{"page":"/blog/eu-sovereign-ad-tech-stack","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Layer","What runs here","Where it usually leaks","EU-only pattern"],"rows":[["Hosting","Bidder, ad server, data warehouse, key management","US hyperscaler region; provider-managed keys","EU-controlled provider or own hardware; keys in an HSM you or an EU third party control; EU-resident admin access only"],["Network and edge","DNS, CDN, DDoS protection, creative delivery","US CDN logs full IP and user agent for every impression","EU CDN or self-hosted edge; log truncation at ingest; no third-party pixels on the edge path"],["Bidder (DSP, SSP, exchange)","OpenRTB request handling, pricing, decisioning","Bid requests sent to US DSPs by design; bid logs stored in the DSP's region","Own or EU-hosted bidder; curated or deal-based supply so EU requests only go to EU-hosted buyers; log retention and location you set"],["Data store and DMP","Segments, identity graph, conversion events","SaaS DMP or CDP replicating to US regions; \"global\" analytics tools","EU-resident warehouse; segment build inside your perimeter; export only aggregates"],["Identity","Hashed email IDs, telco IDs, first-party login graph","Public ID operators hosted abroad; hashed PII posted to a third party","Private operator for EUID or UID2 so hashed data never leaves your environment (EUID docs); telco-network IDs such as Utiq, which reported about 70 million users across six markets as of 15 November 2025 (PPC Land, 1 June 2026); your own login graph. See Identity after Privacy Sandbox"],["Consent","CMP, TC String, GPP","CMP vendor hosted abroad; consent logs in a US region","TCF v2.3-compliant CMP (mandatory since 28 February 2026, IAB Europe) with EU-hosted consent records; see GDPR, ePrivacy and the bidstream"],["Clean room","Partner matching, overlap, incrementality","Clean room run on a US cloud account owned by the partner or the vendor","Self-hosted or EU-provider clean room; computation on your side; see Clean room architectures compared and Clean rooms vs CDP"],["Measurement and attribution","Impression and conversion logs, lift studies","Vendor pixel sends raw events to a US endpoint","Server-side event collection into your warehouse; aggregate reports to partners; DMA Article 6(8) rights to raw data from gatekeepers (Regulation (EU) 2022/1925)"],["Support access","Vendor engineers, on-call, \"break glass\"","Global support teams with standing access","Contractual EU-only support; time-boxed, logged, approved access (the pattern Microsoft's Data Guardian and AWS ESC describe)"],["Observability","Logs, traces, error tracking","SaaS observability tools with US data planes","EU-hosted or self-hosted logging; PII scrubbing before export"]],"sourceUrls":[[],[],[],[],["https://euid.eu/docs/ref-info/ref-operators-public-private","https://ppc.land/the-trade-desk-integrates-utiqs-telco-identity-signals-across-emea/"],["https://iabeurope.eu/transparency-consent-framework/"],[],["https://eur-lex.europa.eu/eli/reg/2022/1925/oj"],[],[]]}