Commerce Media

Commerce media platform RFP: 40 questions to ask a vendor, with a scoring sheet

Published November 10, 2026 · Last updated November 10, 2026
Next scheduled review: 9 May 2027

This commerce media platform RFP gives you 40 questions in eight groups, from data and identity to exit terms. Each question says why it matters and what a good answer contains. A scoring sheet turns answers into comparable numbers, and the whole set downloads as CSV. Retailers can use it as a retail media network RFP.

Contents

Key facts

Bank data has its own sharing rules. Regulation P bars a financial institution from giving a customer's account number to a nonaffiliated third party for marketing, with narrow exceptions (12 CFR 1016.12). Its service-provider and joint-marketing exception requires a contract that limits the vendor's use of the data (12 CFR 1016.13).
Attribution is not incrementality. IAB and IAB Europe define incrementality as causal impact against what would have happened anyway. Attribution and ROAS "show what happened, not whether marketing caused the result" (IAB and IAB Europe guidelines, 3 November 2025).
Attribution windows must be disclosed before the campaign. The IAB/MRC retail media guidelines say windows "must be disclosed before campaign execution and measurement" (IAB/MRC, January 2024).
SOC 2 reports deserve scrutiny. The AICPA says it is looking into allegations about a compliance vendor offering SOC services, and it published proposed 2027 SOC 2 criteria for comment (AICPA, exposure drafts dated 26 October 2026).
Exits take months. When Bank of America's agreements with Cardlytics expired on 31 July 2025, service continued through 16 February 2026 at the bank's request (Cardlytics 10-K, filed 4 March 2026).

Jump to the table

How to use the commerce media platform RFP

Cut the list to what applies. A bank needs every privacy question; a retailer without credit products can mark the FCRA question "not applicable". Gate questions cannot be skipped.
Send the questions with the guidance. Vendors write better answers when they see what a good answer contains. Ask for evidence: a document, a contract clause, an audit report or a live demo.
Score blind, then compare. Two reviewers score each group from 0 to 3 on their own, then agree a final score. The sheet weights the groups and checks the gates.
Negotiate the gaps. A low group score is a list of contract terms to fix before signing. The worked example below shows how that reads.
Export. Download the CSV for procurement, or the DOCX-ready outline for the formal RFP document.

A commerce media network sells ads on data a company holds about its customers' purchases, bookings or usage. The commerce media networks directory lists the live ones, and the commerce media hub collects the rest of our guides.

The 40 questions

Questions marked "(gate)" must score at least 2. A vendor that fails a gate is excluded whatever its total.

A. Data and identity (weight 15)

5 of 5 rows

Density


A1	Which of our data sources does the platform ingest, and at what grain: transaction, account, household or device?	The grain decides which audiences and which measurements are possible later.	A field-level schema per source, refresh frequency and retention per field.
A2 (gate)	Where is raw customer data processed and stored, and does any of it leave our environment?	Banks and loyalty owners often contract on the condition that raw data stays inside. Cardlytics says its network works "without any personal data leaving" its bank partners (company statement) (10-K, 4 Mar 2026).	A data-flow diagram naming every system, region and party, and exactly what leaves, at what level of aggregation.
A3	How are identities matched across our systems and partners, and what match rates do you see?	Match rates set reachable audience size and measurement sample size.	Keys used (hashed email, phone, card token, account ID), hashing method, and dated match rates from comparable deployments.
A4	How fast does an opt-out or consent change reach every audience and channel?	An opt-out recorded in the core system must stop targeting everywhere.	Propagation time in hours, an audit log, and a test you can run during the pilot.
A5	Can we see and export the rules behind every audience segment?	Hidden segment logic blocks fair lending and privacy review.	Versioned, readable rules with an approval workflow and export.

A1

Question: Which of our data sources does the platform ingest, and at what grain: transaction, account, household or device?
Why it matters: The grain decides which audiences and which measurements are possible later.
A good answer contains: A field-level schema per source, refresh frequency and retention per field.

A2 (gate)

Question: Where is raw customer data processed and stored, and does any of it leave our environment?
Why it matters: Banks and loyalty owners often contract on the condition that raw data stays inside. Cardlytics says its network works "without any personal data leaving" its bank partners (company statement) (10-K, 4 Mar 2026).
A good answer contains: A data-flow diagram naming every system, region and party, and exactly what leaves, at what level of aggregation.

A3

Question: How are identities matched across our systems and partners, and what match rates do you see?
Why it matters: Match rates set reachable audience size and measurement sample size.
A good answer contains: Keys used (hashed email, phone, card token, account ID), hashing method, and dated match rates from comparable deployments.

