# Is contextual advertising outside GDPR and ePrivacy? Context fields, IP addresses and Article 5(3)

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| A cautious reading | A context-only request that carries a full URL, an IP address, a user-agent string or a timestamp processes personal data. Where a script on the device assembles it, Article 5(3) applies, and advertising is not strictly necessary for the service. Without a recorded choice, no request is sent. | Article 4(1) and Recital 30; Article 5(3); the Board's guidelines | Requests wait for a choice; page context that reveals sensitive topics is removed |
| A permissive reading | A request limited to a page category and coarse data, sent from a server without reading the device, is outside Article 5(3). Where the recipient has no means reasonably likely to identify anyone, the data is not personal data for that recipient. Remaining processing can rest on legitimate interests. | The wording of Article 5(3); the Court's 2025 ruling ; Article 6(1)(f) | A reduced request is sent from the server when no choice is recorded |

**Where the readings collide.** The same system may use a page category to select an ad while sending a full page address or IP address to deliver it. The readings differ on how much the fields reveal and whether the device is accessed. A truncated address may be more or less useful to a recipient that holds other data.

## Questions to take to your counsel

1. Which fields in our context-only request are personal data, for us and for each recipient?
2. Does any step read from or store on the device?
3. Which exception, if any, do we rely on under Article 5(3) or the UK rules, country by country?
4. Does page context reveal special-category information about a visitor?
5. What do we send when no valid choice is recorded: a reduced request or none?
6. How do we evidence the configuration to a regulator?

[Read the full checkpoint](https://adsovereign.com/blog/contextual-advertising-personal-data-gdpr) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)