Effective January 12th 2026

Table of Contents

This Quantcast Measure Terms of Service (this“Agreement”)describes the terms and conditions on which Quantcast makes Quantcast Measure (the“Services”)available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, USING THE SERVICES OR ENTERING INTO AN OFFLINE AGREEMENT THAT REFERENCES THIS AGREEMENT OR INCLUDES A LINK TO THIS AGREEMENT, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

This Agreement incorporates thePrivacy Implementation forQuantcast Publisher Partners.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call,“Reachpoints”)for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call,“Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the“Measurement Results”,which we make available to you on the Quantcast website (see Section 3).

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Information when registering for a Quantcast account will be processed in accordance with the Quantcast Website and Corporate Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions

provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, you agree not to tag any Reachpoint revealing data regarded as “sensitive” or “special category” Personal Information under Applicable Privacy Laws, including data revealing racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, trade union membership, or health. You further agree not to tag any website that contains information about health conditions or treatments or that might otherwise reveal or suggest an individual’s health status or treatment. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Information from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information (i.e., information that can be used to contact or identify a particular individual, including name, address, telephone number, email address, financial account number or government-issued identifier) of end users. To the extent that the web

pages or apps in which you place the Technology are accessed by end users located in Europe, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and

(iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. You agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Information is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for companies established outside of Europe or a consent revocation page for companies established in Europe. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the“Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

Unless agreed otherwise, you and Quantcast are each separate and independent Businesses or Controllers of any Personal Information which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of Processing of any Personal Information disclosed or received under this Agreement.

Each party shall comply with the obligations that apply to it under Applicable Privacy Laws and provide Personal Information Processed pursuant to this Agreement the level of privacy protection required by such laws. In the event that either party determines that it can no longer meet its privacy obligations under this Agreement or the Privacy Laws, it shall inform the other party without undue delay.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell or Share My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

You represent and warrant that you are not a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”), and you do not have equivalent status under comparable local or international laws and regulations.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Services to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly

display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailingcontact@quantcast.com (if you are resident in the US) orcontact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for

termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services will constitute your acceptance thereof.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California.This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp. 795 Folsom Street

San Francisco, CA 94107 Attn: Legal Department

Email:contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited Beaux Lane House

Lower Mercer Street, 1st Floor Dublin 2, Ireland

Attn: Legal Department

Email:contact.dublin@quantcast.com

“Applicable Privacy Laws”means any applicable international, federal, state, or local privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including but not limited to (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq.as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”); (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive; (d) The Brazilian General Data Protection Law, Law No. 13.709, of August 14, 2018 (“LGPD”)”.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business”has the same meaning as in CCPA.“Measurement Data”has the meaning given to it in Section 1.“Measurement Results”has the meaning defined in Section 1.

“Personal Information”means information that identifies, relates to, describes, is reasonably capable of being associated with, or

could reasonably be linked, directly or indirectly, with a particular individual or household and any other information that may otherwise be considered “personal information” or “personal data” under Applicable Privacy Law.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property”has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective December 10th 2024  to  January 12th 2026

Table of Contents

This Quantcast Measure Terms of Service (this“Agreement”)describes the terms and conditions on which Quantcast makes Quantcast Measure (the“Services”)available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, USING THE SERVICES OR ENTERING INTO AN OFFLINE AGREEMENT THAT REFERENCES THIS AGREEMENT OR INCLUDES A LINK TO THIS AGREEMENT, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

This Agreement incorporates theUS State Data Privacy Addendum to the extent that the Services include processing personal information that is subject to U.S. State Privacy Laws (as defined in the foregoing Addendum) and thePrivacy Implementation forQuantcast Publisher Partners.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call,“Reachpoints”)for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call,“Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the“Measurement Results”,which we make available to you on the Quantcast website (see Section 3).

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Information when registering for a Quantcast account will be processed in accordance with the Quantcast Website and Corporate Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions

provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, you agree not to tag any Reachpoint revealing data regarded as “sensitive” or “special category” Personal Information under Applicable Privacy Laws, including data revealing racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, trade union membership, or health. You further agree not to tag any website that contains information about health conditions or treatments or that might otherwise reveal or suggest an individual’s health status or treatment. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Information from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information (i.e., information that can be used to contact or identify a particular individual, including name, address, telephone number, email address, financial account number or government-issued identifier) of end users. To the extent that the web

pages or apps in which you place the Technology are accessed by end users located in Europe, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and

(iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. You agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Information is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for companies established outside of Europe or a consent revocation page for companies established in Europe. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the“Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

Unless agreed otherwise, you and Quantcast are each separate and independent Businesses or Controllers of any Personal Information which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of Processing of any Personal Information disclosed or received under this Agreement.

Each party shall comply with the obligations that apply to it under Applicable Privacy Laws and provide Personal Information Processed pursuant to this Agreement the level of privacy protection required by such laws. In the event that either party determines that it can no longer meet its privacy obligations under this Agreement or the Privacy Laws, it shall inform the other party without undue delay.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell or Share My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

You represent and warrant that you are not a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”), and you do not have equivalent status under comparable local or international laws and regulations.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Services to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly

display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailingcontact@quantcast.com (if you are resident in the US) orcontact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for

termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services will constitute your acceptance thereof.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California.This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp. 795 Folsom Street

San Francisco, CA 94107 Attn: Legal Department

Email:contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited Beaux Lane House

Lower Mercer Street, 1st Floor Dublin 2, Ireland

Attn: Legal Department

Email:contact.dublin@quantcast.com

“Applicable Privacy Laws”means any applicable international, federal, state, or local privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including but not limited to (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq.as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”); (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive; (d) The Brazilian General Data Protection Law, Law No. 13.709, of August 14, 2018 (“LGPD”)”.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business”has the same meaning as in CCPA.“Measurement Data”has the meaning given to it in Section 1.“Measurement Results”has the meaning defined in Section 1.

“Personal Information”means information that identifies, relates to, describes, is reasonably capable of being associated with, or

could reasonably be linked, directly or indirectly, with a particular individual or household and any other information that may otherwise be considered “personal information” or “personal data” under Applicable Privacy Law.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property”has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective April 5th 2024  to  December 10th 2024

Table of Contents

If you have an active, duly executed contract for Quantcast services (“Existing Contract”), the Existing Contract will govern your use of the service(s) covered in the Existing Contract instead of these Quantcast Measure Terms of Service (“Terms”). In addition, these Terms only apply to the Quantcast Measure service (i.e., the “Service” as described below) and not to any other Quantcast product or service.

Quantcast Measure Terms of Service

This Quantcast Measure Terms of Service (this“Agreement”)describes the terms and conditions on which Quantcast makes Quantcast Measure (the“Services”)available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, USING THE SERVICES OR ENTERING INTO AN OFFLINE AGREEMENT THAT REFERENCES THIS AGREEMENT OR INCLUDES A LINK TO THIS AGREEMENT, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

This Agreement incorporates theUS State Data Privacy Addendum to the extent that the Services include processing personal information that is subject to U.S. State Privacy Laws (as defined in the foregoing Addendum) and thePrivacy Implementation for Quantcast Publisher Partners.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call,“Reachpoints”)for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call,“Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the“Measurement Results”,which we make available to you on the Quantcast website (see Section 3).

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Information when registering for a Quantcast account will be processed in accordance with the Quantcast Website and Corporate Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.

4. Tagging Rules and Privacy.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, you agree not to tag any Reachpoint revealing data regarded as “sensitive” or “special category” Personal Information under Applicable Privacy Laws, including data revealing racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, trade union membership, or health. You further agree not to tag any website that contains information about health conditions or treatments or that might otherwise reveal or suggest an individual’s health status or treatment. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Information from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information (i.e., information that can be used to contact or identify a particular individual, including name, address, telephone number, email address, financial account number or government-issued identifier) of end users. To the extent that the web pages or apps in which you place the Technology are accessed by end users located in Europe, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and (iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. You agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Information is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for companies established outside of Europe or a consent revocation page for companies established in Europe. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the“Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

Unless agreed otherwise, you and Quantcast are each separate and independent Businesses or Controllers of any Personal Information which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of Processing of any Personal Information disclosed or received under this Agreement. Each party shall comply with the obligations that apply to it under Applicable Privacy Laws and provide Personal Information Processed pursuant to this Agreement the level of privacy protection required by such laws. In the event that either party determines that it can no longer meet its privacy obligations under this Agreement or the Privacy Laws, it shall inform the other party without undue delay.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell or Share My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Services to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailing contact@quantcast.com (if you are resident in the US) or contact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services will constitute your acceptance thereof.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California.This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp.
795 Folsom Street
San Francisco, CA 94107
Attn: Legal Department
Email: contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited
Beaux Lane House
Lower Mercer Street, 1st Floor
Dublin 2, Ireland
Attn: Legal Department
Email: contact.dublin@quantcast.com

14. Definitions

“Applicable Privacy Laws”means any applicable international, federal, state, or local privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including but not limited to (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq.as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”); (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive; (d) The Brazilian General Data Protection Law, Law No. 13.709, of August 14, 2018 (“LGPD”)”.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business”has the same meaning as in CCPA.

“Measurement Data”has the meaning given to it in Section 1.

“Measurement Results”has the meaning defined in Section 1.

“Personal Information”means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household and any other information that may otherwise be considered “personal information” or “personal data” under Applicable Privacy Law.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property”has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective August 17th 2023  to  April 5th 2024

Table of Contents

If you have an active, duly executed contract for Quantcast services (“Existing Contract”), the Existing Contract will govern your use of the service(s) covered in the Existing Contract instead of these Quantcast Measure Terms of Service (“Terms”). In addition, these Terms only apply to the Quantcast Measure service (i.e., the “Service” as described below) and not to any other Quantcast product or service.

Quantcast Measure Terms of Service

This Quantcast Measure Terms of Service (this“Agreement”)describes the terms and conditions on which Quantcast makes Quantcast Measure (the“Services”)available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, USING THE SERVICES OR ENTERING INTO AN OFFLINE AGREEMENT THAT REFERENCES THIS AGREEMENT OR INCLUDES A LINK TO THIS AGREEMENT, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

This Agreement incorporates theUS State Data Privacy Addendum to the extent that the Services include processing personal information that is subject to U.S. State Privacy Laws (as defined in the foregoing Addendum) and thePrivacy Implementation for Quantcast Publisher Partners.

1. Introduction: Reachpoints, Tags, and Measurement Data.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call,“Reachpoints”)for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call,“Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the“Measurement Results”,which we make available to you on the Quantcast website (see Section 3).

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

1. Registration.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Information when registering for a Quantcast account will be processed in accordance with the Quantcast Website and Corporate Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

1. Measurement Data and Results.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.
5. Tagging Rules and Privacy.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, you agree not to tag any Reachpoint revealing data regarded as “sensitive” or “special category” Personal Information under Applicable Privacy Laws, including data revealing racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, trade union membership, or health. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Information from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information (i.e., information that can be used to contact or identify a particular individual, including name, address, telephone number, email address, financial account number or government-issued identifier) of end users. To the extent that the web pages or apps in which you place the Technology are accessed by end users located in Europe, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and (iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. You agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Information is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for companies established outside of Europe or a consent revocation page for companies established in Europe. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the“Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

Unless agreed otherwise, you and Quantcast are each separate and independent Businesses or Controllers of any Personal Information which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of Processing of any Personal Information disclosed or received under this Agreement. Each party shall comply with the obligations that apply to it under Applicable Privacy Laws and provide Personal Information Processed pursuant to this Agreement the level of privacy protection required by such laws. In the event that either party determines that it can no longer meet its privacy obligations under this Agreement or the Privacy Laws, it shall inform the other party without undue delay.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell or Share My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

1. Restrictions.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Services to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.
5. Quantcast Rights.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

1. Indemnity.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

1. Warranty Disclaimer.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

1. Suspension and Termination.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailing contact@quantcast.com (if you are resident in the US) or contact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

1. Modification of the Service and of the Terms.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services will constitute your acceptance thereof.

1. Limitation of Liability.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

1. Miscellaneous.

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California.This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

1. Notice.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp.
795 Folsom Street
San Francisco, CA 94107
Attn: Legal Department
Email: contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited
Beaux Lane House
Lower Mercer Street, 1st Floor
Dublin 2, Ireland
Attn: Legal Department
Email: contact.dublin@quantcast.com

1. Definitions

“Applicable Privacy Laws”means any applicable international, federal, state, or local privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including but not limited to (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq.as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”); (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive; (d) The Brazilian General Data Protection Law, Law No. 13.709, of August 14, 2018 (“LGPD”)”.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business”has the same meaning as in CCPA.

“Measurement Data”has the meaning given to it in Section 1.

“Measurement Results”has the meaning defined in Section 1.

