer relationship management purposes and administering your, or your company’s, membership;
to provide member Services to you (including to you as a representative of your company); and
to monitor, develop and improve our Services.

Legal bases for processing

We may process this information for these purposes on the basis of our legitimate interest in:

managing our relationship with our current and prospective members in order to provide better service;
offering and providing our Services in order to promote the aims of our organisation; and
developing and improving our Services in order to better serve our current and prospective members and better promote the aims of our organisation in future.

We may also process this information for these purposes on the basis of performance of our contract with you, or taking steps prior to entering into a contract with you.

Sources

We collect this information directly from you, or from your use of our services.

Recipients

We may share certain of this information with the following:

All service providers listed as ‘suppliers and service providers’ section below.

Event Data (information we may collect in relation to your attendance at our in-person or virtual events, in each case as a representative of your company)

Contact Data (described above)
Contributions to events and transcripts
Service Usage Data (described above)
Accessibility requirements (where relevant / required)
Dietary requirements (where relevant / required)

How long we keep it

Retention reviewed up to 1 year following event.

Purpose of processing

We process this information in order to facilitate your attendance at our events / use of Interactive Services.

Legal bases for processing

In circumstances where we need to process your special category personal data for these purposes (such as where your dietary requirements relate to a health condition, or where we need information about your accessibility requirements to facilitate your attendance), we process this special category personal data on the basis of your consent. You may withdraw your consent at any time, though please note if you do, we may not be able to account for your accessibility or dietary requirements.

We may process (non-special category) information for these purposes on the basis of our legitimate interest in offering events and interactive Services as part of our service package and ensuring that our current / prospective members’ experiences of such Services are the best they can be.

We may also process this (non-special category) information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you.

Sources

We collect this information directly from you, or from your use of our services.

Recipients

We may share certain of this information with the following:

IAB US,
AWS,
Zoom,
Dropbox,
(To the extent necessary) the venue in which our event is being held,
Event or Service sponsors.

Enquiry Data (information we may receive when you get in touch)

Contact Data (described above)
Service Usage Data (described above)
Other personal data you send to us as part of enquiries.

How long we keep it

Retention reviewed up to 3 years from your last engagement with us.

Purpose of processing

We process this information to respond to your enquiries and requests for information or support.

Legal bases for processing

We may process this information for these purposes to pursue our legitimate interest, including:

Our interest in responding to enquiries to ensure smooth operation of our organisation and Services and/or facilitation of onboarding of new members; and
To understand our current and prospective members, and improve our Services, by taking on-board your feedback.

We may also process this information for these purposes on the basis of performance of our contract with you or taking steps prior to entering into a contract with you.

Please note, you may be required to provide us with certain information for us to respond to your enquiries.

Sources

We collect this information directly from you, or from your use of our services.

Recipients

We may share certain of this information with the following:

IAB US
AWS
HubSpot
SurveyMonkey
Salesforce

Payment Data (information we may receive when you pay for our Services)

Contact Data (described above)
Services being paid for
Amounts paid and payable
Bank details including cardholder name, account number, and sort code.

Please note, in circumstances where a company is purchasing our Services, this may not constitute personal data.

How long we keep it

7 years from membership termination or expiry.

Purpose of processing

We process this information to take payment for our Services, such as where you buy tickets to an event we are running.

Legal bases for processing

We process this information for these purposes on the basis of our legitimate interests in charging for our Services and enabling our customers, members and prospective members to purchase those Services.

Sources

We collect this information directly from you.

Recipients

We may share certain of this information with the following:

IAB US
AWS
Stripe
Blackthorn
Intuit QuickBooks Online
Tray.ai

Marketing Data (information we may process as part of marketing our Services)

Contact Data
Service Usage Data
Marketing preferences

How long we keep it

Retention reviewed up to 3 years from your last engagement with us.

Purpose of processing

We process this information in order to keep you updated with information on news, offers and updates about us and our activities.

Legal bases for processing

We only process this information for these purposes where you interact with us as a representative of your company – i.e. on a ‘B2B’ basis. Our legal basis for processing this information is our legitimate interest in promoting our activities and organisation.

We may also obtain consent, where necessary, under local law (consent here refers to local laws applicable to direct marketing).

