Advertising privacy disclosures

Separate the advertising types

Contextual advertising selects ads from the content being viewed and may still involve cookies for frequency capping and fraud prevention. Personalized or interest-based advertising uses a profile built from activity across sites or apps. Retargeting shows ads to people who visited your site or used your app. Conversion measurement sends events such as purchases or sign-ups back to ad platforms to attribute results. Name the types you use; each changes what data flows and what choices users need.

Describe the tracking inputs

Advertising commonly relies on cookies, pixels and tags such as the Meta Pixel or Google tags, mobile advertising identifiers, SDKs from ad networks, hashed email or phone numbers uploaded for audience matching, page and app events, purchase values, and inferred interests. Say which of these you use, which partners receive them, and for which purposes. If you upload customer lists to ad platforms, disclose it explicitly.

Publisher ads have specific required wording

Networks that pay publishers often require exact disclosures. Google AdSense requires publishers to disclose that third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to the website or other websites, that Google's use of advertising cookies enables it and its partners to serve ads based on visits to your sites and other sites, and to tell users how to opt out of personalized advertising. The AdSense platform page covers this in detail.

Sale, sharing, and targeted advertising under US law

California treats disclosing personal information for cross-context behavioral advertising as sharing, even without payment, and other state laws define targeted advertising and give consumers the right to opt out of it. If your pixels or SDKs send activity to ad platforms for targeting, your policy should say that you sell or share personal information or process it for targeted advertising, explain the opt-out link or method, and state that opt-out preference signals such as Global Privacy Control are honored where required. Claiming that you never sell or share while running retargeting pixels is a common and visible inconsistency.

Consent in the EU, EEA, UK, and Switzerland

Advertising cookies and personalized ads generally require prior consent in Europe. Google's EU user consent policy requires publishers and advertisers using Google products to obtain consent for cookies or other local storage where legally required and for ads personalization, to identify each party that may collect or use personal data, to retain records of consent, and to give users a way to revoke it. Your policy should describe the consent tool and how choices can be changed later.

Children and sensitive contexts

Personalized advertising to children raises additional issues. The amended COPPA Rule, effective 23 June 2025 with a general compliance date of 22 April 2026, requires separate verifiable parental consent before disclosing children's personal information to third parties such as for targeted advertising, unless the disclosure is integral to the service. Health, finance, and other sensitive contexts may also restrict ad targeting under state laws and platform policies.

Keep implementation aligned with the text

Where consent is required, tags and SDKs must stay inactive until the choice is recorded and must respect later withdrawals. Where opt-outs apply, the link must work and the signal must reach the tags. Test the site with a fresh browser, an opt-out signal enabled, and consent declined, and confirm that no ad requests fire contrary to what the policy says.

Apps and advertising identifiers

In mobile apps, advertising SDKs read the device advertising identifier where the platform allows it. On iOS, access to the identifier for tracking requires permission through App Tracking Transparency, and on Android users can reset or delete the advertising ID. The policy should state whether the app uses advertising identifiers, for what purposes, and how users can limit them.

How the generator handles advertising

The questionnaire asks for the advertising level, none, contextual, personalized, or retargeting, the providers used, the tracking-consent behavior, and the sale or sharing answer where US state modules apply. Contradictory answers, such as selecting no advertising while listing an ad provider, are flagged before generation.

Common questions