A4

Question: How fast does an opt-out or consent change reach every audience and channel?
Why it matters: An opt-out recorded in the core system must stop targeting everywhere.
A good answer contains: Propagation time in hours, an audit log, and a test you can run during the pilot.

A5

Question: Can we see and export the rules behind every audience segment?
Why it matters: Hidden segment logic blocks fair lending and privacy review.
A good answer contains: Versioned, readable rules with an approval workflow and export.

Download JSON

Table by AdSovereign, CC BY 4.0.

B. Privacy and legal basis (weight 15)

5 of 5 rows

Density


B1 (gate)	For each data use, which GLBA and Regulation P basis do you rely on, and who sends the notices?	The service-provider and joint-marketing exception needs a contract limiting use (12 CFR 1016.13); a recipient may not pass the data on unless the bank could (15 U.S.C. 6802(c)).	A use-by-use map, the draft contract clauses limiting use and reuse, and the notice owner.
B2	Does any feature disclose account numbers or access codes to a third party for marketing?	Regulation P prohibits it with two exceptions; an encrypted number counts only if the recipient cannot decode it (12 CFR 1016.12).	A plain "no", backed by architecture showing tokens only, or the exception relied on.
B3	Will any audience use consumer report data, or support credit or insurance offers?	Prescreened lists are allowed only for firm offers of credit or insurance (15 U.S.C. 1681b(c)); affiliate data used for solicitations needs notice and opt-out (12 CFR 1022.21).	Which features touch consumer reports, the prescreen workflow, or a clear statement that none do.
B4	Which state privacy laws do you treat as applying, and how do you handle data outside the GLBA exemption?	California exempts data collected subject to GLBA, not the company (Cal. Civ. Code 1798.145(e)); Virginia exempts GLBA institutions and data (Va. Code 59.1-576).	A state-by-state matrix and how sale and sharing opt-outs work for web and app data.
B5	How do you stop sensitive inferences, such as health, from entering audiences?	Pharmacy and clinic purchases can reveal health conditions, and state health data laws apply to such data.	Merchant-category and keyword blocklists, tests, and a named policy owner.

B1 (gate)

Question: For each data use, which GLBA and Regulation P basis do you rely on, and who sends the notices?
Why it matters: The service-provider and joint-marketing exception needs a contract limiting use (12 CFR 1016.13); a recipient may not pass the data on unless the bank could (15 U.S.C. 6802(c)).
A good answer contains: A use-by-use map, the draft contract clauses limiting use and reuse, and the notice owner.

B2

Question: Does any feature disclose account numbers or access codes to a third party for marketing?
Why it matters: Regulation P prohibits it with two exceptions; an encrypted number counts only if the recipient cannot decode it (12 CFR 1016.12).
A good answer contains: A plain "no", backed by architecture showing tokens only, or the exception relied on.

B3

Question: Will any audience use consumer report data, or support credit or insurance offers?
Why it matters: Prescreened lists are allowed only for firm offers of credit or insurance (15 U.S.C. 1681b(c)); affiliate data used for solicitations needs notice and opt-out (12 CFR 1022.21).
A good answer contains: Which features touch consumer reports, the prescreen workflow, or a clear statement that none do.

B4

Question: Which state privacy laws do you treat as applying, and how do you handle data outside the GLBA exemption?
Why it matters: California exempts data collected subject to GLBA, not the company (Cal. Civ. Code 1798.145(e)); Virginia exempts GLBA institutions and data (Va. Code 59.1-576).
A good answer contains: A state-by-state matrix and how sale and sharing opt-outs work for web and app data.

B5

Question: How do you stop sensitive inferences, such as health, from entering audiences?
Why it matters: Pharmacy and clinic purchases can reveal health conditions, and state health data laws apply to such data.
A good answer contains: Merchant-category and keyword blocklists, tests, and a named policy owner.

Download JSON

Table by AdSovereign, CC BY 4.0.

C. Clean room and activation (weight 12)

5 of 5 rows

Density


C1	Which clean room or privacy-enhancing technology do you use, and who approves queries?	Whoever controls the query templates controls what can leak.	The named technology, the approval workflow and who holds the keys.
C2	What are the minimum aggregation thresholds, and can you change them without our approval?	Low or vendor-controlled thresholds allow re-identification by comparing overlapping results.	Thresholds stored as our configuration, with a change log.
C3	How do audiences reach offsite channels, and which identifier leaves our perimeter?	Offsite activation is where data most often leaves.	Each destination, the identifier type, contract terms with each and deletion at campaign end.
C4	What can an advertiser bring into the clean room, and what can it take out?	Two-way flows create new disclosures on both sides.	Input and output policies, export limits and query logs we can read.
C5	How is matching to third-party data done, and is it disclosed?	The IAB/MRC guidelines require transparency in how third-party matching is conducted (January 2024).	Method, partners and match rates, written into reporting.

