What this principle requires — and why some platforms don’t comply with it
The principle of “privacy by design” comes up in virtually every discussion about regulatory compliance in the AdTech sector. The thing is, in most cases, its meaning is misunderstood.
A common interpretation focuses on architecture: embedding privacy mechanisms into systems from the very beginning, rather than retroactively. This is true, but it’s only part of the picture. Article 25 of the GDPR requires “data protection by design and by default” — that is, both embedding privacy into the technical design and ensuring that the default state of any system, without any action on the part of the user, is the most privacy-secure of all possible options.
In the AdTech sector, this has specific practical implications that are often overlooked in broader discussions.
What Privacy by Design Means for Programmatic Platforms
The idea behind “Privacy by Design” in the context of programmatic advertising goes beyond a one-time setup. It is a commitment to keep technical specifications up to date as legislative requirements change.
OpenRTB — the protocol that governs the vast majority of programmatic advertising auctions — transmits consent and opt-out signals through the bid request chain. TCF consent strings, GPP signals, and Global Privacy Control (GPC) signals help communicate users’ privacy choices across the ad tech ecosystem. “Privacy by Design” means that when the legal requirements underlying these signals change, the platform’s technical specifications are updated automatically to reflect those changes — rather than relying on manual intervention — and proactively, not only when compliance measures necessitate such updates.
Here’s what “by default” basically means: a platform configured so that, in the absence of an explicit consent signal, tracking does not occur. It is not a platform where tracking occurs by default, but users can opt out. Nor is it a platform where the option to opt out is present in the interface but does not extend throughout the technical stack. It is a platform where the default state, without any action on the user’s part, ensures privacy protection.
The Ongoing Obligation: Keeping Specifications Current
Privacy laws are not static. Since 2020, the CCPA has undergone numerous amendments. They added to and expanded the GPC requirements. The definition of “personal information” was broadened. The rules regarding minors’ data became more specific. The EU AI Act introduced new requirements for automated decision-making that overlap with audience targeting.
From January 2025, fines for each CCPA violation have been increased to $2,663 for unintentional violations and up to $7,988 for violations involving minors — these have replaced the previous thresholds and will be reviewed every odd-numbered January. Each update to the legislation brings new technical requirements: consent management platforms must reflect the new requirements, the processing of opt-in requests must suppress or transmit the correct signals, and opt-out mechanisms must function in accordance with current legal standards, not those in effect two years ago.
“Privacy by Design” means having an appropriate process in place. It does not mean reacting to enforcement actions. Nor is it updating specifications after a settlement has been reached. It involves continuously monitoring changes in legislation and translating them into technical requirements — before the gap between the law and its implementation becomes grounds for a finding of violation.
The platforms that will be fined in 2026–2027 are, for the most part, not platforms that ignore privacy issues. They are platforms that, at a certain point, created a system that met the requirements but failed to maintain it as the requirements changed. The CPPA clearly addresses this point: ensuring compliance is not a “set it and forget it” task. Modern platforms are dynamic — marketing tags change, new integrations are added, and legal requirements are updated. Maintaining compliance requires constant attention to each of these areas.
What This Looks Like in Practice
A platform that operates in accordance with the “Privacy by Design” principle has three features that are typically lacking in platforms that merely claim to be committed to this principle:
Technical specifications that ensure the automatic processing of consent and opt-out signals. When a user opts out, data sharing stops — because the platform’s architecture is designed to process this signal and respond to it across all relevant systems, even if no one manually updates a list. When a new consent signal format is introduced, the platform’s specifications are updated to handle it before it becomes a legal requirement, not after.
A process for translating changes in legislation into technical requirements. Every time a new privacy law takes effect or an existing one is amended, a clearly defined process is initiated to analyze what changes need to be made to the technical specifications — processing of request-for-proposal fields, interpretation of consent strings, distribution of opt-out signals, data retention schedules — and these changes are implemented within established deadlines to ensure the platform’s compliance with legal requirements.
Default settings that ensure privacy protection without user intervention. The platform’s default state—for every new integration, every new publisher, and every new demand-side partner—is the most restrictive configuration permitted under the relevant consent signals. Expanding data sharing requires a conscious configuration decision, not merely the absence of restrictions.
Building and maintaining “Privacy by Design” in AdTech infrastructure is a specialized technical and legal skill. It requires an understanding of both how data flows work in programmatic advertising and what the current legal requirements are for each jurisdiction in which the platform operates.
If this is a gap in your current setup, please contact us.