Curated REDS data practices

The following sections provide information on the collection, storage, processing and sharing of data in REDS. We recommend that our clients consult their own legal team for guidance on their obligations with respect to applicable laws and industry standards.

General Data Protection Regulation

The following sections apply to only customers or data that resides within the European Economic Area, United Kingdom, or Switzerland.

• REDS pixel implementation impact
• The Trade Desk REDS and GDPR

REDS pixel implementation impact

The Trade Desk supports GDPR the IAB Transparency and Consent Framework (TCF). GDPR has specific implications on how The Trade Desk’s pixel technology interacts with users in the European Economic Area (EEA). When Advertiser clients use The Trade Desk’s pixels and tags to set cookies, the cookies are The Trade Desk’s but, The Trade Desk acts as a data processor on behalf of the client for data collected through the cookie. Suppliers are responsible for ensuring appropriate consent prior to laying down pixels on site inventory. Clients may choose how the data is filtered based on their usage requirements of The Trade Desk provided log-level data.

The Trade Desk REDS and GDPR

Below is a rundown of what The Trade Desk is doing specifically:

• The Trade Desk is committed to ensuring compliance with global data protection laws, including the GDPR and UK GDPR. A global team of subject matter experts is available to help The Trade Desk meet industry requirements and standards. The Trade Desk believes the business impact of GDPR is industry-wide, and we work continually with our partners, through organizations like IAB Europe, to help determine and establish paths toward compliance by all parties that control and process data in the digital advertising industry.
• Internally, The Trade Desk has implemented a GDPR compliance program, refining data practices and adding additional policies and procedures, as needed.

California Consumer Privacy Act and REDS changes

The Trade Desk revised REDS to comply with the California Consumer Privacy Act (CCPA) and better reflect the current privacy climate. These revisions include conditional inclusion of rows, data precision reduction, and retention changes. Details are included in the When traffic originates from a US state with an active privacy regulation section.

Data alterations

• Publisher and inventory usage rights
• When traffic originates from GDPR regions
• When traffic originates from a US state with an active privacy regulation
• When traffic is associated with a political advertiser
• When conversion events originate from a third-party provider
• 90 days from event occurrence

Publisher and inventory usage rights

The Trade Desk is committed to ensuring compliance with agreements with our publishers and inventory providers. This may require us to obfuscate certain data fields as required under these agreements.

When traffic originates from GDPR regions

When traffic originates from the European Economic Area, or the United Kingdom, collectively GDPR Regions, traffic determined by IP address to have originated in GDPR Regions is covered by General Data Protection Regulation (GDPR). Which records you receive will be determined by which GDPR processing option you decide to use.

• If you choose to exclude the row, records originating from GDPR Regions will be removed from REDS delivery.
• If you choose pass-through, no data is altered, except for the last octet in the IP address.
• If you choose to scrub personal data, records originating from GDPR Regions will be included in REDS delivery with the following alterations:

EU health advertisers

The following data is scrubbed for EU health advertisers, regardless of the GDPR processing option chosen above.

When traffic originates from a US state with an active privacy regulation

Traffic determined to originate in one of the US states with active privacy regulation and is processed as indicated below.

We determine traffic originating from the specific states through the geo information sent with the bid request. If the geo information is empty, the IP address determines the origin of the traffic.

• If the US Privacy String or Global Privacy Platform (GPP) signal is present, and the string indicates an opt-out, yes, then we may not use any data from the request. Records from this traffic must have certain values scrubbed.

• If the US Privacy String signal is not present, and the Digital Advertising Alliance (DAA) signal or opt-out cookie is set, then we may not bid on the request. Records from traffic originating in California must have certain values scrubbed.

• In the case of no signal present, the data emitted is unaltered by any privacy related components.

NOTE: If any industry standard opt-out signals are set, then no data from the bid request is used and values independent of the geo information are scrubbed.

When traffic is associated with a political advertiser

For political advertisers with an AdvertiserCAtegory.CategoryId for Elections (Candidates and Issues) - 7925 , the following data alterations are made:

When conversion events originate from a third-party provider

All conversion data is removed.

90 days from event occurrence

Page Last Updated: February 12, 2026