Data Mapping for Ad Networks
What are ad networks?
Ad networks connect advertisers (like your business) to publishers, who host ads. Common examples in digital advertising include Facebook Ads and Google Ads.
When does advertising involve sharing data with ad networks?
Not all digital advertising involves sharing personal information of potential ad viewers. For example, an ad service that uses contextual targeting, or the contextual customization of ads, does not generally require any transfer of data that relates to an identifiable individual.
Behavioral targeting, on the other hand, is a type of advertising that targets individuals based on their online or offline activity (i.e., personal information). Generally, that activity (the individual's "behavior") is tracked across different websites, apps, or services. For example, using behavioral advertising, an ad network might customize an advertiser's ads (such as content and placement) to a particular individual based on products the individual viewed, purchased, or searched for on various websites and platforms. If your business uses an ad network for behavioral advertising, it is most likely sharing personal information, such as the information of its web visitors and possibly its customers, as part of that service.
How does a business know what information it is sharing?
Browser-Based Tracking
A common method of information-gathering by ad networks is via browser-based tracker. An example is Facebook Pixel. Facebook Pixel is a tracker you embed in your website or online store that tracks what visitors to your website do. Because the same tracker is placed on millions of websites, Facebook Ads is able to link up a visitor's online activity across multiple websites to create a profile. This profile is what allows Facebook Ads to personalize the ad that's then shown to the visitor on Facebook. Other ad networks might use online cookies placed on your business's website.
Your business (the advertiser) may not know what specific information the ad network collects through this tracking device. If you have Pixel or other tracking devices from ad networks on your business's website, be sure to select "unique personal identifier" as a category of personal information your business shares with the ad network.
Your business may, however, optionally send custom events to ad networks, such as items added to an online shopping cart. If your business does so, select that information during data mapping as well (e.g., indicate in your Data Map that your business shares "purchases" with the ad network).
Server-Side API
Server-side APIs involve sharing information collected and stored on your business's server, which is shared directly with the ad network. With server-side APIs, the business knows (or can know) exactly what personal information it is sharing. Examples include Facebook's Conversion API and App Events API. The Conversion API is designed to collect and process information at the point of a transaction, such as when a consumer makes an online purchase. If your business uses a server-side API to target consumers, its Data Map should reflect the personal information it shares, such as purchases or any other online behavior (i.e., "events").
Offline Events
Offline events involve targeting consumers based on events or behaviors that took place offline, in the real world. For example, a consumer's in-store purchase would be an offline event. A business that uses offline events to target consumers for advertising purposes should map all sharing of distinct pieces of information they share with the ad network.
Custom Targeting
Custom targeting involves targeting a curated list of consumers using information provided by the advertiser, which the ad network then combines with information it knows from its own interactions with consumers or other businesses. For example, to use the FB Custom Audience ad service, a business will upload a list of email addresses and names of individuals for Facebook to target in ad campaigns. Facebook will not tell the business whether a contact is a Facebook user, but Facebook will determine who to target based on a combination of the data shared by the business and the data that Facebook itself maintains. A business that uses this type of ad service should map data sharing for any personal information they share directly with the ad network. For example, a business would select "name" and "email address" as categories of information shared with the ad network about the business's customers, if the business does in fact provide that information directly to the ad network.