“Personal Information”means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household and any other information that may otherwise be considered “personal information” or “personal data” under Applicable Privacy Law.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property”has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

1. Contracting Party.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective July 23rd 2021  to  August 17th 2023

Table of Contents

Quantcast Measure and Q for Publishers Terms of Service

Effective: January 1, 2020

Once you have agreed to theseTerms and Conditions you will be able to download and install the Quantcast Measure Tag. These terms will apply only after such download and installation.

This Quantcast Measure and Q for Publishers Terms of Service (this“Agreement”) describes the terms and conditions on which Quantcast makes Quantcast Measure and Q for Publishers (the“Services”) available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, OR USING THE SERVICES, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

1. Introduction: Reachpoints, Tags, and Measurement Data.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call, “Reachpoints”) for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call, “Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the “Measurement Results”, which we make available to you on the Quantcast website (see Section 3). For more information about how the Services work, please see ourFAQ.

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

2. Registration.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Data when registering for a Quantcast account will be processed in accordance with the Quantcast Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

3. Measurement Data and Results.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.

4. Tagging Rules and Privacy.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, if you are an EU established company or person or your Reachpoints are directed towards end users in the EU, you agree not to tag any Reachpoint revealing other sensitive or special category Personal Data, including racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, or trade union membership. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Data from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information of end users. To the extent that the web pages or apps in which you place the Technology are accessed by end users in the EU, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework (such asQuantcast Choice) or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and (iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. Wherever possible, you agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Data is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for non-EU established companies or a consent revocation page for EU established companies. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the “Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

To the extent that GDPR applies, you and Quantcast are each separate and independent data controllers of any Personal Data which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of processing of any Personal Data disclosed or received under this Agreement.

To the extent that CCPA applies, Quantcast is a Third Party in its relationship with you regarding your use of the Services.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

5. Restrictions.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Service to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.

6. Quantcast Rights.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

7. Indemnity.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

8. Warranty Disclaimer.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

9. Suspension and Termination.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailingcontact@quantcast.com (if you are resident in the US) orcontact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

10. Modification of the Service and of the Terms.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services, after 30 days, will constitute your acceptance thereof.

11. Limitation of Liability.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

12. Miscellaneous.

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California. This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

13. Notice.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp.
795 Folsom Street
San Francisco, CA 94107
Attn: Legal Department
Email:contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited
Beaux Lane House
Lower Mercer Street, 1st Floor
Dublin 2, Ireland
Attn: Legal Department
Email:contact.dublin@quantcast.com

14. Definitions

“Applicable Privacy Laws”means any applicable privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including, where applicable, (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq. (“CCPA”); and; (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business” has the same meaning as in CCPA.

“Measurement Data”has the meaning given to it in Section 1.

“Measurement Results”has the meaning defined in Section 1.

“Personal Data” has the same meaning as in GDPR.

“Personal Information” has the same meaning as in CCPA.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property” has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

“Third Party”has the same meaning as in CCPA.

15. Contracting Party.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective July 21st 2021  to  July 23rd 2021

Table of Contents

Quantcast Measure and Q for Publishers Terms of Service

Effective: January 1, 2020

Once you have agreed to theseTerms and Conditions you will be able to download and install the Quantcast Measure Tag. These terms will apply on after such download and installation.

This Quantcast Measure and Q for Publishers Terms of Service (this“Agreement”) describes the terms and conditions on which Quantcast makes Quantcast Measure and Q for Publishers (the“Services”) available to you.

BY CLICKING THE “I ACCEPT” BUTTON, COMPLETING THE REGISTRATION PROCESS, OR USING THE SERVICES, YOU ARE AGREEING TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY, IN WHICH CASE THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY (OR, IF SUCH ENTITY IS ACTING AS AN AUTHORIZED AFFILIATE, THEN THE TERMS “YOU” OR “YOUR” WILL REFER TO SUCH ENTITY, THE AUTHORIZING PARTY(IES), OR BOTH, AS APPLICABLE). QUANTCAST MAY MODIFY THIS AGREEMENT FROM TIME TO TIME; CONTINUED USE 30 DAYS AFTER NOTIFICATION WILL CONSTITUTE ACCEPTANCE (SEE SECTION 10).

Capitalized terms not otherwise defined herein are defined in Section 14.

1. Introduction: Reachpoints, Tags, and Measurement Data.

Quantcast Measure is a free digital audience measurement service that allows you to tag web pages, video, advertisements, apps, content, and paid search campaigns (what we call, “Reachpoints”) for direct measurement.

You can also define and measure actions and events by customizing your Tags with labels. You have complete control over (and are solely responsible for) which Reachpoints are tagged, how segments are labelled (e.g., with meaningful or obfuscated names), and how the resulting Measurement Results are or are not disclosed publicly.

Each time a browser visits your tagged Reachpoints, Quantcast may, in accordance with Applicable Privacy Laws, collect traffic statistics like those in any web server log (what we call, “Measurement Data”). We then apply proprietary Quantcast algorithms and other data to the Measurement Data to generate the “Measurement Results”, which we make available to you on the Quantcast website (see Section 3). For more information about how the Services work, please see ourFAQ.

To measure Reachpoints that you do not own or control, you may provide your Tag to a third party who accepts this Agreement (any such third party, an“Authorized Affiliate”); you may also instruct us to give the Authorized Affiliate access to the Measurement Results.

2. Registration.

In order to access the Services you must register for a Quantcast account on the Quantcast website. Each new app you Tag requires its own registration and then receives its own unique API key. In registering, you agree to provide accurate, current, and complete information, and to keep it up to date. Any processing of Personal Data when registering for a Quantcast account will be processed in accordance with the Quantcast Privacy Policy which you can accesshere.

You are responsible for keeping your password confidential. You hereby take responsibility for all actions taken—and instructions provided to Quantcast—under your account or with the Measurement Results, by you or any third parties, whether or not authorized. You will notify Quantcast immediately of any unauthorized or non-compliant use of your account and will cooperate with us in stopping it.

3. Measurement Data and Results.

Quantcast uses each piece of Measurement Data both to understand your audience (for your benefit only) and as one of trillions of data points for predictive analytics and in determining what content and advertising to show individuals across the internet and other digital applications. You acknowledge that Quantcast may use Personal Information it receives from you to provide services to other Quantcast clients or for Quantcast’s commercial interests that may be unrelated to providing the Services to you.

Quantcast will never sell your audience (whether identified as such or not) and you control the extent to which Quantcast displays the Measurement Results.

Quantcast grants you perpetual rights to use, copy, and distribute the Measurement Results, including with our sharable widgets, only as long as you:

1. Credit Us. Conspicuously include: “Source: Quantcastwww.quantcast.com”;
2. Present the Measurement Results Exactly as We Provided It. Do not: (i) manipulate or modify the Measurement Results to state or suggest different results from those specifically presented by Quantcast; (ii) combine information related to different Quantcast profiles (for example, by adding together the reach from two different sites instead of presenting the cross-site unduplicated reach measurement provided by Quantcast); (iii) quantitatively aggregate or combine information in the Measurement Results with information derived from other sources (but offering a comparison with information derived from other sources is permissible);
3. Don’t Use Our Work to Compete with Us. Do not use the information in the Measurement Results in any way that competes with Quantcast; and
4. Bind Third Parties. If you provide the information in the Measurement Results directly to any third party (rather than by having them access the information through the Quantcast website), you must ensure that they agree to be bound by and comply with the terms of this Agreement including the foregoing requirements.

4. Tagging Rules and Privacy.

You agree not to misrepresent your digital traffic, audience, or user activity in connection with Quantcast, the Services, or any Tags. You agree not to tag any adware or spyware inventory, or any Reachpoint revealing precise geographic location (i.e., information that describes the precise location of a device derived through any technology that is capable of determining with reasonable specificity the actual physical location of an individual or device), specific health / medical /sex-life information, credit card or financial data, or criminal convictions or charges. In addition, if you are an EU established company or person or your Reachpoints are directed towards end users in the EU, you agree not to tag any Reachpoint revealing other sensitive or special category Personal Data, including racial or ethnic origin, political opinions or parties, religious or philosophical beliefs, or trade union membership. If you represent to Quantcast (e.g., during the signup process) that your Reachpoints are directed to users under the age of 16, Quantcast will not collect any Personal Data from such Reachpoints and you will not receive those of our services that require collection of data across different websites. You will not modify the Tag other than as described in aQuantcast Learning Center Guide. You agree to update your Tag (which may require retagging your Reachpoints) when we notify you of any Tag fixes, updates or upgrades. You will use the Tag in the top most frame possible. You will retain the Tag’s origin address that we provided, in full.

You agree to comply with Applicable Privacy Laws and also industry self-regulation Principles and Codes of Conduct for interest-based advertising in connection with your use of the Tag and the Services. You agree not to use the Services to track or collect personally identifiable information of end users. To the extent that the web pages or apps in which you place the Technology are accessed by end users in the EU, you agree to implement a transparency and consent solution compatible with theIAB Europe Transparency and Consent Framework (such asQuantcast Choice) or another solution mutually agreed by both parties in writing. While you are implementing such consent solution, you agree to (i) obtain consent for Quantcast to use cookies and similar technologies in compliance with Applicable Privacy Laws, (ii) provide proof of such consent if requested by Quantcast, and (iii) not permit calls from your web pages or apps to Quantcast servers if such consent has not be obtained. Wherever possible, you agree to name Quantcast as a party for or by whom cookies or similar technologies are used to access the device and Personal Data is collected through your webpages or apps.

You further agree to prominently display to end users a user friendly, easily accessible, clear and comprehensive privacy policy (and, if necessitated by Applicable Privacy Laws, a separate cookie policy) that, where required, complies with Applicable Privacy Laws and contains the following (a) a statement that your site or app permits data collection for interest-based advertising, (ii) a description of the types of data collected for such advertising, (iii) an explanation of the purposes for which data is collected by, or transferred to, third parties, and (iv) a conspicuous link to either an opt-out mechanism, such as the NAI or DAA opt-outs for non-EU established companies or a consent revocation page for EU established companies. If you use the Services to collect data from a network of domains or subdomains, you will inform each in advance of such disclosures.

In the case of app measurement, operating system platforms provide device-level setting options that allow end users to indicate their preference with respect to third party data collection and targeted advertising (the “Ad Preference Setting”). Quantcast treats these device level Ad Preference Settings as consumer opt-outs and you will accurately pass the Ad Preference Setting to Quantcast. You will not send any identifier associated with a device to the extent that such device has otherwise indicated that the end user wishes to be opted out of advertisement tracking.

To the extent that GDPR applies, you and Quantcast are each separate and independent data controllers of any Personal Data which you and we may disclose or receive under this Agreement. You and Quantcast, pursuant to this Agreement, do not and will not jointly determine the purposes or the means of processing of any Personal Data disclosed or received under this Agreement.

To the extent that CCPA applies, Quantcast is a Third Party in its relationship with you regarding your use of the Services.

If you are a Business subject to CCPA, you agree to prominently post a “Do Not Sell My Personal Information” link on all of your Reachpoints, and to provide consumers with the disclosures required of Businesses by CCPA.

5. Restrictions.

You agree to use the Services only in accordance with the terms and conditions of this Agreement. You will not use the Service to engage in any illegal or offensive acts or serve any illegal content via any Reachpoint. You will not:

1. Interfere or attempt to interfere with the operation or security-related features of the Services or the Technology;
2. Delete, or in any manner alter, the copyright, trademark, or other proprietary rights notices appearing on any Quantcast Content;
3. Represent that Quantcast endorses or supports your services; make any representations and warranties concerning any aspect of the Services, the Technology, or Measurement Results to any Authorized Third Parties or other third parties; or
4. Attempt to index, scrape, search, or crawl the Services or the Quantcast website with any automated process; or attempt to access any information or technology relating to the Services, the Quantcast website, or our proprietary algorithms through any means not intentionally made available by Quantcast to you.

6. Quantcast Rights.

All right, title, and interest, including intellectual property rights, in and to the Quantcast website, the Services, the Technology, and the Quantcast Content are and will remain the exclusive property of Quantcast (“Quantcast Property”). Except as expressly permitted in this Agreement, you will not reproduce, modify, or prepare derivative works based upon, distribute, license, sell, transfer, publicly display, publicly perform, transmit, or use such Quantcast Property. In the event that your Quantcast account is suspended or terminated, Quantcast will continue to respect this Agreement’s limits on our use of the Measurement Data and will cease all public display of the Measurement Results.

Quantcast servers may choose to occasionally respond to any publisher’s Tag by redirecting the browser to a third-party anonymous beacon to support the provision of Quantcast services in market. The decision to beacon is not related to you, your traffic, or your user base.

