Policy & compliance · also called General Data Protection Regulation, Regulation (EU) 2016/679
GDPR
GDPR is the European Union's data protection law, which requires a lawful basis, such as consent, before a business processes personal data.
The General Data Protection Regulation governs how organisations handle personal data about people in the EU. Personal data is broad: cookie identifiers, IP addresses and a Click ID tied to an individual can all count.
Article 6 lists six lawful bases for processing: consent, contract, legal obligation, vital interests, public task and legitimate interests. For advertising cookies and personalised ads, consent is the basis platforms generally expect, which is why consent management banners exist. Google's EU user consent policy passes this duty to publishers using its ad products.
An arbitrageur touches personal data at every step: the traffic source's pixel, the tracker, the feed's ad request and the postback that sends revenue back to the ad platform. Each needs a lawful basis and a privacy notice that says what is collected and who receives it. Operators who buy only US traffic are outside GDPR's main reach but meet state privacy laws instead.
This entry is general education, not legal advice. Anyone targeting European visitors should take qualified advice.
Related terms
Consent management (CMP)
Consent management is the process, usually a cookie banner run by a consent management platform, of asking visitors for permission before using their data for ads.
Compliance
Compliance in search arbitrage means running ads, landing pages and traffic in a way that satisfies the feed's rules, the traffic source's rules and the law, all at once.
Tracking pixel
A tracking pixel is a small piece of code on a web page that tells an ad platform, through the visitor's browser, that a page view or action took place.
Device fingerprinting
Device fingerprinting identifies a device by combining many small technical traits, such as screen size, fonts and browser version, into one recognisable signature.
FTC Act (deceptive advertising)
The FTC Act is the US law that empowers the Federal Trade Commission to stop unfair or deceptive acts or practices in commerce, including deceptive advertising.
Sources: GDPR Article 6: lawfulness of processing, Google AdSense Help: EU user consent policy