HIPAA, PCI DSS and SOC 2 in Ad Tech: Compliance Explained

GDPR & CCPA: Data Privacy Fundamentals

The General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA/CPRA) form the baseline for AdTech data handling in EU and US markets. These are not optional, any DSP, SSP, or DMP serving these regions must comply.

GDPR Requirements (EU/UK)

• • Lawful basis for processing: Explicit consent or legitimate interest documentation
• • Data portability: Export user data in machine-readable format (JSON, CSV)
• • Data minimization: Collect only data necessary for stated purposes
• • Cross-border transfers: SCCs or adequacy decisions required for non-EU transfers

CCPA/CPRA Requirements (California)

• • Disclosure requirements: Inform users about data collection at point of collection
• • Opt-out rights: "Do Not Sell/Share My Personal Information" link required
• • Non-discrimination: Cannot penalize users who exercise privacy rights
• • Sensitive data: CPRA adds restrictions on precise geolocation, race, health data
• • Private right of action: Consumers can sue for data breaches

AdTech Implementation Checklist

• ✓ Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing
• ✓ Execute Data Processing Agreements (DPAs) with all SSPs, DMPs, vendors
• ✓ Implement "Do Not Sell" signal recognition (Global Privacy Control)

PCI-DSS for E-commerce and Retail Media

The Payment Card Industry Data Security Standard (PCI-DSS) governs how credit card data is handled. For AdTech, this applies when your system touches payment data, even indirectly.

When PCI-DSS Applies to AdTech

• • Retail media networks: If your SSP/DSP integrates with checkout flows and receives transaction confirmations containing card data
• • Conversion tracking: If you store purchase amounts linked to card-on-file customer IDs
• • Advertiser billing: If you process advertiser payments via credit card (not through Stripe/Braintree tokens)
• • Data enrichment: If you receive feeds containing card transaction history for audience building

PCI-DSS 4.0 Core Requirements

Network Security

Protect Account Data

Vulnerability Management

Access Control

Monitoring & Testing

Policy & Governance

HIPAA for Healthcare Advertising: When RTB Requires Compliance

The Health Insurance Portability and Accountability Act (HIPAA) protects Protected Health Information (PHI). Many AdTech operators assume HIPAA doesn't apply to them, this is often wrong.

Does HIPAA Apply to Your RTB System?

HIPAA applies when your DSP, DMP, or SSP processes PHI, data that links a person's identity to their health information. The key question: Can you tie a health-related data point to an identifiable individual?

HIPAA Applies When:

• • User email + "searched for cancer treatment" → PHI
• • Device ID + "diabetes medication purchaser" → PHI
• • IP address + "visited oncology clinic website" → PHI
• • CRM match + "insulin pump user segment" → PHI

HIPAA Does Not Apply When:

• • Contextual: Serving ads on WebMD without user tracking → Not PHI

Where HIPAA Applies in RTB Architecture

These are the specific RTB components that require HIPAA compliance when handling healthcare advertiser data:

1. DMP Audience Segments

If your DMP builds segments like "Diabetes Patients," "Cancer Survivors," or "Prescription Drug Users" tied to user IDs, cookies, or device IDs, this is PHI. Requires BAA, encryption, and audit logging.

3. Conversion Tracking

Tracking pixels that fire when a user completes a healthcare action (scheduled appointment, filled prescription, requested medical information) tied to identifiers create PHI.

4. Data Clean Rooms

Matching pharma CRM data (patients on Drug X) with publisher first-party data creates PHI in the clean room, even if outputs are aggregate. The matching process itself requires HIPAA compliance.

5. Log Storage

Raw bid logs, impression logs, and click logs that contain user identifiers + health segment data are PHI. Even if you don't "use" them actively, storing them triggers HIPAA requirements.

HIPAA Compliance Checklist for DSPs/DMPs

• ✓ Business Associate Agreement (BAA): Execute with every healthcare advertiser before campaign launch
• ✓ Access controls: Role-based access; MFA for all admin accounts
• ✓ Audit logs: Immutable logs tracking every access to PHI (who, when, what)
• ✓ Data retention: Automatic purge after campaign end; no indefinite storage of PHI
• ✓ Minimum necessary: Only access/store the PHI required for the specific purpose
• ✓ Employee training: Annual HIPAA training for all staff with PHI access
• ✓ Risk assessment: Annual security risk assessment documented

HIPAA-Compliant RTB: On-Premise Advantage

On-premise RTB infrastructure significantly simplifies HIPAA compliance:

• • Audit simplicity: One infrastructure to audit, not dozens of cloud vendors
• • BAA reduction: Fewer Business Associate Agreements required
• • Custom retention: Implement exact data retention policies for each healthcare client
• • Air-gap option: Healthcare-only DSP can be network-isolated from general advertising

SOC 2 Type II for Enterprise RTB

GLBA for Financial Services Advertising

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customer financial information. Banks, insurers, investment firms, and fintech companies running DSPs or retail media must comply.

GLBA Three Pillars for AdTech

1. Financial Privacy Rule

Financial institutions must provide privacy notices explaining how customer data (including data used for ad targeting) is collected, used, and shared. Customers have the right to opt out of data sharing with non-affiliates.

3. Pretexting Protection

Prohibits obtaining customer information through false pretenses, relevant for third-party data sourcing. AdTech platforms must document data lineage and prove consent for all audience segments.

AdTech impact: Financial services DSPs must maintain complete data provenance, documenting the source, consent basis, and processing history for every audience segment used in targeting.

Compliance Requirements by Vertical

🏦 Finance (Banks, Insurance, Investment)

• ☑ GLBA , Mandatory for US financial institutions
• ☑ GDPR/CCPA , If serving EU/CA customers
• ☑ PCI-DSS , If processing credit card payments for advertising
• ☐ SEC/FINRA , Additional requirements for investment advertising

🏥 Healthcare (Hospitals, Pharma, Insurance)

• ☑ HIPAA , Mandatory when processing PHI (see section above)
• ☑ GDPR/CCPA , For patient/consumer data
• ☐ HITRUST , Optional but highly respected in healthcare

🛒 Retail Media Networks

• ☑ GDPR/CCPA , Shopper privacy is foundational
• ☑ PCI-DSS , If integrating with checkout/payment flows
• ☐ State privacy laws , Virginia, Colorado, Connecticut, Utah regulations

📱 Telecom / ISPs

• ☑ GDPR/CCPA , Subscriber data protection
• ☑ CPNI , Customer Proprietary Network Information (US telecom-specific)
• ☐ FCC regulations , Additional requirements for carrier advertising

FAQ: AdTech Compliance

Does HIPAA apply to programmatic advertising?

Yes, when your system processes Protected Health Information (PHI), data that links a person's identity to health conditions, treatments, or medical history. If your DSP or DMP builds audience segments based on health-related behaviors tied to identifiable users, HIPAA compliance is required.

When does a DSP need PCI-DSS compliance?

A DSP requires PCI-DSS compliance when it stores, processes, or transmits credit card data, typically in retail media networks with integrated checkout flows, or when processing advertiser payments directly via credit card rather than through tokenized payment processors.