7. Indemnity.

Quantcast agrees to defend, indemnify, and hold you harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim that the Technology or the Services infringe any U.S. or European intellectual property rights, provided that you (i) promptly inform and furnish Quantcast with a copy of each related communication and action, (ii) allow Quantcast to assume full control of the defense and settlement, and (iii) assist and cooperate with Quantcast, at Quantcast’s expense. Quantcast will have no obligation or liability hereunder where the claim results from any combination with, addition to, or modification of the Services or the Technology, from your failure to update your Tag, from your or any Authorized Affiliate breach of this Agreement, or from failure to obtain consent for your and our use of cookies or other tracking technology in accordance with Applicable Privacy Laws. If the Services or Technology become, or, in Quantcast’s opinion are likely to become, the subject of a third-party claim against you, Quantcast may, at its option and expense, procure rights for you to continue using the Services or the Technology, replace or modify the same so that it performs substantially similar functions but does not infringe, or terminate this Agreement.The foregoing states the sole and exclusive liability of Quantcast and your sole remedy with respect to third party claims of any kind.

You agree to indemnify and hold Quantcast harmless from any judgments, damages, loss, liability, or costs (including reasonable attorneys’ fees) resulting from a third-party claim resulting from your failure to update your Tag when we notify you of any Tag fixes, updates or upgrades.

8. Warranty Disclaimer.

The services and related information are provided “as is,” without warranty or condition of any kind, either express or implied. Without limiting the foregoing, Quantcast explicitly disclaims any warranties of merchantability, fitness for a particular purpose, quiet enjoyment, or non-infringement. Quantcast makes no warranty that the Services, the Quantcast website, or the Quantcast content will (1) meet your requirements, (2) be available on an uninterrupted, secure, or error-free basis, or (3) not cause any latency or processing delays. Quantcast is under no obligation to retain any Measurement Data or to keep the site up and running for any period of time. Quantcast makes no warranty regarding the accuracy, timeliness, truthfulness, completeness, or reliability of any information obtained through the Services, the Quantcast website, or the Quantcast content. No information, whether oral or written, will create any warranty or representation not expressly made herein. The foregoing exclusions and disclaimers are an essential part of this Agreement and formed a basis for enabling Quantcast to offer the Services to you. Some jurisdictions do not allow exclusion of certain warranties so this disclaimer may not apply to you in full.

9. Suspension and Termination.

Unless otherwise terminated as set forth herein, this Agreement will remain in full force and effect while you use the Services. You may terminate your Quantcast account and this Agreement at any time by both (i) “dequantifying” by deleting all Reachpoints from your profile on the Quantcast website (or, alternatively, by emailingcontact@quantcast.com (if you are resident in the US) orcontact.dublin@quantcast.com (if you are resident outside the US) with your complete account information and explicit request to terminate) and (ii) removing the Tags from all of your Reachpoints. Quantcast may terminate or suspend your access to the Services or terminate this Agreement at any time, for any reason or no reason and without any liability to you. Upon termination, all licenses and other rights granted to you under this Agreement will immediately cease. Quantcast will not be liable to you or any third party for termination of this Agreement (whether by Quantcast or by you) or any termination or suspension of your use of the Services. Upon any termination or suspension, information in connection with your account may no longer be accessed by you. Notwithstanding the above, Sections 4 through 9, Sections 11 through 13, and the second paragraph of Section 3 will survive termination.

10. Modification of the Service and of the Terms.

Quantcast reserves the right, in its sole discretion, to modify or discontinue the Quantcast website and Services without notice. Quantcast may also modify this Agreement from time to time. If the modified Agreement is not acceptable to you, you may terminate your account within 30 days by following the two-step procedure described in Section 9. Use of the Quantcast website, use of any Tag to contact Quantcast’s servers, or use of the Services, after 30 days, will constitute your acceptance thereof.

11. Limitation of Liability.

In no event will Quantcast be liable to you or any third party for any consequential loss, exemplary damages, incidental loss, special damages or loss, lost profit, loss or deletion of Measurement Data or Measurement Results, or punitive damages arising from your use of the Services, even if Quantcast has been advised of the possibility of such damages. These limitations formed a basis for enabling Quantcast to offer these Services to you. This paragraph will apply regardless of any failure of the exclusive remedy provided in the following paragraph.

Except with regard to Quantcast’s obligations under Section 7, liability stemming from death or personal injury resulting from Quantcast’s negligence, or Quantcast’s fraud, notwithstanding anything to the contrary contained herein, Quantcast’s liability to you for any cause whatsoever and regardless of the form of the action, will at all times be limited to two hundred fifty U.S. dollars (US$250.00).

12. Miscellaneous.

This Agreement constitutes the entire Agreement between the parties with respect to the Services and supersedes all previous and contemporaneous agreements, proposals, and communications, written or oral between Quantcast and you with respect thereto. Any agreements regarding the delivery or use of advertising segments will govern the parties’ relationship in connection with the applicable segments but will not affect the parties’ rights, restrictions, or obligations under this Agreement, which the parties acknowledge as separate subject matter. Any waiver by either party of any violation of this Agreement will not be deemed to waive any further or future violation of the same or any other provision. If any parts or provisions of this Agreement are held to be unenforceable, then you and Quantcast agree that such parts or provisions will be given maximum permissible force and effect and the remainder of the Agreement will be fully enforceable. You and Quantcast agree that there are no third party beneficiaries of any promises, obligations or representations made by Quantcast. Either Party may assign its rights, data, and duties, under this Agreement in their entirety in connection with a sale of all (or substantially all) of its assets relating to this Agreement, a merger, or a reorganization. Nothing in this Agreement will constitute a partnership or joint venture or joint controllership between you and Quantcast.This Agreement and any dispute relating to this Agreement will be governed by the laws of the United States and the laws of the State of California, without regard to U.S. or California choice of law rules. You and Quantcast agree and consent that jurisdiction, proper venue, and the most convenient forums for all claims, actions, and proceedings of any kind relating to Quantcast or the matters in this Agreement will be exclusively in courts located in San Francisco, California. This Agreement is drafted in the English language. Any translation into another language is provided for convenience only. In the event of any inconsistency between the English language version and any translation, the English language version shall prevail.

13. Notice.

All notices or other communications to Quantcast from you will be deemed given only when received by hand delivery, electronic mail, or prepaid first class mail, at the address below or any other address provided by Quantcast to you for these purposes:

Persons in the United States, please contact:

Quantcast Corp.
795 Folsom Street
San Francisco, CA 94107
Attn: Legal Department
Email:contact@quantcast.com

Persons outside of the United States, please contact:

Quantcast International Limited
Beaux Lane House
Lower Mercer Street, 1st Floor
Dublin 2, Ireland
Attn: Legal Department
Email:contact.dublin@quantcast.com

14. Definitions

“Applicable Privacy Laws”means any applicable privacy or data protection laws, statutes or regulations as may be amended, extended or re-enacted from time to time, including, where applicable, (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and any EU Member State laws implementing GDPR; (b) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100et seq. (“CCPA”); and; (c) the e-Privacy Directive 2002/58/EC, as amended and as transposed into EU Member State law and any legislation replacing the e-Privacy Directive.

“Authorized Affiliate”means a third party that you allow to use your Tag, your account, or the Measurement Results.

“Business” has the same meaning as in CCPA.

“Measurement Data”has the meaning given to it in Section 1.

“Measurement Results”has the meaning defined in Section 1.

“Personal Data” has the same meaning as in GDPR.

“Personal Information” has the same meaning as in CCPA.

“Quantcast Content”means the content of the Quantcast website and the Services, including the Measurement Data and Measurement Results.

“Quantcast Property” has the meaning given to it in Section 6.

“Reachpoint”has the meaning given to it in Section 1.

“Services”means Quantcast Measurement: the digital audience ratings service that allows you (or an Authorized Affiliate) to define and measure specific online events by tagging Reachpoints, as described herein and as governed by these terms and conditions.

“Tag”means the particular javascript or other audience measurement code or software development kit provided to you by Quantcast, which allows Quantcast to set a cookie and embeddable on web pages, media files, and other Reachpoints, together with any labels and any fixes, updates, and upgrades provided to you.

“Technology”means, separately and collectively, the Tags, and Quantcast’s proprietary technology that generates the Measurement Results.

“Third Party”has the same meaning as in CCPA.

15. Contracting Party.

If you reside in the US this Agreement is between you and Quantcast Corporation. If you reside outside of the US, this Agreement is between you and Quantcast International Limited, an Irish limited liability company. References to “Quantcast”, “us”, “we” and “our” mean either Quantcast Corporation or Quantcast International Limited as appropriate.

Effective August 28th 2023

Table of Contents

Effective Date: May 16, 2023

This US Data Privacy Addendum (this “Addendum”) entered into by Customer and Quantcast (each, a “Party” and collectively, the “Parties”), governs the Processing of Personal Information that Customer transmits or otherwise makes available to Quantcast in connection with the delivery of Quantcast’s services (“Services”).

This Addendum is incorporated into the relevant Quantcast services agreement executed by the Parties (the “Agreement”). This Addendum reflects the Parties’ agreement with respect to the Processing of Personal Information pursuant to the Agreement and is applicable solely to the extent that the US State Privacy Laws apply.

In the event of any inconsistency between the terms of the Agreement and this Addendum, the terms of this Addendum shall prevail.

1.Definitions. Capitalized terms used in this Addendum that are not defined herein shall have the same meaning as set forth in the Agreement.

1.1. “Consumer” means a natural person to whom Personal Information relates.

1.2. “Consumer Rights Request” means a request made by a Consumer to exercise his or her rights under the US State Privacy Laws in relation to Personal Information.

1.3. “Controller” means the party that alone or jointly with others determines the purpose and means of the Processing of Personal Information.

1.4. “Personal Information” means any information relating to a Consumer that is subject to protection under the US State Privacy Laws and includes information that is referred to as “personal data” and similar terms as may be defined in the US State Privacy Laws.

1.5. “Processor” means the party that Processes Personal Information on behalf of the Controller.

1.6. “Subprocessor” means a party engaged by Quantcast in the Processing of the Customer Personal Information on Customer’s behalf.

1.7. “US State Privacy Laws” means privacy laws, regulations, or guidance applicable to the Processing of Personal Information in any relevant jurisdiction, including the California Consumer Privacy Act, as amended, including by the California Privacy Rights Act and implementing regulations (“CCPA”), the Colorado Privacy Act (“CPA”), the Connecticut Act Concerning Protection and Online Monitoring (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), and any other similar applicable laws that are in effect or come into effect during the term of the Agreement.

1.8. The terms “Business,” “Process,”“Sale” (or “Sell”), “Service Provider,” “Share,” and “Third Party” have the meanings ascribed to them in the CCPA.

2.Quantcast as a Third Party.

2.1.Role of Quantcast.The Parties acknowledge and agree that with regard to the Personal Information that Customer makes available to Quantcast through the Tag pursuant to the Agreement and any Personal Information included in the Customer Data (the “Disclosed Personal Information”), Quantcast is a Third Party. In its role as a Third Party, Quantcast shall comply with the obligations that apply to it under the US State Privacy Laws (including with respect to the Disclosed Personal Information) and provide the Disclosed Personal Information the level of privacy protection required by such laws. In the event that Quantcast determines that it can no longer meet its obligations under the US State Privacy Laws with respect to the Disclosed Personal Information, it shall take commercially reasonable steps to notify Customer.

2.2.Processing of the Disclosed Personal Information.Customer makes the Disclosed Personal Information available to Quantcast for the limited and specified purpose of providing Customer with access to Quantcast’s platform and the Services and as otherwise described in the Agreement. Quantcast shall not Process the Disclosed Personal Information for any other purpose unless such Processing is explicitly permitted or required by the US State Privacy Laws or other applicable law.

2.3.Data Security. Quantcast shall maintain technical and organizational measures designed to protect the Disclosed Personal Information against any breach of security leading to the accidental or unlawful destruction, use, loss, alteration, unauthorized disclosure of, or access to the Disclosed Personal Information.

2.4.Consumer Rights Requests. In accordance with the US State Privacy Laws, Customer shall notify Quantcast in writing or through other methods agreed upon by the Parties of all Consumer Rights Requests it receives relating to the Disclosed Personal Information with which Quantcast must comply (including deletion and opt-out requests).

2.5.Compliance Verification. At reasonable intervals during the term of the Agreement not to exceed more than once in a given twelve (12) month period, Quantcast shall, upon written request, make available to Customer information or documentation necessary to demonstrate its compliance with its obligations under this Addendum with respect to the Disclosed Personal Information. In the event that the information or documentation provided by Quantcast reveals any unauthorized use of the Disclosed Personal Information, Customer and Quantcast shall promptly work together in good faith to agree upon reasonable and appropriate steps to stop and remediate the unauthorized use.

3.Modifications. The Parties agree to cooperate in good faith to amend the terms of this Addendum and/or enter into additional terms as necessary to address modifications, amendments, or updates to the US State Privacy Laws.

Effective April 28th 2025

Table of Contents

Key Terms

Capitalized terms that are not defined in these Key Terms are as defined in theQuantcast Products and Services Privacy Policy. These Key Terms are for use in understanding the Quantcast Products and Services Privacy Policy. Nothing in these Key Terms modifies any active agreement with any Quantcast customer, vendor or other business partner (e.g., agreements for the Advertise and Measure product, etc.).