If you would like to be removed from our mailing list, please let us know by clicking unsubscribe at the bottom of any email you receive from us or by completing this form.

Sources

We collect this information directly from you, or from your use of our services.

Recipients

We may share certain of this information with the following:

IAB US
AWS
HubSpot
SurveyMonkey
Salesforce
Auth0 + OKTA
Event or Service sponsors.

Analytics Data (information about how you interact with our Services)

Session statistics: number of times you interact with our Services; actions taken on our Services; pages that you visit; average amount of time you spend on our Services; average number of pages you view during a session; whether you leave our Services after viewing only one page.
Approximate geolocation
Browser and device information: browser, device, operating system and screen resolution you are using to access / view our Services.

How long we keep it

18 months from collection.

Purpose of processing

We use cookies or similar technologies (e.g., pixels) to collect this information and we use the information to understand how you use our Services and in order to improve, maintain, and develop our Services.

Legal basis for processing

We process analytics data if you have given your consent.

More information

You can find out more about how:

Google processes analytics data by clicking here; and
HubSpot processes analytics data by clicking here.

You can withdraw your consent for Google Analytics by using the following link:
Google Analytics Opt-out Add-on (by Google) – Chrome Web Store.

We disclaim all responsibility for, and do not control, any opt-out mechanisms provided by any third party.

You can also withdraw your consent to the placement of cookies and similar technologies from our Services by interacting with the cookies tool we use. You can do so by clicking on the ‘C’ icon and adjusting the available sliders to ‘On’ or ‘Off’, then clicking ‘Save and close’. You may need to refresh your page for your settings to take effect.

Sources

We use third party-provided cookies and technologies to collect this information from you, including those provided by Google through ‘Google Analytics’ and HubSpot.

Recipients

Google
HubSpot

Where explicit retention periods are not described above, we hold data for as long as necessary bearing in mind the purpose for which it was collected. To determine the appropriate period, we consider the amount, nature, and sensitivity of the data, the potential risk of unauthorised access, and legal requirements.

3.TRANSFERS AND DISCLOSURE
Transfers	Where we transfer personal data from within the UK/EU to a country outside the UK/EU which does not provide an adequate level of protection, we use contracts (“Standard Contractual Clauses”) approved by the European Commission or UK Information Commissioner’s Office which give personal data protection similar to that which personal data has in the UK/EU, or (for US transfers) we make use of the EU/UK-US Data Privacy Framework. For more information, drop us a line using the contact details at the start of this policy.
Disclosure	Other than as set out above, we may disclose your personal data: ● Where required by law, government, competent authorities or the courts or to establish, exercise or defend our legal rights, and for the purposes of preventing crime and fraud (e.g., we may share personal data with our professional advisors, investigators, or credit reference agencies).Legal basis: compliance with a legal obligation or our legitimate interests in protecting our stakeholders and organisation. ● With other members receiving Services from us – e.g., if you participate in our working groups, a directory (name and company represented) is shared with other group members.Legal basis: our in facilitating collaboration and communication between working group members. legitimate interests ● With IAB US, who hosts our member and contact database.Legal basis: our legitimate interests in leveraging the database infrastructure created by IAB US. ● With our sponsors, as outlined in the “1. INTRODUCTION” section (note: no special category data is shared).Legal basis: our legitimate interest in partnering with sponsor organisations for mutual financial or other benefit. ● With our suppliers and service providers – see below.Legal basis: our legitimate interests in outsourcing certain elements of our Service, or systems and processes required to provide our Services, in order to promote and facilitate the most efficient and effective means of operating our business. ● If involved in a merger, acquisition, investment, or sale of assets, we may share relevant personal data to involved parties.Legal basis: the legitimate interests of us, our shareholders, customers/members and other parties to a transaction, unless those interests are outweighed by prejudicial impacts upon you.
Suppliers and Service Providers	We use a range of suppliers and service providers to operate our business. Entities who may receive your personal data as part of our processing described above include the following: Internet Advertising Bureau, Inc. (IAB US): provide and operates part of our customer relationship management platform; Amazon Web Services (AWS): provides cloud hosting services; HubSpot, Inc. (HubSpot): provides customer relationship management platform services and analytics services; SurveyMonkey Inc. (SurveyMonkey): provides online survey and form functionality; Zoom Video Communications, Inc (Zoom): provide videotelephony services; GoodSuite, Inc.: provides backend IT services; Dropbox, Inc. (Dropbox): provides file storage/hosting services; Salesforce, Inc. (Salesforce): provides customer relationship management tools and software; Slack Technologies, Inc. (Slack): provides communication platform services; Google LLC.: provides cloud hosting and analytics services; Heroku (provided by Salesforce, Inc.): provides application building platform services; GitHub, Inc.: provides developer platform services; Atlassian Corporation (Jira): provides project management and issue/bug tracking services; Microsoft: provides IT services; Stripe, Inc (Stripe): provides financial (payment processing) services; Auth0 + OKTA (Okta, Inc.): provides identity and access management services; Blackthorn.io, Inc. (previously Blackthorn Payments 360): provides financial (payment processing) services; Intuit QuickBooks Online (Intuit Inc.): provides financial (accounting) services; Tray.ai, Inc.: provides automation and integration services for cloud-based workflows; SMTP2GO (Sand Dune Mail Ltd): provides cloud-based email delivery services; SendGrid (provided by Twilio Inc.): provides cloud-based email delivery services; Conga Corporation: provides digital document transformation tools that automate business processes; PushMetrics GmbH: provides an automation tool for the delivery of data and reports from business intelligence platforms; CData Software, Inc.: provides data connectivity services; Continuous: provides hardware and software support services; and Tableau (provided by Salesforce, Inc.): provides business intelligence and analytics services.

