{"page":"/blog/eu-digital-omnibus-tracker","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Ad tech activity","Law today (Article 5(3))","Council mandate","What still decides the answer"],"rows":[["Behavioural targeting, retargeting, cross-site IDs in bid requests","Consent","Consent; a recital excludes \"providing programmatic advertising\" from the contextual exemption (p. 48)","Consent signal quality; GDPR basis for later processing"],["First-party web analytics","Consent, unless a national authority tolerates it","Exempt if anonymous, aggregated and not shared or combined (p. 157)","Whether the vendor pools data across clients"],["Contextual ad measurement and per-campaign caps","Consent","Exempt within strict limits (p. 157)","Whether a cap uses past activity, which the article excludes"],["Joint industry audience measurement","Consent","Exempt under EMFA Article 24 conditions (p. 157)","Pseudonymisation and no tracking outside the measured service"],["Consent management platforms and TCF strings","Collect consent per purpose and vendor","Same, plus a single-click refusal and a four-month memory of refusals (p. 158)","How a CMP records refusal and which vendors fit the exemptions"],["Clean-room and measurement partners","Recital 26 GDPR counts means reasonably likely to be used \"by the controller or by another person\" (GDPR)","Article 25a: not personal data for a third party unable to identify; processors stay in scope (p. 140)","Whether the partner is a processor or an independent recipient"]],"sourceUrls":[[],[],[],[],[],["https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"]]}