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Quantcast Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Quantcast Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Quantcast Clients. Audience Insights enable Quantcast Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and an ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of one or morePseudonymous Identifiers (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (e.g.., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether a Quantcast Client bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Quantcast Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular Quantcast advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Quantcast Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences and assess their effectiveness, all on behalf of the Quantcast Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Quantcast Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit our service providers/processors to whom we disclosePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Quantcast Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Quantcast Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions..

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes device type and version, screen size and resolution, browser language, device operating system and version, browser type and version, application and version, or other information about the device. Some Device Information is derived fromHTTP Request Header Information.

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices

Email Address

See Hashed Email Address

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Quantcast Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

Hashed Email Address

A hashed email address (HEM) is an email address that has been encoded using a cryptographic hashing function. A hashed email is treated as aPseudonymous Identifier.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address
• Cookie (if available)
• User Agent, which is a string (a line of text) that includesDevice Information.
• Date, which includes the precise time of access
• ReferralURL, which is the web page you were on when the request was sent
• TLS Session ID, which identifies a particular session of communication between the browser and the server
• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Quantcast Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one meter. Quantcast does not use precise geolocation data and we request that Quantcast Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems in accordance with the retention periods stated in ourProducts and Services Privacy Policy.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work,” family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;
• Custom-Client Data Labels: these are custom category labels set by Quantcast Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).
• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data.” Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited toPseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website, mobile applications, and advertisements that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Quantcast Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Quantcast Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.
• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Quantcast Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.
• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.
• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.
• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot reveal your real-life identity without technical efforts to add additional information, which Quantcast does not have or do. We do not attempt to link Pseudonymous Identifiers we hold to you as an individual, and we prohibit our service providers/processors to whom we disclose Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.
• First Party Cookie ID: seeCookie ID.
• IP Addresses.
• Hashed email addresses
• Third party identifiers
• Device ID.
• Application ID: an ID that is unique to your mobile device and a particular app on your device.
• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).
• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.
• Probabilistic Identifier.
• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.
• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/Special Purpose/Feature/Special Feature

TheTCFhas standardised certain Purposes, Special Purposes, Features and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes, Features, and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information governed by the GDPR, and use the Purposes, Special Purposes, Features, and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF Purposes, Special Purposes, Features, and Special Features, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Quantcast Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Quantcast Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective March 26th 2025  to  April 28th 2025

Table of Contents

Key Terms

Effective: March 25 2025

Capitalized terms that are not defined in these Key Terms are as defined in theQuantcast Products and Services Privacy Policy. These Key Terms are for use in understanding the Quantcast Products and Services Privacy Policy. Nothing in these Key Terms modifies any active agreement with any Quantcast customer, vendor or other business partner (e.g., agreements for the Advertise and Measure product, etc.).

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Quantcast Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Quantcast Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Quantcast Clients. Audience Insights enable Quantcast Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and an ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of one or morePseudonymous Identifiers (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (e.g.., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether a Quantcast Client bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Quantcast Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular Quantcast advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Quantcast Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences and assess their effectiveness, all on behalf of the Quantcast Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Quantcast Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Quantcast Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Quantcast Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes device type and version, screen size and resolution, browser language, device operating system and version, browser type and version, application and version, or other information about the device. Some Device Information is derived fromHTTP Request Header Information.

Email Address

See Hashed Email Address

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Quantcast Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

Hashed Email Address

A hashed email address (HEM) is an email address that has been encoded using a cryptographic hashing function. A hashed email is treated as aPseudonymous Identifier.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address
• Cookie (if available)
• User Agent, which is a string (a line of text) that includesDevice Information.
• Date, which includes the precise time of access
• ReferralURL, which is the web page you were on when the request was sent
• TLS Session ID, which identifies a particular session of communication between the browser and the server
• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Quantcast Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one meter. Quantcast does not use precise geolocation data and we request that Quantcast Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work,” family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;
• Custom-Client Data Labels: these are custom category labels set by Quantcast Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).
• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data.” Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited toPseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website, mobile applications, and advertisements that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Quantcast Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Quantcast Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.
• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Quantcast Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.
• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.
• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.
• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot reveal your real-life identy without technical efforts to add additional information, which Quantcast does not have or do. We do not attempt to link Pseudonymous Identifiers we hold to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.
• First Party Cookie ID: seeCookie ID.
• IP Addresses.
• Hashed email addresses
• Third party identifiers
• Device ID.
• Application ID: an ID that is unique to your mobile device and a particular app on your device.
• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).
• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.
• Probabilistic Identifier.
• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.
• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/Special Purpose/Feature/Special Feature

TheTCFhas standardised certain Purposes, Special Purposes, Features and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes, Features, and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information governed by the GDPR, and use the Purposes, Special Purposes, Features, and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF Purposes, Special Purposes, Features, and Special Features, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Quantcast Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Quantcast Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective December 16th 2024  to  March 26th 2025

Table of Contents

Key Terms

Effective: December 15 2024

Capitalized terms that are not defined in these Key Terms are as defined in theQuantcast Products and Services Privacy Policy. These Key Terms are for use in understanding the Quantcast Products and Services Privacy Policy. Nothing in these Key Terms modifies any active agreement with any Quantcast customer, vendor or other business partner (e.g., agreements for the Advertise and Measure product, etc.).

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Quantcast Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Quantcast Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Quantcast Clients. Audience Insights enable Quantcast Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and an ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of one or morePseudonymous Identifiers (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (e.g.., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether a Quantcast Client bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Quantcast Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular Quantcast advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Quantcast Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences and assess their effectiveness, all on behalf of the Quantcast Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Quantcast Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Quantcast Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Quantcast Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes device type and version, screen size and resolution, browser language, device operating system and version, browser type and version, application and version, or other information about the device. Some Device Information is derived fromHTTP Request Header Information.

Email Address

See Hashed Email Address

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Quantcast Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

Hashed Email Address

A hashed email address (HEM) is an email address that has been encoded using a cryptographic hashing function. A hashed email is treated as aPseudonymous Identifier.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address
• Cookie (if available)
• User Agent, which is a string (a line of text) that includesDevice Information.
• Date, which includes the precise time of access
• ReferralURL, which is the web page you were on when the request was sent
• TLS Session ID, which identifies a particular session of communication between the browser and the server
• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Quantcast Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one meter. Quantcast does not use precise geolocation data and we request that Quantcast Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work,” family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;
• Custom-Client Data Labels: these are custom category labels set by Quantcast Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).
• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data.” Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited toPseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website, mobile applications, and advertisements that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Quantcast Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Quantcast Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.
• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Quantcast Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.
• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.
• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.
• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link Pseudonymous Identifiers to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.
• First Party Cookie ID: seeCookie ID.
• IP Addresses.
• Hashed email addresses
• Third party identifiers
• Device ID.
• Application ID: an ID that is unique to your mobile device and a particular app on your device.
• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).
• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.
• Probabilistic Identifier.
• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.
• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/Special Purpose/Feature/Special Feature

TheTCFhas standardised certain Purposes, Special Purposes, Features and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes, Features, and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information governed by the GDPR, and use the Purposes, Special Purposes, Features, and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF Purposes, Special Purposes, Features, and Special Features, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Quantcast Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Quantcast Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective June 11th 2024  to  December 16th 2024

Table of Contents

Key Terms

Effective: June 6 2024

Capitalized terms that are not defined in these Key Terms are as defined in theQuantcast Products and Services Privacy Policy. These Key Terms are for use in understanding the Quantcast Products and Services Privacy Policy. Nothing in these Key Terms modifies any active agreement with any Quantcast customer, vendor or other business partner (e.g., agreements for the Advertise and Measure product, etc.).

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Quantcast Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Quantcast Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Quantcast Clients. Audience Insights enable Quantcast Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and an ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of one or morePseudonymous Identifiers (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (i.e., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether a Quantcast Client bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Quantcast Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular Quantcast advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Quantcast Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences and assess their effectiveness, all on behalf of the Quantcast Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Quantcast Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifier can determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiers may relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers (this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifiers with Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Quantcast Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Quantcast Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes browser, app, or other information about the device (such as device type, screen size and resolution, date and time, and language), which also may include a User Agent. Some Device Information is derived fromHTTP Request Header Information.

Email Address

See Hashed Email Address

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Quantcast Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

Hashed Email Address

A hashed email address (HEM) is an email address that has been encoded using a cryptographic hashing function. A hashed email is treated as aPseudonymous Identifier.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address
• Cookie (if available)
• User Agent, which is a string (a line of text) identifying the device type, browser type, and version that the user is using to access the web server (“User Agent”)
• Date, which includes the precise time of access
• ReferralURL, which is the web page you were on when the request was sent
• TLS Session ID, which identifies a particular session of communication between the browser and the server
• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessing ofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Quantcast Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one meter. Quantcast does not use precise geolocation data and we request that Quantcast Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work,” family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;
• Custom-Client Data Labels: these are custom category labels set by Quantcast Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).
• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data.” Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessed by Quantcast is limited toPseudonymised Identifiers Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website, mobile applications, and advertisements that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Quantcast Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Quantcast Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.
• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Quantcast Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.
• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.
• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.
• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is aPseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link Pseudonymous Identifiers to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.
• First Party Cookie ID: seeCookie ID.
• IP Addresses.
• Hashed email addresses
• Third party identifiers
• Device ID.
• Application ID: an ID that is unique to your mobile device and a particular app on your device.
• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).
• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.
• Probabilistic Identifier.
• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.
• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/Special Purpose/Feature/Special Feature

TheTCFhas standardised certain Purposes, Special Purposes, Features and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes, Features, and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information governed by the GDPR, and use the Purposes, Special Purposes, Features, and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF Purposes, Special Purposes, Features, and Special Features, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Quantcast Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Quantcast Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective February 17th 2024  to  June 11th 2024

Table of Contents

Key Terms

Effective: March 1 2024

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, and Inferred Data to Clients. Audience Insights enable Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and one ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of aPseudonymous Identifier (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (i.e., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether Quantcast bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences on behalf of the Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudience Segment Datafrom different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes browser, app, or other information about the device (such as device type, screen size and resolution, date and time, and language), which also may include a User Agent. Some Device Information is derived fromHTTP Request Header Information.

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receives Bid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address

• Cookie (if available)

• User Agent, which is a string (a line of text) identifying the device type, browser type, and version that the user is using to access the web server (“User Agent”)

• Date, which includes the precise time of access

• ReferralURL, which is the web page you were on when the request was sent

• TLS Session ID, which identifies a particular session of communication between the browser and the server

• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingof Personal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’s Processing and/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’s Processing and/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one metre. Quantcast does not use precise geolocation data and we request that Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived from GPS coordinates or fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated with Pseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, and Inferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

An IP Address that has been hashed, or encoded using a cryptographic hashing function to obfuscate the email, is treated as aPseudonymous Identifier.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work”, family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;

• Custom-Client Data Labels: these are custom category labels set by Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).

• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such as Pseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/or Inferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data”. Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify as Personal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited to Pseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.

• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.

• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.

• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.

• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such as IP Addresses) with Bid Request Data and/or Event Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike using Cookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed upon Personal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link Pseudonymous Identifiers to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.

• First Party Cookie ID: seeCookie ID.

• IP Addresses.

• Hashed email addresses, which are email addresses that have been encoded using a cryptographic hashing function to obfuscate the email.

• Third party identifiers

• Device ID.

• Application ID: an ID that is unique to your mobile device and a particular app on your device.

• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).

• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.

• Probabilistic Identifier.

• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.

• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API by Clients or Third Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes, Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with a Label (in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/TCF Special Purpose

TheTCFhas standardised certain Purposes, Special Purposes and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information and use the Purposes, Special Purposes and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF “Purpose” or TCF “Special Purpose”, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. These Inferences are then used to deliver advertising and provide aggregated, analytical reporting to our Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective February 12th 2024  to  February 17th 2024

Table of Contents

Key Terms

Effective: March 1 2024

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data,Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Clients. Audience Insights enable Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and one ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of aPseudonymous Identifier (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (i.e., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether Quantcast bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences on behalf of the Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device or connected TV (“CTV”) device by the device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes browser, app, or other information about the device (such as device type, screen size and resolution, date and time, and language), which also may include a User Agent. Some Device Information is derived fromHTTP Request Header Information.

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address

• Cookie (if available)

• User Agent, which is a string (a line of text) identifying the device type, browser type, and version that the user is using to access the web server (“User Agent”)

• Date, which includes the precise time of access

• ReferralURL, which is the web page you were on when the request was sent

• TLS Session ID, which identifies a particular session of communication between the browser and the server

• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one metre. Quantcast does not use precise geolocation data and we request that Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived from GPS coordinates or fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

An IP Address that has been hashed, or encoded using a cryptographic hashing function to obfuscate the email, is treated as aPseudonymous Identifier.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work”, family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;

• Custom-Client Data Labels: these are custom category labels set by Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).

• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data”. Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited toPseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.

• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.

• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.

• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.

• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link Pseudonymous Identifiers to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.

• First Party Cookie ID: seeCookie ID.

• IP Addresses.

• Hashed email addresses, which are email addresses that have been encoded using a cryptographic hashing function to obfuscate the email.

• Third party identifiers

• Device ID.

• Application ID: an ID that is unique to your mobile device and a particular app on your device.

• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).

• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.

• Probabilistic Identifier.

• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.

• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/TCF Special Purpose

TheTCFhas standardised certain Purposes, Special Purposes and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information and use the Purposes, Special Purposes and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF “Purpose” or TCF “Special Purpose”, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective August 29th 2023  to  February 12th 2024

Table of Contents

Advertising Exchange

SeeExchange/Advertising Exchange.

Attributes/Attribute Information

Attributes are known, observed, or inferred characteristics. Examples of attributes are “male” and “visited XYZ website”. Attributes may be derived fromEvent Data, Bid Request Data,Client Data, Third Party Data, andInferences/Inferred Data. Quantcast associates attributes withPseudonymous Identifiers.

Audience

An Audience is a group of devices and/or users who are known to or are estimated to have certain common characteristics. A characteristic in common may be anInterest, such as an interest in cooking. A characteristic in common may be anAttribute, such as being male, visited a particular digital property, or viewed or interacted with a particular advertisement. One type of Audience is a group who have visited a Client’s digital property. Another type of Audience is a group who have been shown, or may potentially be shown, a Client’s advertisement.

Audience Insights

Audience Insights are data collected, or data that is inferred from data collected, about anAudience. Audience Insights are aggregated, anonymised data and are notPersonal Information. An example of an Audience Insight is a report that a given audience is estimated to be 70% male and 3 times as likely to be interested in cooking compared to the general population.

Quantcast provides Audience Insights based onEvent Data,Bid Request Data,Client Data,Third Party Data, andInferred Data to Clients. Audience Insights enable Clients to better understand the audiences who engage with their content and ads.

Bid Request/Bid Request Data

A Bid Request is a request by a digital content publisher (e.g., website owner, app developer, streaming content provider, etc.) for an offer to place an ad in the publisher’s digital content. For example, when you visit an ad-supported web page, Bid Requests are sent by, or on behalf of, the publisher of the web page to multiple parties that may want to show an ad to you. Those parties can bid for the opportunity to show an ad in an auction, and one ad is selected to show on the page. Bid Requests typically go through anAdvertising Exchange. This all happens via digital communication between computer servers in less than a second. The contents of the Bid Request may include information about the ad unit (the container in the digital content that will display the ad), the digital content, the device it will be seen on, and your engagement with the publisher’s digital content, so that prospective buyers can choose whether to bid and how much. For most cases, the contents of the Bid Request are defined by the OpenRTB industry standard (https://iabtechlab.com/standards/openrtb/), though not all fields are necessarily included in every Bid Request. Bid Request Data consists of data provided in the Bid Request and will commonly consist of aPseudonymous Identifier (if available), the content that the ad would serve in (such as the web page, app, video, etc.), the type of device the ad would be served on (i.e., your device type), the approximate geographic location of your device, the size of the ad, the auction ID, and consent information, such asTCF Signals. Bid Request Data also includes Quantcast’s response to the Bid Request, such as whether Quantcast bid on the ad opportunity.

Browsing Data

Browsing Data is information collected relating to yourOnline activity or behaviour. Browsing Data is generated when aPixels, Tags, or SDKs installed by a Client on its digital property loads and sends information to us. This includes the websiteURL of the page you are visiting, often along with aPseudonymous Identifier, as well as fields of information that may be automatically included fromHTTP Header Information, such as referralURLs(which is theURLthat directed your browser to the website where an advertisement was served to you).

Browsing Data is included inEvent Data.

Client Data

Client Data isImported Data that is uploaded to the Quantcast platform by a particular advertiser Client for use on its behalf. Client Data isPseudonymised Information, which defines groups of users. These groups might typically be based on users’Online Data orOffline Data, or other characteristics or aspects of users’ relationship with the Client. The groups are then used by Quantcast to help deliver advertising campaigns to the rightAudiences on behalf of the Client.

Cookie

A Cookie is a small bit of text that is sent to and saved on your computer or device when you visit a website. A Cookie is associated with a single web browser profile; each web browser and browser profile that you use on your device will have separate Cookies. Cookies allow a website to recognise a browser and are commonly used to store user preferences or identifiers, which enables us to collect and use information about browsers over time and across different internet content. Cookies enable us to understand more about users and the content they are visiting over time, which in turn can be used to improve our Clients’ advertising activities and the quality of advertising you experience. The identifiers we store in Cookies arePseudonymous Information; in other words, they cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link a Pseudonymous Identifier to you as an individual, and we prohibit other parties with whom we sharePseudonymous Identifiers orPseudonymous Information from doing the same. Browsers have controls that enable users to clear or block Cookies. See your browser help for details.

There are two forms of cookies: First Party Cookies and Third Party Cookies.

A “First Party Cookie” is limited in scope to a particular website you visit (“First Party Cookie”). In some instances, Quantcast is able to store or access information in a First Party Cookie. Ifwww.example.com incorporates QuantcastPixels, Tags or SDKs into their website, and if you visit www.example.com, Quantcast may set a First-Party Cookie associated with www.example.com. In these instances, Quantcast can store aPseudonymous Identifier in the First-Party Cookie, but because it is a First Party Cookie, Quantcast can only access thatPseudonymous Identifier in the context of your visits to that site.

A “Third Party Cookie” is a cookie associated with an internet domain that is different from the one you are visiting. For example, if you are visitingwww.example.com and a QuantcastPixel, Tag or SDKon that website is able to set a cookie associated with quantcast.com, that is a Third Party Cookie. That same cookie will be accessible to Quantcast on other sites that also incorporate QuantcastPixels, Tags or SDKs. Quantcast uses

Pseudonymous Identifiers stored in Third Party Cookies in order to collect information across multiple websites.

Quantcast Cookies placed on your device have a maximum expiry period of 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). Each time you visit a website and a First or Third Party Cookie is placed on your device, the placement of a Cookie begins a new expiry period of up to 13 months (or such shorter period as described in the Privacy Policy “Information Collection” section). All Quantcast Cookies automatically cease providing any data to Quantcast from your browser upon expiration.

Cookie ID/Identifier

A Cookie ID is a unique string of characters that we store in aCookie that allows us to identify a single web browser instance over time and across different web sites. Our Cookie IDs arePseudonymous Identifiers. AFirst Party Cookie ID is a uniquePseudonymous Identifier relating to theFirst-Party Cookie set by the owner of the website you are visiting. AThird Party Cookie ID is a unique Pseudonymous Identifier relating to theThird-Party Cookie set by Quantcast.

Cookie Syncing/Matching

In the online advertising industry, Cookie Syncing/Matching generally refers to a process through which two entities who each, and separately, identify a device using their ownPseudonymous Identifiercan determine which of their respectivePseudonymous Identifiers may relate to the same device. For example, Quantcast may pseudonymously identify a device as “cookie ID 123.” Company B may pseudonymously identify the same device as “cookie ID ABC.” Cookie Syncing/Matching enables Quantcast and Company B to recognise that their respectivePseudonymous identifiersmay relate to the device that Quantcast records as “cookie ID 123”.

Quantcast’s Cookie Syncing activities work similarly. If you visit a website that incorporatesPixels, Tags or SDKs from Quantcast, Company B may match its own pseudonymous identifiers to Quantcast Pseudonymous Identifiers(this creates a record of matching pseudonymous identifiers for Company B). Once a match is established, Company B can reference a particular device when communicating with Quantcast, using Quantcast’sPseudonymous Identifier.

The Cookie Syncing/Matching process does not in itself result in Quantcast sharingAttributes related to QuantcastPseudonymous Identifierswith Company B. The Cookie Syncing/Matching enables transactions between the parties at a later time; for example, in the case of an Advertising Exchange sending a Bid Request, the Bid Request can contain a previously synchedPseudonymous Identifier.

Cross-Media Matching/Linking

In the online advertising industry, Cross-Media Matching generally refers to a process through which Quantcast links identifiers across a user’s consumption of various media (e.g. audio, video, websites, apps, etc) because such identifiers are known to orInferredto relate to the same user. Matching/Linking may be undertaken for consumption of media on a single device and for consumption of media on more than one device. As an example, if you visit a digital property using your mobile phone and later visit that same digital property using a browser on your laptop or make visits to several different digital properties using a browser over a period of time, Quantcast may initially determine that these visits are made by different users and assign each device user their own profile.

If, however, Quantcast finds there is sufficient commonality between thePseudonymous Identifiers associated with the consumption of media, Quantcast will assess that those identifiers may be joined as they are likely to emanate from the same user. This assessment is“probabilistic”– in other words, it uses statistical techniques to determine that the identifiers to be matched have a higher likelihood of relating to the same device and/or user.

Data Management Platforms and Data Providers

Data Management Platforms and Data Providers provideThird Party Data to Quantcast, or provide a platform through which Clients can provideClient Data to Quantcast. These companies either directly licence first and third partyAudienceSegment Data from different sources (such asOnline Data andOffline Data) to businesses or provide a platform through which Clients can collect, organise, and activate such data for Quantcast’s use in connection with the Solutions. We sharePseudonymous Identifiers withData Management Platforms/Data Providers in order to sync/match identifiers to effectively integrate with their services (seeCookie Syncing/Matching).

Device ID/Identifier

A unique string of characters that can be used to identify a device set by the developer of the device’s operating system (e.g., a mobile phone, tablet, TV, or console). Device Identifiers (or “Device IDs”) serve a similar purpose asCookies and can be used to provide personalised advertising. A Device ID is aPseudonymous Identifier.

A Mobile Advertising ID (or “MAID”) is a Device ID assigned to a mobile device by the mobile device operating system. Typically, the device user can reset or turn off the ID via the device’s settings. A MAID is referred to as the IDFA (ID for Advertisers) on iOS devices and GAID (Google Ad ID) on Android mobile devices.

Device Configuration/Device Information

Information about a device or its configuration, transmitted from the device, and typically associated with aPseudonymous Identifier. The information includes browser, app, or other information about the device (such as device type, screen size and resolution, date and time, and language), which also may include a User Agent. Some Device Information is derived fromHTTP Request Header Information.

Event Data

Information collected relating to yourOnline activity/behaviour, which may include Personal Information inPseudonymous Identifiers,Imprecise/Approximate Location Information,HTTP Request Header Information,Device Information,Browsing Data andTCF Signals. Event Data is generated when aPixel, Tag, or SDK installed on a Client’s digital property loads and sends information to us. Event Data can also be collected from ads, when you view or click on an ad which contains aTag.

Exchange/Advertising Exchange

A marketplace platform that facilitates automated, real-time, auction-based buying and selling of ad inventory (which are spaces available on sites and apps to display ads). An Advertising Exchange receivesBid Requests from digital publishers and forwards them to advertisers, or to entities like Quantcast who act on behalf of advertisers. Advertisers, or their agents, respond toBid Requests with a bid amount and an advertisement to provide to a user if they win the auction.

First Party Cookie

SeeCookie.

HTTP Request Header Information

HTTP headers are defined by internet standards and contain a number of data fields designed to facilitate communication and interoperability on the internet. On the web, your web browser controls which headers are sent and what the contents are. We receive the headers when a request is sent over the internet to our system, such as when aPixel loads in your web browser. We also might receive information that has been derived from the HTTP headers from another party, such as in aBid Request. We use a subset of the header fields for purposes described in the Privacy Policy, which includes:

• IP Address
• Cookie (if available)

User Agent, which is a string (a line of text) identifying the device type, browser type, and version that the user is using to access the web server (“User Agent”)

• Date, which includes the precise time of access
• ReferralURL, which is the web page you were on when the request was sent
• TLS Session ID, which identifies a particular session of communication between the browser and the server
• Content-Language, which is the languages of the intended audience for the enclosed content

Detailed documentation related to HTTP header information can be found online in a general search for “HTTP header information fields”.

IAB Transparency & Consent Framework (“TCF”)

The IAB Transparency & Consent Framework, or “TCF,” is a standardised industry program active in countries governed by the GDPR, and designed for notifying users about dataProcessing by companies involved in digital advertising on sites and apps that users visit, and for establishing a legal basis for thatProcessing.

The TCF is designed to be used on digital properties, such as websites and apps. The TCF incorporates a consent dialog that displays when users visit a website or app, giving them information about vendors, the data they collect, and the purposes for which they collect it. It also offers an opportunity for users to give or change their permissions for such data collection and use.

