Ad Tech Compliance
Ad Tech Compliance: Guides, Comparisons and Tools
Published · Last updated
Next scheduled review:
An advertising compliance review follows the information disclosed, the parties involved and the rules that apply to their roles. A hosting choice or consent interface cannot settle those questions alone. Use this guide to identify the relevant legal reference, map actual recipients and prepare evidence for a qualified reviewer.
Contents
Definition
Ad tech compliance is the application of relevant legal and contractual obligations to the roles, data disclosures and processing activities in an advertising workflow.
Start here
Newcomer: Map healthcare disclosures
Trace pixels, audience activation and sensitive-context disclosures before choosing a promotional workflow.
Buyer: Identify state-law scope
Use the dated tracker to locate statutes, effective dates and covered data.
Engineer: Review financial-data use
Separate transaction information, consumer groupings and the recipients involved in bank advertising.
Compare the decisions
3 of 3 rows
Healthcare flow | Whether protected information is disclosed | Context, parties, permissions and agreements | A universal advertising exemption |
State privacy scope | Which health-data duties may apply | Jurisdiction, definitions and dates | A substitute for current legal review |
Financial advertising | How financial information is used or shared | Data categories, recipients and permitted purposes | Permission derived from hosting location |
Healthcare flow
- What it answers
Whether protected information is disclosed
- Evidence to inspect
Context, parties, permissions and agreements
- What it does not establish
A universal advertising exemption
State privacy scope
- What it answers
Which health-data duties may apply
- Evidence to inspect
Jurisdiction, definitions and dates
- What it does not establish
A substitute for current legal review
Financial advertising
- What it answers
How financial information is used or shared
- Evidence to inspect
Data categories, recipients and permitted purposes
- What it does not establish
Permission derived from hosting location
Table by AdSovereign, CC BY 4.0.
Pages by purpose
References
- HIPAA and Advertising: Data, Permissions and Vendors: A concise reference on HIPAA advertising: protected health information, patient authorization, business associates and the limits of technical controls.
- Healthcare Tracking Pixels: Privacy and Data Risks: What healthcare tracking can disclose, why banners and server-side tagging are not complete answers, and what to inspect in the actual data flow.
- GLBA and Advertising: Bank Customer Data: How Regulation P treats bank customer data, disclosures and marketing exceptions, with separate security, state-law and credit-advertising considerations.
- HIPAA, PCI DSS and SOC 2 in Ad Tech: Compliance Explained: HIPAA, PCI DSS and SOC 2 in Ad Tech: a practical guide to the definitions, operating decisions, measurement and evidence you need.
- EU AI Act and Advertising: What Applies to Ad Tech: AI Act advertising rules by article: bans since Feb 2025, deepfake labels since Aug 2026, high-risk from Dec 2027. 16 provisions mapped to ad tech.
- Ad Tech Regulation Calendar 2027: Dates and Deadlines: Privacy law effective dates for 2027 and every ad tech deadline we could verify: 26 dated rows for US states, the EU and UK, checked 9 November 2026.
- CNIL Cookie Rules: Exemptions, Refuse-All and Fines: CNIL cookie rules explained: consent exemptions, the refuse-all button and 16 CNIL cookie fines, from Google's €100m in 2020 to Fnac's €7m in October 2026.
- Cookie Banner Rules by Country: EU, UK, US States: Cookie banner rules in 18 jurisdictions: legal basis, consent for ad cookies, reject button, GPC signals and fines. EU, UK, Switzerland, US states.
- EU Data Act for Ad Tech: Switching, Access, Interoperability: EU Data Act summary for ad tech: in force since 12 Sept 2025, egress charges end 12 Jan 2027, SaaS in scope, smart TV data rules, and Omnibus changes.
- DSA Advertising Transparency: Ad Labels, Bans, Repositories: DSA ad transparency explained: Article 26 labels, the profiling bans for minors and sensitive data, Article 39 repositories and the €120m X fine of 2025.
- Air-Gapped Ad Tech: When Regulators or Contracts Require It: What an air-gapped network means for ad tech, where isolation rules come from (FedRAMP, DoD IL5 and IL6, SecNumCloud) and what an ad stack can do offline.
- SOC 2 for Ad Tech: Type 1 vs Type 2, Criteria, Vendors: SOC 2 for ad tech explained: Trust Services Criteria, Type 1 vs Type 2, ISO 27001 compared, how to read a report, and which ad tech vendors state SOC 2.
- Fair Lending Advertising Rules for Targeted Ads: ECOA and Fair Housing Act advertising requirements for targeted ads after the 2026 Regulation B rule, with an 18-item checklist cited to law and cases.
