Legitimate Interest Assessment (LIA)

Entity: Advisible AB — Advertising Technology Platform

Legal Basis: Article 6(1)(f) GDPR — Legitimate Interest

Scope:

  • Purpose 2: Select basic ads
  • Purpose 7: Measure ad performance
  • Special Purpose 1: Ensure security, prevent fraud, and debug
  • Special Purpose 2: Deliver and present advertising and content
  • Special Purpose 3: Save and communicate privacy choices

1. Purpose Test

Our advertising platform supports third-party publishers and advertisers in delivering contextual, non-personalized advertisements and measuring their performance. We also ensure the technical delivery of ads and maintain the security and integrity of our systems. These processing activities serve the following legitimate interests:

  • Supporting ad-funded content through contextual advertising.
  • Providing advertisers with accurate performance metrics.
  • Ensuring fraud prevention, platform stability, and secure ad delivery.
  • Storing and transmitting users' privacy preferences.

These processing purposes are well-aligned with user expectations for ad-supported online services.

2. Necessity Test

The processing of limited data is strictly necessary for the purposes outlined:

  • Purpose 2 (Select basic ads):
    • We use non-identifying, contextual information (such as device type, placement metadata, and page-level context) to select non-personalized ads.
    • No profiling, tracking, or persistent identifiers are used unless additional consent is provided.
  • Purpose 7 (Measure ad performance):
    • We record ad impressions and related engagement signals for reporting purposes.
    • If the user has not consented to personalized advertising (Purposes 3 and 4) or objects to Purpose 7, we still measure ad performance but associate it with a nil identifier, ensuring that metrics remain anonymous.
  • Special Purposes 1, 2, and 3:
    • We process IP addresses, user agents, and similar request-level data to prevent fraud and technical errors, deliver ad content, and record user privacy preferences. This is necessary to ensure a functioning and secure service.

3. Balancing Test

We have assessed whether our legitimate interests are overridden by the rights and freedoms of the user. The following safeguards are in place:

  • We provide full transparency about our data use via publisher CMPs (under the IAB TCF).
  • Users can object to Purposes 2 and 7 at any time via the CMP interface.
  • We do not use personal identifiers unless the user has:
    • Consented to Purpose 1 (storage),
    • Consented to Purpose 3 (ads profile creation),
    • Consented to Purpose 4 (ads selection), and
    • Not objected to Purpose 7.
  • If these conditions are not met, a pseudonymous user ID may be stored (if Purpose 1 is consented), but is not used in any processing.
  • We still record ad delivery metrics in this fallback case, but associate them with a nil (anonymous) identifier.
  • We limit data retention and use aggregation and pseudonymization where appropriate.

These safeguards minimize the impact on individual privacy while supporting the commercial needs of publishers and advertisers.

4. Conditional Use of User Identifiers

When the user has provided consent to Purpose 1, we generate and store a pseudonymous user ID in a cookie. However, this identifier is only used in advertising-related processing (such as frequency capping, deduplication, or personalized ad selection) when the following conditions are met:

  • Consent is also given for Purpose 3 and Purpose 4, and
  • The user has not objected to Purpose 7.

If these conditions are not fulfilled, we do not use the user ID, and ad delivery proceeds without personalization or frequency capping.

In such cases, any ad-related metrics are recorded using a nil identifier and cannot be linked to any individual user. This protects user privacy while still supporting high-level campaign reporting.

5. Conclusion

We conclude that processing under legitimate interest for:

  • Purpose 2 (basic ad selection),
  • Purpose 7 (ad performance measurement),
  • Special Purposes 1, 2, and 3

...is lawful, proportionate, and balanced. Personal identifiers are only used when fully authorized by user consent. All other processing is limited to what is necessary for contextual advertising, security, and basic measurement.

Therefore, our processing under legitimate interest complies with Article 6(1)(f) GDPR and the principles of transparency, necessity, and data minimization.