The TCF allows Quantcast to work with publishers of websites and other digital properties in a consistent manner using standardised technical specifications to:

(a) provide a link to Quantcast's Privacy Policy, as well as transparency about Quantcast'sProcessingofPersonal Information, the specific purposes for which QuantcastProcessesPersonal Information, and Quantcast's legal basis for suchProcessing, directly on the website or other digital property accessed by the user;

(b) allow the user, in a granular manner, to express their consent or refusal to consent, to Quantcast's (i) use ofCookies, and (ii) the purposes of Quantcast'sProcessing, which are the reasons why QuantcastProcessesthe personal data of users (“TCF Purposes”), including where Quantcast relies on the user’s consent for suchProcessingdirectly on the website or other digital property that the user is accessing;

(c) allow the user to object to Quantcast'sProcessingofPersonal Information (for purposes where Quantcast relies on legitimate interests) directly on the website or other digital property accessed by the user.

Using theTCFallows publishers of websites or other digital properties to provide information about Quantcast’sProcessingto users in a consistent manner. The user-facing disclosures presented by these digital properties are sourced from information that Quantcast has registered with theTCF's“Global Vendor List”, a publicly accessible, machine-readable repository of information about TCF-compliant vendors, like Quantcast. This information includes Quantcast’s Privacy PolicyURL, the purposes for which itProcessesPersonal Information, and its legal basis for each of these purposes. As the description of these purposes and minimum standards for disclosures are standardised across all TCF participants, Quantcast knows how operators of websites or other digital properties using the TCF are making disclosures about Quantcast and can have confidence in such disclosures.

In addition, the TCF enables publishers of websites or other digital properties to create and send to Quantcast a standardised technical signal that indicates (A) whether Quantcast’s transparency disclosures were provided to a user; (B) whether or not the user has consented to Quantcast’sProcessingand/or each purpose for which Quantcast sought the user's consent; and (c) whether the user objected to Quantcast’sProcessingand/or any purposes for which QuantcastProcessesPersonal Informationon the basis of its legitimate interests (the “TCF Signal”).

TCF Signal is collected via QuantcastTags if the digital property on which theTagis implemented has also implemented a TCF-compatible Consent Management Platform, which is a company or organisation that centralises and manages transparency for, and consent and objections of, the user (“CMP”) . In addition, TCF Signal is received by Quantcast as part of theBid Requests it receives fromAdvertising Exchanges. Quantcast is able to read the standardised TCF Signal and will onlyProcessPersonal Information for purposes to which the user has consented (where consent is the legal basis) or not objected (where legitimate interests is the legal basis) in order to provide the Solutions.

Read more about the TCF herehttps://iabeurope.eu/transparency-consent-framework/

Imported Data

Imported Data is uploaded to the Quantcast platform or provided to us via an Application Programming Interface (“API”). Imported Data isPseudonymised Information, which may include information relating to yourOnline data orOffline data or other information that Clients or partners have about you. For examples of Imported Data provided to Quantcast, seeClient Data orThird Party Data.

Imported Data (Client)

SeeClient Data.

Imported Data (Third Party/Segment)

SeeThird Party Data.

Imprecise/Approximate Location Information

Typically, in digital advertising we distinguish between precise and imprecise geolocation information.

Precise geolocation usually comes from GPS coordinates from mobile devices, and can have precision up to about one metre. Quantcast does not use precise geolocation data and we request that Clients, partners, and third parties refrain from sending precise geolocation to us. If a party inadvertently sends it, we do not use it in the Solutions and it is removed from our systems within 30 days.

Imprecise geolocation is lower precision, and refers to a general geographic area, for example a country, region, city or division of a metropolitan area, and/or some combination of these, and is often derived from GPS coordinates or fromIP Addresses.

Inferences/Inferred Data

Inferences, or Inferred Data, is information that is inferred from data that we have collected about a device, such asEvent Data,Bid Request Data, Client Data, orThird Party Data. Our inferences are made using algorithms that estimate the likelihood that the user of a device has particular interests or characteristics. The Inferences are then associated with aPseudonymous Identifier as part of a set of deviceAttributes.

For example, if a device frequently visits sports websites, it might be inferred that there is some probability the user of that device likes sports. Similarly, if a device frequently visits an airline provider’s website, it might be inferred that there is some probability a user of that device likes to travel. Other Inferences include things such asInterests, income range, gender, age, marital status, and other socio-economic information.

Inferences associated with any individual device have a high degree of uncertainty. Inferences become more accurate when used to estimate the characteristics of a large group of devices, like anAudience.

Interests

Interests are known, observed, or inferred non-demographic characteristics. Interests are associated withPseudonymous Identifiers to characterise particular interests of users. Examples of Interests include “cooking” and “outdoor activities”. Interests may be derived fromEvent Data,Bid Request Data,Client Data,Third Party Data, andInferences/Inferred Data.

IP Address

An IP (“Internet Protocol”) Address is a unique numerical label corresponding to a computer or device. Computers use IP Addresses to identify each other and know where to send information over the Internet. For example, when you open a web page in your browser a request is made to a server for the web page content. The server knows where to send the content based on the IP Address contained in the request. Computers or other devices are assigned an IP Address from the network the device is on. A device’s IP Address may change over time or as a device changes locations. Also, an IP Address can refer to multiple devices, for example if the devices are behind an internet router.

An IP Address that has been hashed, or encoded using a cryptographic hashing function to obfuscate the email, is treated as aPseudonymous Identifier.

Labels/Label Data

Labels, or Label Data, are descriptors associated withPseudonymous Identifiers to denote particular groups of users that can be subsequently used to index allPseudonymous Identifiers associated with that label. An analogy would be applying a “label” to messages in an email inbox - you might decide to label messages from work as “Work”, family members as “Family,” and so on. These labels then help you readily index and recall particular categories of email.

Labels processed by Quantcast are:

• Labels fromData Management Platforms and Data Providers : these are category Labels (e.g., male, female, age 21-24) acquired from third party data partners relating to aPseudonymous Identifier;
• Custom-Client Data Labels: these are custom category labels set by Clients corresponding to a device associated with the identifier visiting their digital property (e.g., byline of the news article accessed by the user) or product name (of the product accessed by the user).
• Inferred Data Labels: these are inferred category Labels about a user using a device associated with aPseudonymous Identifier, e.g., inferred age, inferred gender, inferred interest.

Example Labels are “male” and “visited XYZ website”. Labels may be inferred information (seeInferences/Inferred Data) or may be Imported Data (seeClient Data andThird Party Data).

Log Data

Log Data is an industry term that is generally used to refer to data collected from interactions with computer systems, and is used differently by different companies. For purposes of describing ourProcessing, we use more precise terms, such asPseudonymous Identifiers,Event Data,Bid Request Data,Client Data,Third Party Data, and/orInferences/Inferred Data, which are all types of data that can be subsumed within the general industry term “Log Data”. Some elements within Log Data, when isolated from thePseudonymous Identifiers, will not qualify asPersonal Information. For example, a single time zone and publisherURL without an associatedPseudonymous Identifierwould not qualify asPersonal Information.

Online Data

Data relating to a user’s interaction with digital media including websites, apps and streaming media services.

Offline Data

Data relating to a user’s real-world purchases and/or activity.

Panel

A Panel is a set of individuals who have consented to participate in market research and share information about themselves, their preferences and interests for purposes of research and market analytics.

This information can then be used as the basis for learning or making inferences about a larger population. For example, if a number of people on a Panel share that they visit a particular news website, and of those people, most of them are male and over the age of 50, we might extrapolate from that and say that most of the audience for that website is male and over 50.

Another way to use Panel data is to compare Panel results to the estimates that we have made using our algorithms in order to score the effectiveness of our algorithms. So, if our algorithm predicted for the same news website that most of the audience is under 30, we would learn that our algorithm might be wrong.

Personal Information

Personal Information refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you, your browser, or your device. We use the term “personal information” to refer to information that is subject to protection under data protection and privacy laws and regulatory regimes around the world. Depending on the jurisdiction, such information may be referred to as “personal data.”

The Personal InformationProcessedby Quantcast is limited toPseudonymised Identifiers. Quantcast does notProcessPersonal Information that directly identifies you as an individual, and that can be used to directly identify you without technical efforts to add additional information, which Quantcast does not have.

Pixels, Tags, and SDKs

Pixels, Tags, and SDKs are computer code embedded in a website that we use to enable the Solutions. We tend to use the terms Pixels, Tags, and SDKs interchangeably. Clients that use the Solutions can put them on their sites, in their apps, or in their ads in order to send us information that is then used in the Solutions. When a Pixel, Tag, or SDK loads and calls our servers, we receiveHTTP Header Information, along with other information that is configured by the Client who is using the Solutions. That information includes IDs from partners, so we know which partner the data is coming from.

Pixels, Tags, and SDKs include:

• Sync Pixels: These are used to exchange and matchPseudonymous Identifiers between companies that participate in the digital advertising market. By matching, they can synchronise these identifiers to deliver and measure ads.
• Tags or Pixels in ads: When a digital ad loads on a page, it can include a Tag or Pixel that we use on behalf of Clients to gather information about where and when the ad was served. This can help to measure ad performance, to ensure ads are shown where intended, and to learn in order to improve ad effectiveness.
• Tags or Pixels on publisher Clients’ web pages: For publisher Clients that use the Solutions, they can put our Tags on their sites. The information we collect then enables the Client to learn about their audience, and it enables us to build models for better targeting ads.
• Tags or Pixels used by advertiser Clients: When advertiser Clients use our Tags or Pixels, they send us information so we can learn about their customers in order to help them better target their ads.
• SDKs: SDKs are bits of computer code that mobile app publisher Clients incorporate into their apps, enabling them to send us information. Similar to Pixels or Tags, the information enables us to offer the Solutions as described in our Privacy Policy.

Probabilistic Identifier

A Probabilistic Identifier is a Pseudonymous Identifier which we create by combiningPseudonymous Identifiers (such asIP Addresses) withBid Request Data and/orEvent Data using non-deterministic, statistical methods to estimate the likelihood that a group of devices may be used by the same user or household, if applicable law or rules allow. For example, we might be able to determine that because a mobile phone and a TV are on the same network, they are likely in the same house. We can then use that information to select and measure ads. Unlike usingCookie IDs, this approach is not 100% accurate and could identify one or many devices.

Process

Refers to any operation or set of operations performed uponPersonal Information or sets ofPersonal Information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Pseudonymous Identifiers

Pseudonymous Identifiers are unique values that distinguish your browser profile(s) or device(s). Pseudonymous Identifiers cannot be linked to you as an individual without technical efforts to add additional information, which Quantcast does not have. We do not attempt to link Pseudonymous Identifiers to you as an individual, and we prohibit other parties with whom we share Pseudonymous Identifiers from doing the same.

Pseudonymous Identifiers are important in digital advertising because they help distinguish browsers or devices over time across different contexts. This is useful for example, to limit the number of times that we show the same ad to one device, to measure the performance of ads, and to target and select personalised ads.

We may incorporate any one of the following types of information in a Quantcast Pseudonymous Identifier:

• Third Party Cookie ID: seeCookie ID.
• First Party Cookie ID: seeCookie ID.
• IP Addresses.
• Hashed email addresses, which are email addresses that have been encoded using a cryptographic hashing function to obfuscate the email.
• Device ID.
• Application ID: an ID that is unique to your mobile device and a particular app on your device.
• Application Session ID: like an application ID, except that it is reset periodically (e.g., many browsers reset these after 30 minutes of inactivity).
• Exchange User ID: an ID that is sent to us with aBid Request that identifies the device or browser where an ad is to be shown.
• Probabilistic Identifier.
• Publisher User ID: digital publishers that use the Solutions can send us an ID to use in the Solutions. The digital publisher hashes or encrypts an identifier available to it. The resulting ID is pseudonymous because it does not directly identify you, but it would be consistent across different publishers, so the Publisher User ID can be used to match data.
• TLS Session ID: when you visit a websiteURL that starts with “https” instead of “http”, that means you have an encrypted connection between your browser and the site. If one of ourPixels, Tags or SDKs loads on the site, that call to our server will also be encrypted. The Session ID identifies a particular session of communication between the browser and the server.

Pseudonymous/Pseudonymised Information

Pseudonymised Information isPersonal Information that has beenProcessed in such a manner that the information can no longer be attributed to a specific user without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal information is not attributed to a specific user.

Segment Data

Segment Data is imported data that is uploaded to the Quantcast platform or provided to us via an API byClients orThird Party Data Partners. Segment Data isPseudonymised Information, which may includeOnline Data and/orOffline Data as well asAttributes,Inferences, orInterestsinferred from that data. This category of information is typically called “Segment Data” because it identifies groups of users who fall into advertising segments (e.g., “auto buyers,” “shoe shoppers,” or “women 25-35”). These segments represent groups of users that share (or that are inferred to share) one or more certain characteristics in common (e.g., a client may want to advertise to a segment of “male shoppers who are interested in sports fashion”). These groupings are created by using the intersection of different segments (in the example given, an audience that is simultaneously in the “male”, “shopper”, and “sports fashion” segments). A segment may be identified with aLabel(in which case it is referred to as “Label Data”).