- FCRA Prescreen Rules: Firm Offers, Opt-Out Notice, Ads: FCRA prescreen requirements: the firm offer of credit, short and long opt-out notices, the five-year opt-out, and what it means for credit-based ads.
- GLBA Joint Marketing Exception and Marketing Opt-Out: When GLBA requires a marketing opt-out, what the joint marketing exception and its contract allow, and a 13-row decision table with Regulation P cites.
- HIPAA Marketing Rule: Authorization, Exceptions, Forms: HIPAA marketing rules explained: the 45 CFR 164.501 definition, its exceptions, paid communications, sale of PHI and every required authorization element.
- HIPAA-Compliant Marketing Platforms: What It Really Means: HHS certifies no marketing platform. What "HIPAA compliant" means, and which of 27 email, CRM, analytics, CDP and tracking tools publicly offer a BAA.
- Digital Omnibus GDPR Status: Cookie and Ad Tech Tracker: Digital Omnibus status on 9 Nov 2026: Council mandate agreed 21 Oct, no Parliament position, no trilogue. Cookie, AI and GDPR texts compared side by side.
- Pharma Programmatic Advertising: Rules and Data Limits: Pharma advertising rules for programmatic: FDA 202.1, the 2025 DTC crackdown, HIPAA, FTC and state health data laws, mapped to five data sources.
- Data Residency Requirements by Country: Advertising Data: Data residency laws in 21 jurisdictions, checked 9 Nov 2026: which force in-country storage, which allow transfers, and what it means for ad data.
- Sovereign Cloud Providers Compared: AWS, Azure, Google, OVH: 11 sovereign cloud providers compared on operator, staff access, keys, SecNumCloud and C5 status, and launch dates. Checked with providers 9 Nov 2026.
- EU Cloud Sovereignty Framework Explained: SEAL Levels: The EU Cloud Sovereignty Framework rates cloud services on 8 objectives and SEAL-0 to SEAL-4. Both weight sets, the CADA proposal, ad tech impact.
- CMIA Advertising Rules and CCPA Health Data in California: California health data in ads: CMIA marketing limits for providers, pharma and health apps, CCPA sensitive data rights, penalties and the Healthline case.
- Connecticut Consumer Health Data Rules for Advertisers: CTDPA health data rules for ad tech: consent to sell, the 1,750-foot geofence ban, the July 2026 status definition and the October 2026 geolocation ban.
- Maryland Online Data Privacy Act: Sensitive Data Rules: Maryland MODPA for advertisers: sensitive data only when strictly necessary, no sale, a 1,750-foot geofence ban, inferences covered from 1 July 2026.
- Nevada Health Data Law (SB 370): Rules for Advertisers: Nevada SB 370 for ad tech: who counts as a consumer, two consents, a one-year sale form, the 1,750-foot geofence ban and penalties up to $15,000.
- New York Health Information Privacy Act: Status and Rules: NYHIPA (S9269) passed both houses in June 2026 but awaits delivery to the Governor. What it would require: a sale ban, authorizations, no ad exemption.
- My Health My Data Act: What It Means for Advertisers: Washington's My Health My Data Act for ad tech: health data that includes cookie IDs, two consents, a signed sale form, a 2,000-foot geofence ban, suits.
- Telehealth Advertising Rules After the FTC Cases: Telehealth advertising rules after GoodRx, BetterHelp, Cerebral and Monument: what the FTC orders ban, the 2024 HBNR, HHS tracking guidance, 2026 cases.
- UK Data (Use and Access) Act 2025: Cookies and Advertising: What the UK Data (Use and Access) Act 2025 changed for cookies from 5 February 2026: new consent exceptions, £17.5m fines, ICO guidance and the ad debate.
- GDPR, ePrivacy and TCF 2.3 and 2.4 Consent Signals: Device access, personal data and advertising consent signals. TCF participation and a consent string do not establish legal compliance.
Decision guides
- Bank Advertising: Illustrative Implementation Pattern: Plan a bank advertising evaluation with a data-flow inventory, permission review, access controls and a documented evidence plan.
- Bank Media Networks: Data Boundaries and Permissions: Bank media networks: separate payment systems, audience processing and advertiser access, then assess permissions for each data flow.
Trackers
- State Health Privacy Laws: Advertising Reference: Selected state health privacy rules for advertising: consent, sharing, sale, sensitive data and scope. A dated reference with primary-source links.
- US State Privacy Laws 2027: Tracker of All 24 Laws: 24 US state privacy laws checked on 9 Nov 2026: dates to 2028, thresholds, GPC, sensitive data, minors, cure periods, enforcers and recent enforcement.
Glossary
- PHI (protected health information): Definition and Example: Protected health information is individually identifiable health information covered by HIPAA, with scope depending on the holder and context.