C1

Question: Which clean room or privacy-enhancing technology do you use, and who approves queries?
Why it matters: Whoever controls the query templates controls what can leak.
A good answer contains: The named technology, the approval workflow and who holds the keys.

C2

Question: What are the minimum aggregation thresholds, and can you change them without our approval?
Why it matters: Low or vendor-controlled thresholds allow re-identification by comparing overlapping results.
A good answer contains: Thresholds stored as our configuration, with a change log.

C3

Question: How do audiences reach offsite channels, and which identifier leaves our perimeter?
Why it matters: Offsite activation is where data most often leaves.
A good answer contains: Each destination, the identifier type, contract terms with each and deletion at campaign end.

C4

Question: What can an advertiser bring into the clean room, and what can it take out?
Why it matters: Two-way flows create new disclosures on both sides.
A good answer contains: Input and output policies, export limits and query logs we can read.

C5

Question: How is matching to third-party data done, and is it disclosed?
Why it matters: The IAB/MRC guidelines require transparency in how third-party matching is conducted (January 2024).
A good answer contains: Method, partners and match rates, written into reporting.

Download JSON

Table by AdSovereign, CC BY 4.0.

D. Measurement and incrementality (weight 15)

5 of 5 rows

Density


D1 (gate)	Do you run randomised holdouts or other controlled tests, and can we see the control design?	Without a credible counterfactual, measured differences "may reflect correlation" rather than impact (IAB and IAB Europe, 2025).	Holdout or randomised design by default, control size, power calculation and confidence intervals.
D2	Which attribution windows do you use, and are they disclosed before each campaign?	The IAB/MRC guidelines require disclosure before execution; typical windows run 3, 7, 14, 28 or 30 days (January 2024).	Window per objective, written into the insertion order.
D3	What share of customers' spending does your data see, and how do you treat the rest?	Cards carried 79% of US noncash payments by number but 8% by value in 2024 (Federal Reserve, 1 July 2026).	A coverage estimate with method, and how results are scaled or caveated.
D4	How do returns, chargebacks and late clearing change reported sales?	Rewards and partner payments can trail the purchase by months; Cardlytics pays incentives one to four months after redemption (10-K).	A restatement policy, preliminary and final flags, and typical lag in days.
D5	Which independent partners can validate results with their own data?	PayPal launched its program with 20 certified third-party measurement partners (PayPal, 6 Jan 2026).	Named partners, what data each receives and a past joint study.

D1 (gate)

Question: Do you run randomised holdouts or other controlled tests, and can we see the control design?
Why it matters: Without a credible counterfactual, measured differences "may reflect correlation" rather than impact (IAB and IAB Europe, 2025).
A good answer contains: Holdout or randomised design by default, control size, power calculation and confidence intervals.

D2

Question: Which attribution windows do you use, and are they disclosed before each campaign?
Why it matters: The IAB/MRC guidelines require disclosure before execution; typical windows run 3, 7, 14, 28 or 30 days (January 2024).
A good answer contains: Window per objective, written into the insertion order.

D3

Question: What share of customers' spending does your data see, and how do you treat the rest?
Why it matters: Cards carried 79% of US noncash payments by number but 8% by value in 2024 (Federal Reserve, 1 July 2026).
A good answer contains: A coverage estimate with method, and how results are scaled or caveated.

D4

Question: How do returns, chargebacks and late clearing change reported sales?
Why it matters: Rewards and partner payments can trail the purchase by months; Cardlytics pays incentives one to four months after redemption (10-K).
A good answer contains: A restatement policy, preliminary and final flags, and typical lag in days.

D5

Question: Which independent partners can validate results with their own data?
Why it matters: PayPal launched its program with 20 certified third-party measurement partners (PayPal, 6 Jan 2026).
A good answer contains: Named partners, what data each receives and a past joint study.

Download JSON

Table by AdSovereign, CC BY 4.0.

