Is contextual advertising outside GDPR and ePrivacy? Context fields, IP addresses and Article 5(3)

The General Data Protection Regulation (GDPR) looks at information that relates to a person and whether the person is identifiable. Recital 26 considers means reasonably likely to be used, including by another person. Recital 30 describes online identifiers, including internet protocol (IP) addresses. An address or identifier can work in combination with other information. GDPR Article 4(1), Recitals 26 and 30.

In Breyer, the Court of Justice considered a website operator’s dynamic IP addresses. The Court held that such an address can be personal data for the operator where it has legal means to obtain information needed to identify the visitor from an internet service provider. The Court addressed the operator’s position under the predecessor data protection directive. {V09a:C-582/14, paras. 43–49}.

In EDPS v. SRB the Court examined pseudonymisation under the regulation governing European Union institutions. The judgment considered means available to a recipient and distinguished that question from the controller’s own duty at collection. A separate Court judgment held that a consent string can be personal data when it can be linked by reasonable means to an identifier. C-413/23 P, paras. 78–87, 107–116; C-604/22, paras. 42–51.

ePrivacy concerns a different operation: storing information or gaining access to information already stored on terminal equipment. The European Data Protection Board (EDPB) discusses tracking pixels, tracked web addresses, IP-based tracking and identifiers in its final guidance. The question is what the technology does and where it gets the information. ePrivacy Article 5(3); EDPB Guidelines 2/2023, final version, paras. 47–51, 54–57, 62–66.

Regulation 6 of the United Kingdom’s Privacy and Electronic Communications Regulations addresses storage and access with its own conditions. The Data (Use and Access) Act 2025 adds specified exceptions in the UK scheme. A design spanning both sets of rules can have the same network trace and a different analysis in each place. UK PECR, reg. 6; Data (Use and Access) Act 2025, Schedule 12.

Where the readings collide. The same system may use a page category to select an ad while sending a full page address or IP address to deliver it. The readings differ on how much the fields reveal and whether the device is accessed. A truncated address may be more or less useful to a recipient that holds other data.

• Which fields appear in the actual request and headers?
• Is the request assembled by a script on the device or by a server?
• How many parts of the address are kept, and where is truncation applied?
• Does the page address contain query fields or account details?
• Does the topic disclose health, religion or another sensitive attribute about a person?
• Who gets the request, and which other information can they use?
• Which countries are included in delivery?

An ad request can use a category like gardening without needing the full path of the article. The browser and service can still attach a referrer or network address along the way. A capture at the recipient can show fields that a planning document or application log leaves out.

Truncation at the edge and truncation after logs are written have different effects. In the first case a buyer may receive only a coarse network value. In the second, another party may hold the full address even if a report shows only the prefix. Counsel can assess the two recipients and records separately.

A test of the fallback path can record how a request differs when there is no recorded choice. It can also show whether a previously loaded script runs again or whether the first request comes from the server. That evidence helps counsel distinguish how the context was obtained from how an ad was selected. A recipient’s copy of a network trace can show more about what it got than the system’s campaign name. For instance, a bid request might contain a general category in one field while the HTTP header carries a full referrer. The intended selection logic and the observed request belong in separate entries.

The status of a request can also change when a service moves from a server integration to browser code. In the browser design, a resource can read fields or trigger a later request on the device. Counsel can compare the chain of operations across both designs while the team keeps the ad placement itself constant.

The choice record can identify which fallback path the team actually tested.

1. Which fields in our context-only request are personal data, for us and for each recipient?
2. Does any step read from or store on the device?
3. Which exception, if any, do we rely on under Article 5(3) or the UK rules, country by country?
4. Does page context reveal special-category information about a visitor?
5. What do we send when no valid choice is recorded: a reduced request or none?
6. How do we evidence the configuration to a regulator?

Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.

Download these questions

A program may value keeping a limited contextual placement when no choice is recorded. A reduced request may support some inventory without all the data that a full request would give the buyer. The business can compare the difference in delivery and measurement with the uncertainty about each field.

There is also a choice about reversibility. Removing a field from an outbound payload differs from changing tags already deployed across sites. A record of the path, recipient and assumptions can make it easier to revisit a decision if a site adds a field or a buyer gains another way to match it.

Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.

The Commission’s Digital Omnibus proposal of 19 November 2025 includes changes to rules on information on terminal equipment. The proposal text sets out amendments to both the GDPR and ePrivacy Directive. The European Parliament lists it as awaiting a committee decision as of 10 November 2026. Procedure 2025/0360(COD), stage reached. {V09b:COM(2025) 837, Articles 1 and 5, checked 10 November 2026}.

An EDPB announcement dated 16 October 2026 describes a Norwegian authority decision involving data from a dating app and Articles 6 and 9. It reports the regulator’s decision in that case. EDPB regulator announcement on the Norwegian authority’s decision, checked 10 November 2026.

Related references

• identity and privacy guide
• ad tech legal checkpoints index
• counsel briefing kit
• advertising consent signals reference
• identity after privacy sandbox
• rtb architecture explained
• bid request
• cookie banner rules by country
• cnil cookie rules
• eu digital omnibus tracker
• contextual targeting
• bank media network reference

1. GDPR Article 4(1). Checked 10 November 2026.
2. GDPR Recitals 26 and 30. Checked 10 November 2026.
3. ePrivacy Directive Article 5(3). Checked 10 November 2026.
4. GDPR Articles 6 and 9. Checked 10 November 2026.
5. UK Privacy and Electronic Communications Regulations, regulation 6. Checked 10 November 2026.
6. Court of Justice, Breyer, C-582/14, paras. 43–49. Checked 10 November 2026.
7. Court of Justice, EDPS v. SRB, C-413/23 P, paras. 78–87, 107–116. Checked 10 November 2026.
8. Court of Justice, IAB Europe, C-604/22, paras. 42–51. Checked 10 November 2026.
9. EDPB Guidelines 2/2023, final version, §§ 3.1, 3.3 and 3.5. Checked 10 November 2026.
10. European Parliament, procedure 2025/0360(COD), stage reached. Checked 10 November 2026.