4. COOKIES AND SIMILAR TECHNOLOGIES
What is a cookie?	Although the term “cookie” commonly is used to refer to a small text file stored on a device, we use the term “cookie” in this Privacy Policy to refer generically to any technology that can track information in relation to your use of our Services, such as a “pixel tag.”
Our use of cookies for EU/UK Service visitors	Except for cookies and similar technologies associated with Google Analytics and HubSpot, we geo-block the placement of cookies for visitors to our Services located in the EU or UK. This means that if you access or receive our Services from within these locations, we will not place or use any cookies in relation to such access or receipt, except for the cookies and similar technologies associated with Google Analytics. Details of the cookies placed in connection with Google Analytics are as follows: Cookie: _ga Duration: 2 years Use: To distinguish users Access: Google will have access to information collected via this cookie Cookie: _ga_ Duration: 2 years Use: To persist session state Access: Google will have access to information collected via this cookie Cookie: hubspotutk Duration: Indefinite (unless the user overwrites the data) Use: To prevent the need for users to re-enter data when submitting a form Access: HubSpot will have access to information collected via this cookie only when a form is re-submitted
What information do our cookies collect from non-EU/UK Service visitors?	The information typically collected by cookies includes such data as the referral web domain, the type of operating system and browser you are using, mobile device identifiers, IP address, pages that you visit, the date and time of your visit, how long you stay on a page, location data, information relating to your activities on our Website, log-in details, and technical attributes of visits to our Website. This information may be processed by us or third parties for purposes such as: Analytics (e.g., understanding how visitors utilize our Website, visitor demographics), Advertising (targeted or otherwise; audience segmentation; identity resolution), Measurement (e.g., understanding ad effectiveness, attribution), Confirming membership status or product subscriptions, Storing login information for easier repeat access
How can I opt out from the placement of cookies?	You may stop or restrict cookies on your computer or delete them from your browser by adjusting your web browser preferences and you should consult the operating instructions that apply to your browser for instructions should you wish to do so and in general to determine how best to configure your browser settings to meet your requirements. You can withdraw your consent for Google Analytics by using the following link: Google Analytics Opt-out Add-on (by Google) – Chrome Web Store. We disclaim all responsibility for, and do not control, any opt-out mechanisms provided by any third party. You can also withdraw your consent to the placement of cookies and similar technologies from our Services by interacting with the cookies tool we use. You can do so by clicking on the ‘C’ icon and adjusting the available sliders to ‘On’ or ‘Off’, then clicking ‘Save and close’. You may need to refresh your page for your settings to take effect.
Do we use cookies for advertising activities in relation to EU/UK Service visitors?	We geo-block advertising activities which involve the processing of personal data via cookies for individuals or companies located in the EU or UK.

Privacy and Cookie Policy

Tools & Utilities

Articles

About the IAB Tech Lab

Contact