E. Ad serving and formats (weight 8)

5 of 5 rows

Density


E1	Which surfaces and formats are live, and which are planned, with dates?	Offers, display, email, push and in-branch or in-store screens need different tooling.	A format list with specifications, live versus planned.
E2	How are frequency and pacing controlled across surfaces?	Customers see the same brand in app, email and offers.	Cross-surface caps, pacing logic and reporting by surface.
E3	What creative review applies to regulated advertisers and categories?	Bank and credit ads carry disclosure rules; see bank advertising rules.	A review workflow, category blocks and an audit trail.
E4	Do you measure viewability and invalid traffic on owned surfaces, to which standard?	MRC counts a display ad viewable at 50% of pixels for one second (MRC, 2015).	The vendor used, the standard followed and IVT filtering.
E5	Can buyers reach inventory programmatically, and through which protocol and DSPs?	Programmatic access widens demand beyond managed sales.	OpenRTB 2.6 support, deal IDs and a list of connected DSPs.

E1

Question: Which surfaces and formats are live, and which are planned, with dates?
Why it matters: Offers, display, email, push and in-branch or in-store screens need different tooling.
A good answer contains: A format list with specifications, live versus planned.

E2

Question: How are frequency and pacing controlled across surfaces?
Why it matters: Customers see the same brand in app, email and offers.
A good answer contains: Cross-surface caps, pacing logic and reporting by surface.

E3

Question: What creative review applies to regulated advertisers and categories?
Why it matters: Bank and credit ads carry disclosure rules; see bank advertising rules.
A good answer contains: A review workflow, category blocks and an audit trail.

E4

Question: Do you measure viewability and invalid traffic on owned surfaces, to which standard?
Why it matters: MRC counts a display ad viewable at 50% of pixels for one second (MRC, 2015).
A good answer contains: The vendor used, the standard followed and IVT filtering.

E5

Question: Can buyers reach inventory programmatically, and through which protocol and DSPs?
Why it matters: Programmatic access widens demand beyond managed sales.
A good answer contains: OpenRTB 2.6 support, deal IDs and a list of connected DSPs.

Download JSON

Table by AdSovereign, CC BY 4.0.

F. Pricing and contract (weight 12)

5 of 5 rows

Density


F1 (gate)	List every fee: platform, data, media, revenue share, measurement and minimums.	Fees hidden in media rates are hard to audit later.	A fee schedule and a sample invoice.
F2	Is pricing tied to impressions, engagements or attributed sales, and how is an attributed sale defined?	Cardlytics' main model charges a share of all purchases by served customers during the campaign, "regardless of whether" they engage (10-K).	The definition, the window and a worked invoice.
F3	How is the revenue share to us calculated, and can we audit it?	Partner share drives the business case.	The formula, the inputs and audit rights.
F4	What service levels apply to uptime, support and reporting, with what credits?	Late reports delay billing and optimisation.	Service levels with measurable credits.
F5	Which terms stop you using our data for your own products or other clients?	Reuse is restricted by law for GLBA data (15 U.S.C. 6802(c)) and should be restricted by contract for the rest.	A purpose-limitation clause covering model training.

F1 (gate)

Question: List every fee: platform, data, media, revenue share, measurement and minimums.
Why it matters: Fees hidden in media rates are hard to audit later.
A good answer contains: A fee schedule and a sample invoice.

F2

Question: Is pricing tied to impressions, engagements or attributed sales, and how is an attributed sale defined?
Why it matters: Cardlytics' main model charges a share of all purchases by served customers during the campaign, "regardless of whether" they engage (10-K).
A good answer contains: The definition, the window and a worked invoice.

F3

Question: How is the revenue share to us calculated, and can we audit it?
Why it matters: Partner share drives the business case.
A good answer contains: The formula, the inputs and audit rights.

F4

Question: What service levels apply to uptime, support and reporting, with what credits?
Why it matters: Late reports delay billing and optimisation.
A good answer contains: Service levels with measurable credits.

F5

Question: Which terms stop you using our data for your own products or other clients?
Why it matters: Reuse is restricted by law for GLBA data (15 U.S.C. 6802(c)) and should be restricted by contract for the rest.
A good answer contains: A purpose-limitation clause covering model training.

Download JSON

Table by AdSovereign, CC BY 4.0.

