Data minimization

The simplest way to protect data is not to collect it. Data minimization asks every system: do you really need this field, this precise location, this full birth date, and for how long? It is written into GDPR Article 5(1)(c), and appears in California's CCPA / CPRA regulations, India's India DPDP Act and other laws.

In advertising, minimisation might mean passing coarse location instead of GPS coordinates in bid requests, truncating IP addresses, limiting the data fields shared with each bidder, shortening retention of logs, or using aggregated reporting instead of user-level exports. The bidstream has been criticised by regulators for broadcasting more data to more parties than necessary.

There is a genuine tension with fraud detection, which benefits from rich signals. The practical answer is purpose-specific processing: collect the signals needed to detect invalid traffic, use them only for that purpose, secure them, and delete them when no longer needed. Minimisation is also a business advantage: less data means less breach risk and fewer compliance obligations.

Think of it like this

Data minimization is like packing for a trip with only what you will use, rather than bringing your entire wardrobe just in case.

An example

An SSP in Europe changes its bid requests to send only city-level location and truncated IPs to most bidders, keeping full IPs only for its accredited fraud-detection partner.