- MHMDA (Washington My Health My Data Act): Washington's My Health My Data Act regulates covered consumer health data, including collection and sharing rules beyond HIPAA's entity boundary.
- GLBA (Gramm-Leach-Bliley Act): Definition and Example: The Gramm-Leach-Bliley Act sets financial privacy obligations, including rules for handling and disclosing covered nonpublic personal information.
Counsel checkpoints
- Ad Tech Legal Checkpoints: 10 Questions for Counsel: Ten open legal questions in health, financial and EU advertising data: the rule text, how readings differ and what to ask your counsel.
- BAA vs HIPAA Authorization for Ad Platforms: When an ad platform receives PHI, is a BAA needed, an authorization, or both? The rule text, where readings differ and 7 questions for counsel.
- Is Hashed or Cohort Data De-Identified Under HIPAA?: Hashed emails, cohorts and clean-room outputs against HIPAA's two de-identification methods, state and EU tests, and 6 questions for counsel.
- MODPA "Strictly Necessary": Health Data and Ads: Maryland limits sensitive data to what a requested service strictly needs and bans its sale. How readings differ for ads, and 6 questions for counsel.
- Pixel Lawsuits: Wiretap Act, CIPA, Party Exception: How the party exception and its crime-or-tort limit work in tracking pixel lawsuits, where courts differ by state, and 7 questions for counsel.
- GLBA Service Provider Exception and Ad Data: Does Regulation P's service provider exception cover an advertiser, a DSP or a clean room? Rule text, readings and 7 questions for counsel.
- Are Card Networks Covered by GLBA? Open Questions: GLBA defines financial institutions by activity. How that applies to card networks and their ad data, where readings differ, 6 questions for counsel.
- Bank Transaction Data for Ads: GDPR, PSD2, UK Rules: Using bank transaction data for advertising in the EU and UK: GDPR bases, PSD2 limits, silent-party data, and 8 questions for counsel.
- How to Read a Privacy Class Action Settlement Notice: Proposed, approved and paid are different stages. How to read a pixel settlement notice, find the court record, and 5 questions for counsel.
- Counsel Briefing Kit for Ad Tech Data Flows: A fact sheet, a question list and a decision record for briefing counsel on an advertising data flow. Free templates in Markdown and CSV.
- Is Contextual Advertising Outside GDPR and ePrivacy?: A context-only ad request can still carry a URL, IP address or device data. Rule text, how readings differ, and 6 questions for counsel.
- Is a TCF Consent String Enough for GDPR?: What a TC String records, what it does not prove, where regulators and industry differ on legitimate interest, and 6 questions for counsel.
What changed recently
Dated entries from the linked pages’ changelogs. Open the entry for the change and its source context.
November 10, 2026: Ad Tech Legal Checkpoints: 10 Questions for Counsel
November 10, 2026: BAA vs HIPAA Authorization for Ad Platforms
November 10, 2026: Bank Media Networks: Data Boundaries and Permissions
November 10, 2026: Bank Transaction Data for Ads: GDPR, PSD2, UK Rules
2026-11-10: Added the Counsel Checkpoints series: ten open legal questions with readings, facts and questions for counsel.
FAQ
Is a security certification enough for advertising compliance?
No. Security evidence describes controls within a scope. The legality of a disclosure depends on the data, purpose, organizational roles and applicable rules.
What should I give a legal reviewer?
Provide the real request payloads, page contexts, recipient list, contracts, permission records, retention rules and proposed use. A product label cannot substitute for that evidence.
How should I check a tracker entry before relying on it?
Open the linked law, court order or agency guidance. Check its scope and effective date, and separate proposals from requirements already in force.
Does server-side tracking eliminate a disclosure?
Moving the collection point does not by itself change the recipient or purpose of the resulting transfer. Inspect what leaves the server.
How should I use the tracker?
Follow the linked authoritative text and note the recorded date, covered data and effective status. Have the actual proposed workflow assessed before activation.
What to read next
How this works on owned infrastructure
Evaluate AdSovereign against a documented advertising data flow before assigning a compliance label. The architecture should identify collection points, data stores, audience decisions, delivery integrations and measurement recipients. Ask the security review for evidence about the controls and operating responsibilities in the proposed deployment, with scope and dates. A qualified reviewer must assess the legal basis and contractual requirements for the specific use; software ownership does not decide those issues. Keep a evaluation within approved data and integration boundaries and verify the resulting disclosures.
Component licensing, inclusions and payment terms are published on the pricing page.
Sources
Changelog
- November 9, 2026: added fuller reading paths, glossary links and dates from linked changelogs.
- October 25, 2026: organized legal references around healthcare disclosure, state-law scope and financial-data use without implying completed legal review.
- October 17, 2026: published the source-linked topic guide.