G. Security and SOC 2 (weight 13)

5 of 5 rows

Density


G1 (gate)	Provide your latest SOC 2 Type 2 report: period, auditor, scope and exceptions.	The AICPA is looking into allegations about one SOC services provider, and its journal has covered the risks of quick-turn SOC engagements (AICPA, accessed 9 Nov 2026).	A Type 2 report covering the systems in scope, a recent period, a named CPA firm and remediation of exceptions.
G2	Which Trust Services Criteria are in scope, and how will you move to the 2027 criteria?	SOC 2 can cover security, availability, processing integrity, confidentiality and privacy; the 2027 criteria are in draft (AICPA).	The categories covered and a transition plan.
G3	Who manages encryption keys, and can we hold our own?	Customer-held keys limit what the vendor can read.	Key management design and customer-managed key support.
G4	Which subprocessors and regions handle our data?	Each subprocessor is another party to assess.	A current list and advance notice of changes.
G5	What are your incident response and notification commitments?	Banks have their own notification duties to meet.	Notification time in hours, named contacts and recent exercise results.

G1 (gate)

Question: Provide your latest SOC 2 Type 2 report: period, auditor, scope and exceptions.
Why it matters: The AICPA is looking into allegations about one SOC services provider, and its journal has covered the risks of quick-turn SOC engagements (AICPA, accessed 9 Nov 2026).
A good answer contains: A Type 2 report covering the systems in scope, a recent period, a named CPA firm and remediation of exceptions.

G2

Question: Which Trust Services Criteria are in scope, and how will you move to the 2027 criteria?
Why it matters: SOC 2 can cover security, availability, processing integrity, confidentiality and privacy; the 2027 criteria are in draft (AICPA).
A good answer contains: The categories covered and a transition plan.

G3

Question: Who manages encryption keys, and can we hold our own?
Why it matters: Customer-held keys limit what the vendor can read.
A good answer contains: Key management design and customer-managed key support.

G4

Question: Which subprocessors and regions handle our data?
Why it matters: Each subprocessor is another party to assess.
A good answer contains: A current list and advance notice of changes.

G5

Question: What are your incident response and notification commitments?
Why it matters: Banks have their own notification duties to meet.
A good answer contains: Notification time in hours, named contacts and recent exercise results.

Download JSON

Table by AdSovereign, CC BY 4.0.

H. Exit and data portability (weight 10)

5 of 5 rows

Density


H1 (gate)	At exit, can we export all our data, configurations, audiences and logs in documented formats, and at what cost?	Without an export, the next platform starts from zero.	Formats (CSV or Parquet), schema documentation and the fee, ideally none.
H2	What happens to our data and derived models after termination, and how is deletion certified?	Derived models can carry our data forward.	A deletion timeline and a certificate.
H3	How long will you run in parallel while we migrate?	Bank of America's exit from Cardlytics ran almost seven months past expiry (10-K).	A transition-assistance period and its rates.
H4	Can segments and measurement history move to another platform?	History is what makes year-on-year comparison possible.	Portable identifiers and a history export.
H5	Who owns code, models and configurations built for us?	Ownership decides what you can take with you.	An intellectual property clause naming each.

H1 (gate)

Question: At exit, can we export all our data, configurations, audiences and logs in documented formats, and at what cost?
Why it matters: Without an export, the next platform starts from zero.
A good answer contains: Formats (CSV or Parquet), schema documentation and the fee, ideally none.

H2

Question: What happens to our data and derived models after termination, and how is deletion certified?
Why it matters: Derived models can carry our data forward.
A good answer contains: A deletion timeline and a certificate.

H3

Question: How long will you run in parallel while we migrate?
Why it matters: Bank of America's exit from Cardlytics ran almost seven months past expiry (10-K).
A good answer contains: A transition-assistance period and its rates.

H4

Question: Can segments and measurement history move to another platform?
Why it matters: History is what makes year-on-year comparison possible.
A good answer contains: Portable identifiers and a history export.

H5

Question: Who owns code, models and configurations built for us?
Why it matters: Ownership decides what you can take with you.
A good answer contains: An intellectual property clause naming each.

Download JSON

Table by AdSovereign, CC BY 4.0.

How the scoring sheet works

Each answer gets a score from 0 to 3, based on evidence rather than on how confident it sounds.

5 of 5 rows

Density


0	No answer, a refusal, or an answer that contradicts the good answer
1	A claim without evidence
2	Meets the good answer, with a document reference
3	Meets the good answer and proves it: contract clause, audit report, sample file or live demo
N/A	Does not apply to your business (not allowed for gate questions)

0

Meaning: No answer, a refusal, or an answer that contradicts the good answer

1

Meaning: A claim without evidence

2

Meaning: Meets the good answer, with a document reference

3

Meaning: Meets the good answer and proves it: contract clause, audit report, sample file or live demo

N/A

Meaning: Does not apply to your business (not allowed for gate questions)

Download JSON

Table by AdSovereign, CC BY 4.0.