Software Development Kit (SDK)

SeePixels, Tags, and SDKs.

Tag

SeePixels, Tags, and SDKs.

TCF

SeeIAB Transparency & Consent Framework.

TCF Purpose/TCF Special Purpose

TheTCFhas standardised certain Purposes, Special Purposes and Special Features and the descriptions of data processing activity in the digital advertising industry. Through this standardisation, the digital advertising industry can ascribe consistent meanings for the permissions that data subjects give via theTCF. This also ensures a consistent experience for users because they then do not have to read and understand an entirely different set of Purposes, Special Purposes and Special Features for each website they visit.

Because of the benefits of standardising the purposes across the industry, we use theTCFto establish the legal basis toProcessPersonal Information and use the Purposes, Special Purposes and Special Features in our Privacy Policy to describe much of our data processing activity.

For detailed descriptions of TCF “Purpose” or TCF “Special Purpose”, seeIAB Transparency & Consent Framework.

Third Party Cookie/Cookie ID

SeeCookie.

Third Party Data

Third Party Data is Imported Data that is uploaded to the Quantcast platform or provided to us via API by third partyData Management Platforms and Data Providers. Third Party Data may includeSegment Data.

Training Data

Training Data isPseudonymous Information that we receive from Clients and third party data providers, where the actualAttributes orInterests of the underlying users are known (even though their actual identities are not known to Quantcast). The Training Data is segmented across variousInterestsandAttributes, such as shopping interests (e.g., automotive, technology, or restaurants), business and occupation (e.g., management, IT professional or retail), media interests (e.g., cinema, video games, TV), income range, age, marital status, and other socio-economic information and used for data modeling purposes. We use the Training Data to train statistical models to makeInferences. When our systems subsequently receiveEvent Data relating to a user, we can infer whether theEvent Data displays characteristics similar to the Training Data. If theEvent Data displays characteristics that are similar to the Training Data, we can infer from that the likelyAttributes andInterests of the user to whom theEvent Data relates. TheseInferences are then used to deliver advertising and provide aggregated, analytical reporting to our Clients.

URL (Uniform Resource Locator)

A URL, also known as a web address, is a reference to a unique web resource that specifies its location on a computer network. Most commonly, a URL points to a web page. URLs can also point to a document, image, video, etc. URLs often use plain text, such aswww.quantcast.com; in that case, the domain name must be processed by a Domain Name Server in order to convert the domain name into anIP Address.

Effective August 29th 2023

Table of Contents

Last Update: May 16, 2023

This Privacy Implementation for Quantcast Publisher Partners is for Quantcast publisher partners and clients (“publishers”) who include Quantcast code, such as pixels or tags, on their websites for Quantcast Measure or the Quantcast QID Module in Prebid. It documents certain privacy-related responsibilities for publishers, which are in addition to theUS Data Privacy Addendum (the “DPA”). If there is any conflict between this document and the DPA, the DPA is the controlling document.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

This document does not contain legal advice, and adherence to this document does not ensure legal compliance. Publishers must ensure for themselves that they operate in a legal manner, based on their particular circumstances. In the event of any conflict between this document and applicable laws or regulations, the laws or regulations should prevail.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a publisher has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Publishers are responsible for ensuring their own implementation of self-regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms used across jurisdictions that describe the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data.

Where the EU GDPR or the UK GDPR applies, Quantcast is a “controller” of personal data collected using Quantcast tags and pixels dropped on your sites. This document, together with the Quantcast agreement under which you access our services, addresses our respective GDPR compliance responsibilities. Where US state privacy law applies, Quantcast acts as a “third party” unless agreed otherwise.

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, including Quantcast Measure tags and the QID prebid module, publishers are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, publishers have to make sure of notice and choice for their own collection and processing of personal data.

At minimum, and further subject to any other applicable laws or rules, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising and advertising measurement), and how users can exercise their choices. Laws or rules in some jurisdictions, including the EU and the UK, would require that Quantcast be specifically identified in the notice, and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching, and cross-device matching (using passively collected data). The data Quantcast collects includes information about users’ visits to sites, such as IP address, device information, timestamp, referrer URL, etc.

Quantcast implements choice using industry standard methods, and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, publishers need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Publishers should, at minimum, and subject to any additional legal requirements provide a link to the geographically relevant industry opt-out page, including but not limited toYourAdChoices and theNAI in the US,Your Online Choices in Europe, andYour Ad Choices in Canada.

In all cases, publishers should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, publishers are responsible to make sure that tags or pixels don’t fire until that consent is obtained. Publishers must not send to Quantcast, or enable Quantcast to collect, personal data without having established required permissions, and certainly not if the user has explicitly opted out.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the publisher has no operations in Europe. Alternatively, such publishers may elect not to introduce data about EU or UK users into Quantcast’s services. Quantcast Choice is a leading, and TCF compliant, Consent Management Platform. Proper use of Quantcast Choice will meet these TCF requirements.

Publishers not using the TCF for EU or UK users may, only with Quantcast’s express written permission, use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF. In any case, publishers should not allow data to be collected by, or transmitted to, Quantcast on their sites without user consent, and must be able to provide proof of consent to Quantcast, upon request.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt-out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Publishers need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable. Unless agreed otherwise with Quantcast, Quantcast acts as a “third-party,” as defined under the CCPA, with respect to personal data it collects or receives from publishers’ sites. Quantcast will check the US Privacy String,as specified by the IAB.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, Virginia and elsewhere. Publishers need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US Data Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, when acting as a controller or third party, Quantcast will be responsible for honoring users’ access and deletion requests with respect to their personal data that is within Quantcast’s services.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category data” under applicable law or data about children under the age of 16, publishers must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and publishers may not send such information to Quantcast or cause Quantcast to collect it. If a publisher has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will publishers use any information collected or generated by Quantcast’s services to identify an individual user.

Effective June 25th 2025

Table of Contents

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self- regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party” in the State of California and as a “processor” or such similar designation for all other applicable US states.

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained. As to any personal information and/or personal data provided to Quantcast (whether provided by an advertiser, agency or a third-party on an advertiser or agency’s behalf), advertisers and agencies represent and warrant that as to such personal information and/or personal data, they have obtained any consent required by applicable laws, regulations and industry self-regulatory codes.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law (including data revealing racial or ethnic origin, political opinions, or parties, religious or philosophical beliefs, trade union membership or related to health status or treatment) or data about children under the age of 18 or such other age specified by applicable laws, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 18 or such other age specified by applicable laws. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law. Sensitive data also includes any data that qualifies as “consumer health data” under the Washington My Health My Data Act, 2023 Wash. Laws 191 or any other equivalent laws.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will clients and other partners use any information collected or generated by Quantcast’s services to identify an individual user.

Copyright © 2025,Quantcast

Effective June 11th 2025  to  June 25th 2025

Table of Contents

Privacy Implementation for Quantcast Advertiser Partners

Effective August 26th 2024

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self- regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party” in the State of California and as a “processor” or such similar designation for all other applicable US states.

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law (including data revealing racial or ethnic origin, political opinions, or parties, religious or philosophical beliefs, trade union membership or related to health status or treatment) or data about children under the age of 18 or such other age specified by applicable laws, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 18 or such other age specified by applicable laws. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law. Sensitive data also includes any data that qualifies as “consumer health data” under the Washington My Health My Data Act, 2023 Wash. Laws 191 or any other equivalent laws.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will clients and other partners use any information collected or generated by Quantcast’s services to identify an individual user.

Copyright © 2025,Quantcast

Effective August 26th 2024  to  June 11th 2025

Table of Contents

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self- regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party.”

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data

after it receives (or is notified of) a user’s request.Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law (including data revealing racial or ethnic origin, political opinions, or parties, religious or philosophical beliefs, trade union membership or related to health status or treatment) or data about children under the age of 16, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law. Sensitive data also includes any data that qualifies as “consumer health data” under the Washington My Health My Data Act, 2023 Wash. Laws 191 or any other equivalent laws.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will clients and other partners use any information collected or generated by Quantcast’s services to identify an individual user.

Effective July 29th 2024  to  August 26th 2024

Table of Contents

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self- regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party.”

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services. Quantcast Choice is a leading, and TCF compliant, Consent Management Platform.

Proper use of Quantcast Choice will meet these requirements.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law (including data revealing racial or ethnic origin, political opinions, or parties, religious or philosophical beliefs, trade union membership or related to health status or treatment) or data about children under the age of 16, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law. Sensitive data also includes any data that qualifies as “consumer health data” under the Washington My Health My Data Act, 2023 Wash. Laws 191 or any other equivalent laws.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will clients and other partners use any information collected or generated by Quantcast’s services to identify an individual user.

Effective April 5th 2024  to  July 29th 2024

Table of Contents

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self-regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party.”

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK: The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services. Quantcast Choice is a leading, and TCF compliant, Consent Management Platform. Proper use of Quantcast Choice will meet these requirements.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum: The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law (including data revealing racial or ethnic origin, political opinions, or parties, religious or philosophical beliefs, trade union membership or related to health status or treatment) or data about children under the age of 16, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law. Sensitive data also includes any data that qualifies as “consumer health data” under the Washington My Health My Data Act, 2023 Wash. Laws 191 or any other equivalent laws.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will publishers use any information collected or generated by Quantcast’s services to identify an individual user.

Effective January 23rd 2024  to  April 5th 2024

Table of Contents

Last Update: September 28, 2023

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theInternational Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self-regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party.”

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK:The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services. Quantcast Choice is a leading, and TCF compliant, Consent Management Platform. Proper use of Quantcast Choice will meet these requirements.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum:The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law or data about children under the age of 16, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will publishers use any information collected or generated by Quantcast’s services to identify an individual user.

Effective August 29th 2023  to  January 23rd 2024

Table of Contents

Last Update: May 16, 2023

This Privacy Implementation for Quantcast Advertiser Partners documents certain privacy-related responsibilities for advertisers and agencies, which are in addition to theUS State Data Privacy Addendum and theEEA/UK/Swiss Data Privacy Addendum (collectively, the “DPAs”). If there is any conflict between this document and the DPAs, the DPAs are the controlling documents.

Privacy regulation around the world is dynamic. Quantcast may update this document from time to time at its own discretion in order to keep pace with changes in privacy rules and risks, and industry best practices, as well as to ensure users’ rights are honored appropriately.

Quantcast may take reasonable measures to ensure that data processed in its services is collected and processed in accordance with privacy rules and industry best practices. We may review locations where data is collected and may refuse to accept data that is not collected in a manner consistent with the approaches described in this document.

Terminology

This document uses “user” or “users” as interchangeable with “data subject” or “consumer” or other equivalent terms from various rules.

When we say rules, we mean laws, regulations, and industry self-regulatory codes that are applicable to the processing of personal data in relation to Quantcast’s services. Quantcast has a global footprint, including operations in the EU, the UK, and the US (including California), so those jurisdictions’ rules are applicable to Quantcast for data about users who reside in those jurisdictions.

We also will use “personal data” as interchangeable with terms such as, “personal information.” Personal data processed by Quantcast’s service is pseudonymous, including but not limited to IP address, cookie or device IDs, and other identifiers used for advertising-related purposes. In the case where a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Industry standards and self-regulatory programs

Quantcast supports and participates in industry self-regulatory programs, and generally implements industry standards and best practices when it comes to handling personal data. Partners and clients are responsible for ensuring their own implementation of self-regulatory rules and industry best practices, in particular related to providing transparency and choice to users in places where data is collected or used by Quantcast’s services.

Controller, processor, service provider, vendor, etc.

Unfortunately, terms describing the relationships between parties sharing data are not interchangeable. Quantcast determines its role based on applicable law and the facts of its processing of personal data. In many relationships with advertiser partners or clients, Quantcast is a controller or joint controller, because of the role that Quantcast plays in defining exactly how data is used. This does not mean Quantcast has unfettered rights to use this data; rather, Quantcast’s use of the data is usually restricted by contractual limitations. If you have questions about this, please consult your agreement or ask your account representative.

Advertisers: Where the EU GDPR or the UK GDPR applies, Quantcast is a joint controller of personal data collected using Quantcast tags and pixels and of other personal data introduced into Quantcast’s services by the advertiser. Where US state privacy law applies, Quantcast acts as a “third party.”

Notice/Transparency and Choice

Laws, self-regulatory rules, and industry best practice require users be notified about processing of personal data, and be offered a choice – either opt in or opt out — with respect to that processing.

When deploying Quantcast tags or pixels, or otherwise introducing data into Quantcast’s services, partners and clients are responsible to make sure that users are given notice and choice that is required for Quantcast to be able to collect and process the data. And, of course, partners and clients have to make sure of notice and choice for their own personal data collection and processing.

