IAB Tech Lab finalises data deletion request framework to streamline digital ad supply chain privacy compliance

Global digital advertising technical standards-setting body, IAB Tech Lab, has released the final Data Deletion Request Framework (DDRF), following the conclusion of two extensive public comment periods. This signifies an important step forward in handling consumer data privacy concerns within the digital advertising supply chain.

The Indian government is rapidly moving towards enacting the Digital Personal Data Protection Act (DPDPA) to create a strong framework for digital privacy. This Act will bring major changes, requiring brands and ad agencies to update privacy policies, set up consent mechanisms, and comply with rules on data portability and erasure.

Ensuring users understand and agree to how their data is processed will be crucial, making clear consent mechanisms essential. Companies will need to upgrade their systems to support data portability, allowing users to transfer their data between providers easily. Additionally, specific procedures for obtaining consent from parents or guardians for minors and individuals with disabilities will need to be put in place.

Brands and advertising agencies must implement ways for users to request data deletion. They will also need to provide data protection notices in all 22 languages listed in the Eighth Schedule of the Constitution, which will require considerable technical and interface updates. Compliance will lead to additional costs, including investments in new technology and personnel.

“The industry has long struggled with the need for a standardised solution to manage data deletion requests,” said Jared Moscow, director of product, privacy and addressability at IAB Tech Lab. “The DDRF addresses this challenge head-on, providing clear guidance and strategic insights into effectively handling these requests. It equips industry players with the technical tools necessary for efficiently managing data deletion requests.”

The DDRF establishes a standardised mechanism for transmitting data deletion request signals throughout the digital advertising ecosystem. It provides provisions for validating request origins, ensuring requester authenticity, confirming receipt, and employing cryptographic signatures for authentication.

This interoperable framework supports compliance with existing privacy legislation and lays the groundwork for future privacy initiatives within the adtech ecosystem.

The DDRF builds upon IAB Tech Lab’s portfolio of privacy compliance initiatives, including the Global Privacy Platform, the Accountability Platform, and the Privacy Taxonomy project. Collectively, these form a foundational framework for streamlining privacy regulatory compliance and advancing responsible data-handling practices in digital advertising.

Several organisations, including Google, Roku, Ketch, Sourcepoint, Dstillery, Raptive, Mediavine, and Index Exchange, were active in shaping the framework during the development process. Jonathan Joseph, head of solutions of privacy compliance provider Ketch, said, “The DDRF will bring much-needed efficiency to the entire ecosystem, helping to automate what has, to date, been a manual, arduous process. We will be adopting and integrating it into our product solutions so our clients can take advantage of the new framework.”

John Rosendahl, director of product management at Mediavine added that DDRF solves critical challenges publishers face in transmitting data deletion requests. “It reduces the technical complexities in transferring data and provides publishers with the tools they require to remain compliant,” he said.