A publisher's real-time bidding stack broadcasts user pseudonymous IDs and URL context to dozens of bid requesters without intelligible notice of recipients or purposes. Which compliance concern is strongest?
Select an answer to reveal the explanation.
Short Explanation
If your ID is sprayed to a crowd of bidders before anyone explains who gets it or why, transparency already tripped. Speed of the auction does not erase purpose limitation or the need for a real legal basis. RTB still has to answer GDPR basics.
Full Explanation
A publisher’s real-time bidding stack that broadcasts user pseudonymous IDs and URL context to dozens of bid requesters without intelligible notice of recipients or purposes raises strongest concern that RTB-style sharing of identifiers challenges transparency, purpose limitation, and lawful-basis requirements for personal data in adtech. Spraying an ID to a crowd of bidders before explaining who gets it undermines people’s ability to understand the marketplace behind a page view. Claiming RTB is exempt from purpose limitation because auctions complete in milliseconds fails—speed is not a legal exemption. Saying unique advertising IDs are anonymous by definition once truncated fails when they still single out users. Asserting publishers need only disclose the winning advertiser, never the bid ecosystem, fails transparency about recipients and purposes in the wider chain. Exam caveat: pseudonymous IDs used to target or distinguish users remain personal data; millisecond auctions do not erase Articles 5–6 or notice duties. Operational check: map every bid recipient category, minimise data in bid requests, obtain valid consent for non-essential tracking, improve layered notices, and contractually constrain downstream adtech uses.