A group's points equal its weight times the share of the maximum score it earned. For example, a group weighted 15 that scores 11 of a possible 15 earns 11 points. The total adds the eight groups and runs from 0 to 100. If every question in a group is not applicable, that group drops out and the other weights scale up.

Six gates sit on top: A2, B1, D1, F1, G1 and H1 must each score at least 2. A total of 75 or more reads as strong, 50 to 74.9 as a vendor to negotiate with, and below 50 as weak.

Why gates on those six? Each covers a risk a high score elsewhere cannot offset: raw data leaving your perimeter, no lawful basis, no causal measurement, hidden fees, an unaudited security programme and no way out.

Worked example: a vendor that scores 63.7

A fictional vendor answers every question. The table shows its scores and the points the sheet gives each group.

9 of 9 rows

Density


A. Data and identity (15)	3, 2, 2, 3, 1	73.3%	11.0
B. Privacy and legal basis (15)	2, 3, N/A, 2, 1	66.7%	10.0
C. Clean room and activation (12)	2, 1, 1, 2, 2	53.3%	6.4
D. Measurement and incrementality (15)	2, 2, 1, 0, 3	53.3%	8.0
E. Ad serving and formats (8)	3, 3, 2, 2, 1	73.3%	5.9
F. Pricing and contract (12)	2, 1, 2, 3, 2	66.7%	8.0
G. Security and SOC 2 (13)	3, 2, 2, 3, 2	80.0%	10.4
H. Exit and data portability (10)	2, 1, 2, 1, 0	40.0%	4.0
Total			63.7, all gates passed

A. Data and identity (15)

Scores, questions 1 to 5: 3, 2, 2, 3, 1
Share of maximum: 73.3%
Points: 11.0

B. Privacy and legal basis (15)

Scores, questions 1 to 5: 2, 3, N/A, 2, 1
Share of maximum: 66.7%
Points: 10.0

C. Clean room and activation (12)

Scores, questions 1 to 5: 2, 1, 1, 2, 2
Share of maximum: 53.3%
Points: 6.4

D. Measurement and incrementality (15)

Scores, questions 1 to 5: 2, 2, 1, 0, 3
Share of maximum: 53.3%
Points: 8.0

E. Ad serving and formats (8)

Scores, questions 1 to 5: 3, 3, 2, 2, 1
Share of maximum: 73.3%
Points: 5.9

F. Pricing and contract (12)

Scores, questions 1 to 5: 2, 1, 2, 3, 2
Share of maximum: 66.7%
Points: 8.0

G. Security and SOC 2 (13)

Scores, questions 1 to 5: 3, 2, 2, 3, 2
Share of maximum: 80.0%
Points: 10.4

H. Exit and data portability (10)

Scores, questions 1 to 5: 2, 1, 2, 1, 0
Share of maximum: 40.0%
Points: 4.0

Total

Scores, questions 1 to 5
Share of maximum
Points: 63.7, all gates passed

Download JSON

Table by AdSovereign, CC BY 4.0.

That reads as "negotiate". The weak spots are specific: coverage of spending it cannot see (D3 scored 0), deletion of derived models (H5 scored 0) and audience matching (C2 and C3 scored 1). Those become contract exhibits. If the same vendor had scored 1 on H1, the export question, the total would fall to 63.0 and the gate would exclude it.

Why a commerce media RFP differs from a DSP RFP

A DSP RFP template asks how a vendor will buy media for you. A commerce media platform RFP asks how a vendor will sell media built on your customers' data. The risk moves from fees and supply quality to legal basis, data movement and proof of results.

For banks and card issuers that means GLBA and Regulation P first. The GLBA joint marketing exception explains when a vendor can see customer data without an opt-out, and FCRA prescreen rules cover credit offers. State law adds a layer; the US state privacy laws tracker lists effective dates, and health-related purchases may fall under laws such as the Washington My Health My Data Act.

Measurement is the other large difference. A financial media network sees card spending but often not the product, the cash purchase or the other bank's card. Why financial media networks struggle with measurement explains those gaps. The IAB/MRC retail media measurement guidelines set the disclosure baseline that D2 and C5 test. For clean room designs behind group C, see clean room architectures compared. To test whether the program pays at all before you run an RFP, start with the commerce media business case template.

