The ad tech glossary

309 terms, each answered in one sentence, then explained properly with an analogy and a worked example.

A

Antitrust in ad tech: Antitrust in ad tech refers to competition-law cases and investigations examining whether dominant companies, especially Google, have monopolised or abused their position in the technology used to buy and sell ads.
App Tracking Transparency (ATT): App Tracking Transparency (ATT) is Apple's framework, introduced with iOS 14.5 in 2021, requiring apps to ask users' permission before tracking them across other companies' apps and websites or accessing the IDFA.

CCPA / CPRA: The CCPA, as amended by the CPRA, is California's consumer privacy law giving residents rights to know, delete, correct and opt out of the sale or sharing of their personal information.
CMP (consent management platform): A CMP (consent management platform) is software that shows users privacy choices, such as a cookie banner, records their consent or opt-outs, and passes them to the site's partners.
Consent string: A consent string is a compact encoded value recording a user's privacy choices, such as the TCF TC String or a GPP string, that travels with ad requests to vendors.
COPPA: COPPA is the US Children's Online Privacy Protection Act, enforced by the FTC, which requires verifiable parental consent before collecting personal information from children under 13 online.

Data minimization: Data minimization is the privacy principle that organisations should collect and keep only the personal data that is adequate, relevant and necessary for a specific, stated purpose.
Digital Markets Act (DMA): The Digital Markets Act (DMA) is an EU regulation imposing competition-style obligations on designated "gatekeeper" tech platforms, including limits on combining personal data for ads without consent.
Digital Services Act (DSA): The Digital Services Act (DSA) is an EU regulation setting rules for online platforms on illegal content, transparency and user protection, including ad labelling, targeting limits and public ad repositories.

GDPR: The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
Global Privacy Control (GPC): Global Privacy Control (GPC) is a browser or extension setting that automatically tells every website a user visits that they do not want their personal data sold or shared.

IAB Global Privacy Platform (GPP): The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
IAB TCF (Transparency & Consent Framework): The IAB TCF (Transparency & Consent Framework) is IAB Europe's standard for collecting users' GDPR consent and objections through CMPs and passing those choices to ad tech vendors in a consent string.
India DPDP Act: India's Digital Personal Data Protection (DPDP) Act 2023 is the country's main data protection law, with Rules notified in November 2025 that bring its obligations into force in phases.

Legitimate interest: Legitimate interest is one of the GDPR's six lawful bases for processing personal data, allowing processing without consent when it is necessary for a genuine interest not overridden by the individual's rights.

PII (personally identifiable information): PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Pseudonymous data: Pseudonymous data is personal data where direct identifiers are replaced with a code, such as a hashed email or random ID, so it cannot identify someone without additional information kept separately.

United States v. Google (ad tech): United States v. Google (ad tech) is the US Justice Department's antitrust case in which a federal court ruled in April 2025 that Google illegally monopolised key open-web ad tech markets.