Generally, notice must include the fact that third parties are collecting and processing users’ data, along with information about the data collected, the means of collection, the purposes for processing (including interest-based advertising), and how users can exercise their choices. Laws or rules in some jurisdictions would require that Quantcast be specifically identified in the notice and a link to Quantcast’sprivacy policy be included.

Quantcast’s methods of collection include, depending on particular circumstances, cookies, pixels, JavaScript tags, probabilistic device matching and cross-device matching (using passively collected data).

Quantcast implements choice using industry standard methods and will be responsible for honoring that choice with respect to personal data within Quantcast’s services.

For their part, partners and clients need to provide access to the choice using industry standard and legally compliant methods, depending on the applicable laws and rules. Usually this means providing access to choose within other privacy disclosures, including in a privacy policy.

In all cases, partners and clients should have user-facing privacy policies that are prominently linked from their homepages and from content (sites, apps, etc.) where personal data are collected or used.

Privacy policies will adhere to applicable laws, as well as industry self-regulatory requirements and industry best practices. At minimum, policies should disclose the fact that third parties are collecting personal data for advertising-related purposes, and should describe the methods of collection, as described above. Particular circumstances and applicable rules may create additional requirements.

Where consent (opt-in) is required prior to setting cookies or collecting data, such as in Europe under ePrivacy, the GDPR, and the UK GDPR, partners and clients are responsible to make sure that tags or pixels don’t fire until that consent is obtained.

EU and the UK:The industry standard means for ensuring notice and choice for vendors like Quantcast in the EU and the UK is the IAB Europe Transparency and Consent Framework. Quantcast is vendor ID 11. Quantcast’s required purposes and associated legal bases are viewable in the Global Vendor List. Because Quantcast is subject to European law, the TCF should be used for all users in the EU or the UK, even if the client or partner has no operations in Europe. Alternatively, such partners and clients may elect not to introduce data about EU or UK users into Quantcast’s services. Quantcast Choice is a leading, and TCF compliant, Consent Management Platform. Proper use of Quantcast Choice will meet these requirements.

Partners and clients not using the TCF for EU or UK users need to use a legally compliant alternative means to ensure Quantcast’s legal basis for using cookies, where applicable, and for processing the data. This includes that Quantcast must be identified as a controller of the user’s personal data, and a link to Quantcast’s privacy policy must be provided. Quantcast may in the future require TCF.

Privacy policies in the EU and the UK need to include a link to the European Interactive Digital Advertising Alliance (EDAA) opt out page, located at youronlinechoices.com.

US: In the US, along with other requirements laid out here, privacy policies need to include links to an industry standard opt out page, like those offered by the NAI or DAA.

California: The CCPA applies for users in California. Partners and clients need to provide users with notice of their “sale” and “share” opt-out rights and the ability to exercise such rights, as applicable.

Other US states: Applicable state privacy law applies for users in Colorado, Connecticut, Utah, and Virginia. Partners and clients need to provide users with notice of their “sale” and “targeted advertising” opt-out rights and the ability to exercise such rights, as applicable.

US State Privacy Addendum:The processing of US users’ personal data in connection with Quantcast’s services shall be governed by the US State Privacy Addendum,which is available here.

Access and Deletion

Under applicable law, including the EU GDPR, the UK GDPR, and the US state privacy laws, as a joint controller or third party, Quantcast will be responsible for providing users access to their personal data that is within Quantcast’s services, and for deleting personal data after it receives (or is notified of) a user’s request.

Other Matters

Sensitive data. Because Quantcast’s services are not intended for processing data regarded as “sensitive” or “special category” under applicable law or data about children under the age of 16, partners and clients must not transmit to Quantcast or cause Quantcast to collect any such data. Quantcast tags and pixels may not be deployed on content that is directed at children under the age of 16. Sensitive or special category data includes the types of data listed in Article 9 of the EU GDPR, Section 1798.140 of the CCPA (as amended by the CPRA), or any equivalent term under applicable law.

Directly identifying personal data. Quantcast’s services are not designed to process directly identifying personal data, such as names or email addresses, and partners and clients may not send such information to Quantcast or cause Quantcast to collect it. If a partner has express permission from Quantcast to use email address, phone number, or other directly identifying information, such information will be pseudonymized (usually hashed or encrypted,) according to Quantcast specifications, before transmitting to Quantcast.

Reidentification. Under no circumstances will publishers use any information collected or generated by Quantcast’s services to identify an individual user.

Effective September 11th 2023

Table of Contents

Laws that may require us to process your information

As described in our Privacy Policy, we process information when we comply with a legal obligation including, for example, to access, preserve or disclose certain information if there is a valid legal request from a regulator, law enforcement or others. See below the current list of laws which are enforceable in Ireland that give rise to a legal obligation for Quantcast which results in the processing of information. New laws may be enacted, or other obligations may become binding on our processing of your information which may require us to process your information, and we will update this list from time to time.

Civil and Commercial Laws:

Court orders requiring the processing of information can be issued under:

• Regulation (EU) No 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters.
• Council Regulation (EC) No 1206/2001 of 28 May 2001 on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters.

Criminal Laws:

Search warrants and production orders requiring the processing of information can be issued under:

• Section 10 of the Criminal Justice (Miscellaneous Provisions) Act 1997 as amended by 6(1)(a) of the Criminal Justice Act 2006
• Section 7 of the Child Trafficking and Pornography Act 1998
• Section 14 of the Criminal Assets Bureau Act 1996
• Section 63 Criminal Justice Act 1994, as amended
• Section 15 of the Criminal Justice Act 2011
• Section 7 Criminal Justice (Offences Relating to Information Systems) Act 2017
• Section 48(2) and Section 52 of the Criminal Justice (Theft and Fraud Offences) Act 2001
• Section 74 and Section 75 of the Criminal Law (Mutual Assistance) Act 2008
• Section 96 of the Garda Síochána Act 2005
• Section 51(6)(b) of the International Criminal Court Act 2006
• Section 26 of the Misuse of Drugs Act 1977, as amended
• Section 29 of the Offences Against the State Act 1939
• Section 16 of the Official Secrets Act 1963
• Section 25 of the Prevention of Corruption (Amendment) Act 2001

Consumer Laws:

Regulatory requests requiring the processing of information can be issued under:

• Section 11, Section 18 and Section 36 of the Competition and Consumer Protection Act 2014.

Corporate and Taxation Laws:

Regulatory requests requiring the processing of information can be issued under:

• Section 787 of the Companies Act 2014.

Regulatory:

Regulatory requests requiring the processing of information can be issued under:

• Chapters IV and VI of General Data Protection Regulation, Part 6 of the Data Protection Act 2018.

Effective September 18th 2025

Table of Contents

These Quantcast Advertise Insertion Order Terms & Conditions (“IO Terms”) govern the Insertion Orders (“IOs”) that reference these IO Terms. In these IO Terms, the party entering into the IO will be called “Company” and the Quantcast entity identified on the relevant Insertion Order will be called“Quantcast”. Quantcast will provide the services set forth in the IO and these IO Terms (“Services”).

These IO Terms are comprised of the following:

In addition, Company will comply with Quantcast’s then-currentCampaign and Data PolicyandPrivacy Requirements(collectively the “Campaign Policy”). All of the foregoing linked addenda and policies constitute “Policies” under the 4As Terms.

j.Additional Company Representation and Warranty.

k.For Placements Priced on a CPA basis.

i. Company agrees to pay Quantcast for the conversions and click-thru conversions as stated within the applicable placement. The conversion is defined as from both click-thru and view- thru conversions.

I.IAB Principles:Quantcastsupports the principles of IAB initiative ads.txtand appads.txt, and recommends all publishers adopt ads.txtand appads.txt as soon as possible. For inventory where we crawl a non-empty ads.txt file orappads.txt file, Quantcast will only consider buying inventory from authorized sellers.

X. MUTUAL INDEMNITY

“XI. LIMITATION OF LIABILITY QUANTCAST MAKES NO REPRESENTATIONS REGARDING THE BENEFITS TO COMPANY FROM THE SERVICES, OR THAT THE QUANTCAST PLATFORM OR ANY INFORMATION PROVIDED BY INVENTORY PARTNERS WILL BE ERROR-FREE, ALWAYS AVAILABLE OR OPERATE WITHOUT LOSS OR CORRUPTION OF DATA OR TECHNICAL MALFUNCTION. EXCEPT FOR CLAIMS RELATING TO INDEMNIFICATION, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING AS A RESULT OF DELAYS, LOSS OF DATA, LOSS OF USE OR LOSS OF PROFIT) ARISING OUT OF OR RELATED TO THESE IO TERMS, HOWEVER CAUSED AND UNDER WHATEVER CAUSE OF ACTION OR THEORY OF LIABILITY BROUGHT (INCLUDING CONTRACT OR NEGLIGENCE), EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. NOTHING IN THIS SECTION XI LIMITS ANY LIABILITY FOR FRAUD, FRAUDULENT MISREPRESENTATION, OR ANY OTHER LIABILITY WHICH CANNOT LEGALLY BE LIMITED. EXCEPT FOR CLAIMS RELATING TO PAYMENTS DUE, AND/OR INDEMNIFICATION, IN NO EVENT WILL EITHER PARTY’S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATED TO THESE IO TERMS EXCEED THE GREATER OF (A) ONE HUNDRED THOUSAND U.S. DOLLARS (US $100,000) OR (B) THE ACTUAL AMOUNT PAID AND/OR PAYABLE TO QUANTCAST FOR THE PROVISION OF SERVICES TO COMPANY IN THE TWELVE (12) MONTHS PRIOR TO THE DATE THE LIABILITY FIRST AROSE. The parties acknowledge that the limitations and exclusions contained in these IO Terms have been the subject of negotiation between the parties and represent the parties’ agreement based upon the perceived level of risk associated with their respective obligations under these IO Terms and the payments made hereunder.”

(a) to authorize LiveRamp to provide its Data Onboarding Service to Company, including to access and download Company’s CRM data for placement of data cookies and delivery of such cookies to Quantcast; (b) to upload all data to LiveRamp’s SFTP site, and not provide such data directly to Quantcast. Company is prohibited from sending Quantcast any Direct Identifiers, or recombining any data it receives from Quantcast with Direct Identifiers; (c) Company will not (i) resell or provide access to LiveRamp’s Data Onboarding Service to anyone except Authorized Users, (ii) reverse engineer, aggregate, or disambiguate any data or technology received from LiveRamp or its services (except as expressly agreed by LiveRamp in writing), (iii) use such service to sell or advertise any products that are sexually- oriented or related to tobacco, illegal gambling, firearms, or any other illegal product; (d) Company will not provide LiveRamp with any data (i) related to an individual’s health or medical condition, sexual orientation, or religion, (ii) of those under age 18 (or age 13 if from Australia), (iii) with attributes that correlate to unique records or individuals, or (iv) for which Company does not own or have rights to, or has not otherwise obtained consent to provide to LiveRamp; and (e) Company additionally warrants that: (y) it will not direct data to any other destination other than Quantcast unless Company has a direct agreement with the entity controlling such destination, and (z) obtained and maintained all required consents under Applicable Privacy Laws for LiveRamp to collect, use and retain personally identifiable information provided to LiveRamp hereunder.

Effective April 3rd 2024  to  September 18th 2025

Table of Contents

Last Updated: September 28, 2023

j.Additional Company Representation and Warranty.

i. Company represents and warrants that it will comply with all applicable laws and has obtained all necessary licensure for performance hereunder, and that Ads will not infringe or violate any applicable laws, ordinances, rules, codes, or regulations (including, without limitation, any industry-specific ethical, professional, or self-regulatory requirements or guidelines, and Applicable Privacy Laws) or the rights of any third party. If Company is an Agency (as defined in the 4As Terms), Company also represents and warrants that it has the authority to bind its Clients to these IO Terms and each IO, and that all of Company’s actions related to these IO Terms and each IO will be within the scope of such agency.

k.For Placements Priced on a CPA basis.

i.Company agrees to pay Quantcast for the conversions and click-thru conversions as stated within the applicable placement. The conversion is defined as from both click-thru and view-thru conversions.

Effective January 23rd 2024  to  April 3rd 2024

Table of Contents

Last Updated: September 28, 2023

j.Additional Company Representation and Warranty.

i. Company represents and warrants that it will comply with all applicable laws and has obtained all necessary licensure for performance hereunder, and that Ads will not infringe or violate any applicable laws, ordinances, rules, codes, or regulations (including, without limitation, any industry-specific ethical, professional, or self-regulatory requirements or guidelines, and Applicable Privacy Laws) or the rights of any third party. If Company is an Agency (as defined in the 4As Terms), Company also represents and warrants that it has the authority to bind its Clients to these IO Terms and each IO, and that all of Company’s actions related to these IO Terms and each IO will be within the scope of such agency.

k.For Placements Priced on a CPA basis.

i.Company agrees to pay Quantcast for the conversions and click-thru conversions as stated within the applicable placement. The conversion is defined as from both click-thru and view-thru conversions.