Download the RFP checklist

The CSV has one row per question and blank columns for each vendor's answer, score, evidence link and reviewer. The DOCX-ready outline uses Word heading styles, so it opens as a formatted RFP with a cover page, instructions, one section per group and an answer table under each question. Both files are free under CC BY 4.0. The scoring runs in your browser, and vendor answers you paste are never sent to a server.

FAQ

What should a commerce media platform RFP cover?

Eight areas: data and identity, privacy and legal basis, clean room and activation, measurement and incrementality, ad serving and formats, pricing and contract, security, and exit. Banks also need GLBA and FCRA questions that a retailer can mark as not applicable. The 40 questions above cover each area with five questions.

How many vendors should get the RFP?

Three to five is usual for a platform choice: enough to compare, few enough to read every answer properly. Fewer than three makes the scores hard to calibrate. Run a pilot with the top one or two before signing.

How do I score vendor answers fairly?

Score evidence, not prose. Use the 0-to-3 scale, have two reviewers score each group alone, then agree. Check the six gates before you look at totals.

Do banks need different RFP questions from retailers?

Mostly the same questions, with stricter answers. A bank needs a lawful basis for each use of account data under Regulation P (12 CFR 1016.13) and an answer on prescreened credit offers. A retailer marks B3 not applicable and focuses on state privacy law and loyalty consent; see loyalty program data in advertising.

Which SOC 2 report should I ask for?

A SOC 2 Type 2 report covering the systems that will hold your data, for a recent period, with the auditing firm named and any exceptions explained. Type 2 reports test whether controls worked over time, not only whether they exist. Ask how the vendor plans for the proposed 2027 criteria (AICPA).

Is this the same as a DSP RFP?

No. A DSP RFP evaluates a buying platform; this one evaluates a platform that sells media on your data. Some questions overlap, such as fees, security and exit. Use the DSP RFP template for buying.

How this works on owned infrastructure

Several gates in this RFP ask the same thing in different words: does raw customer data leave your environment, and can you leave the vendor with everything you brought? With a hosted platform, the honest answers depend on the vendor's architecture and contract, and you verify them by audit. AdSovereign is an enterprise RTB stack with a DMP and clean room that is designed to run inside your own data centre or cloud account. Questions A2, C2 and H1 then become checks on your own configuration rather than promises to negotiate. The security page describes the controls it supports, and the architecture page shows where data sits.

Sources

Electronic Code of Federal Regulations via Cornell LII, 12 CFR 1016.12, "Limits on sharing account number information for marketing purposes" (accessed 9 November 2026). https://www.law.cornell.edu/cfr/text/12/1016.12
Cornell LII, 12 CFR 1016.13, "Exception to opt out requirements for service providers and joint marketing" (accessed 9 November 2026). https://www.law.cornell.edu/cfr/text/12/1016.13
Cornell LII, 15 U.S.C. 6802, "Obligations with respect to disclosures of personal information" (accessed 9 November 2026). https://www.law.cornell.edu/uscode/text/15/6802
Cornell LII, 15 U.S.C. 1681b, "Permissible purposes of consumer reports" (accessed 9 November 2026). https://www.law.cornell.edu/uscode/text/15/1681b
Cornell LII, 12 CFR 1022.21, "Use of eligibility information by affiliates for marketing purposes" (accessed 9 November 2026). https://www.law.cornell.edu/cfr/text/12/1022.21
California Privacy Protection Agency, California Consumer Privacy Act statute text, effective 1 January 2026, section 1798.145(e). https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf
Virginia Code, section 59.1-576, "Scope; exemptions" (accessed 9 November 2026). https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/
IAB and IAB Europe, "Guidelines for Incremental Measurement in Commerce Media" (3 November 2025). https://www.iab.com/wp-content/uploads/2026/01/IAB_and_IAB_Europe_Guidelines_Incremental_Measurement_Commerce_Media_November_2025.pdf
IAB and MRC, "Retail Media Measurement Guidelines" (January 2024). https://www.iab.com/wp-content/uploads/2024/01/IAB_Retail_Media_Measurement_Guidelines_January2024.pdf
AICPA and CIMA, "SOC 2" topic page with the notice on SOC services and the exposure drafts for proposed 2027 SOC 2 Trust Services Criteria (dated 26 October 2026; accessed 9 November 2026). https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2

More sources (4)

Cardlytics, Inc., Form 10-K for fiscal year 2025 (filed 4 March 2026). https://www.sec.gov/Archives/edgar/data/1666071/000166607126000010/cdlx-20251231.htm
PayPal, "CES 2026: PayPal Ads Unveils Transaction Graph Insights and Measurement Partnership Program" (6 January 2026). https://newsroom.paypal-corp.com/2026-01-06-PayPal-Ads-Unveils-Transaction-Graph-Insights-and-Measurement-Partnership-Program
Federal Reserve, "The 2025 Federal Reserve Payments Study: national payment volumes, top-line data, CY 2015-24" (1 July 2026). https://www.federalreserve.gov/paymentsystems/frps_cy2015_24_topline.htm
Media Rating Council, "Viewable Ad Impression Measurement Guidelines", Version 2.0 (18 August 2015). https://mediaratingcouncil.org/sites/default/files/Standards/081815%20Viewable%20Ad%20Impression%20Guideline_v2.0_Final.pdf

Changelog

9 November 2026. First edition: 40 questions in eight groups, six gates, 0-to-3 scale, CSV and DOCX-ready export, 12 scoring test cases. Next review 9 May 2027.

Author: Art Kukharenko, CEO, AdSovereign. Published: 10 November 2026. Last updated: 10 November 2026.

Commerce media RFP scorecard

Step 2 · Answer and score

A1. Which of our data sources does the platform ingest, and at what grain: transaction, account, household or device?

A2. Where is raw customer data processed and stored, and does any of it leave our environment? (gate: minimum 2)

A3. How are identities matched across our systems and partners, and what match rates do you see?

A4. How fast does an opt-out or consent change reach every audience and channel?

A5. Can we see and export the rules behind every audience segment?

B1. For each data use, which GLBA and Regulation P basis do you rely on, and who sends the notices? (gate: minimum 2)

B2. Does any feature disclose account numbers or access codes to a third party for marketing?

B3. Will any audience use consumer report data, or support credit or insurance offers?

B4. Which state privacy laws do you treat as applying, and how do you handle data outside the GLBA exemption?

B5. How do you stop sensitive inferences, such as health, from entering audiences?

C1. Which clean room or privacy-enhancing technology do you use, and who approves queries?

C2. What are the minimum aggregation thresholds, and can you change them without our approval?

C3. How do audiences reach offsite channels, and which identifier leaves our perimeter?

C4. What can an advertiser bring into the clean room, and what can it take out?

C5. How is matching to third-party data done, and is it disclosed?

D1. Do you run randomised holdouts or other controlled tests, and can we see the control design? (gate: minimum 2)

D2. Which attribution windows do you use, and are they disclosed before each campaign?

D3. What share of customers' spending does your data see, and how do you treat the rest?

D4. How do returns, chargebacks and late clearing change reported sales?

D5. Which independent partners can validate results with their own data?

E1. Which surfaces and formats are live, and which are planned, with dates?

E2. How are frequency and pacing controlled across surfaces?

E3. What creative review applies to regulated advertisers and categories?

E4. Do you measure viewability and invalid traffic on owned surfaces, to which standard?

E5. Can buyers reach inventory programmatically, and through which protocol and DSPs?

F1. List every fee: platform, data, media, revenue share, measurement and minimums. (gate: minimum 2)

F2. Is pricing tied to impressions, engagements or attributed sales, and how is an attributed sale defined?

F3. How is the revenue share to us calculated, and can we audit it?

F4. What service levels apply to uptime, support and reporting, with what credits?

F5. Which terms stop you using our data for your own products or other clients?

G1. Provide your latest SOC 2 Type 2 report: period, auditor, scope and exceptions. (gate: minimum 2)

G2. Which Trust Services Criteria are in scope, and how will you move to the 2027 criteria?

G3. Who manages encryption keys, and can we hold our own?

G4. Which subprocessors and regions handle our data?

G5. What are your incident response and notification commitments?

H1. At exit, can we export all our data, configurations, audiences and logs in documented formats, and at what cost? (gate: minimum 2)

H2. What happens to our data and derived models after termination, and how is deletion certified?

H3. How long will you run in parallel while we migrate?

H4. Can segments and measurement history move to another platform?

H5. Who owns code, models and configurations built for us?

Step 3 · Results

Key facts

How to use the commerce media platform RFP

The 40 questions

A. Data and identity (weight 15)

A1

A2 (gate)

A3

A4

A5

B. Privacy and legal basis (weight 15)

B1 (gate)

B2

B3

B4

B5

C. Clean room and activation (weight 12)

C1

C2

C3

C4

C5

D. Measurement and incrementality (weight 15)

D1 (gate)

D2

D3

D4

D5

E. Ad serving and formats (weight 8)

E1

E2

E3

E4

E5

F. Pricing and contract (weight 12)

F1 (gate)

F2

F3