The Trade Desk and Data Protection – What Belongs in the Privacy Policy
Concise guide to The Trade Desk: data processed, purposes, legal bases (GDPR) and what website operators must include in their privacy policy.
The Trade Desk and Data Protection – What Website Operators Need to Know
If a website operator uses The Trade Desk, they process visitor and interaction data for the purpose of programmatic advertising and audience building on the basis of consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. This information is based on the provider's statements and publicly available sources.
A. Purpose and Function of The Trade Desk
The Trade Desk is a Demand-Side Platform (DSP) for programmatic advertising, i.e. a software platform that enables advertisers to book advertising space on the internet automatically, in a targeted manner and in real time. Website operators integrate a small code snippet – the so-called TTD pixel or TTD tag – into their website. This pixel is executed when a visitor loads the website.
The pixel collects data about the visitor and forwards it to The Trade Desk. The Trade Desk uses this data to segment the visitor into target groups (audiences) and later display targeted advertising to them on other websites – for example while visiting news portals or social media. This procedure is called retargeting or remarketing.
Technically, the integration works as follows: The TTD pixel is inserted as JavaScript code into the <head> or <body> area of the website. When the page loads, The Trade Desk sets a tracking cookie on the visitor's device via the pixel. In addition, cookie data from other partners (e.g. Google Analytics) can also be transmitted to The Trade Desk.
B. Mandatory Disclosures in the Privacy Policy regarding The Trade Desk
The GDPR requires website operators to transparently explain the following points in their privacy policy:
- Processing purposes (Art. 13(1)(c) GDPR): Why is data processed?
- Legal bases (Art. 13(1)(c) GDPR): On what legal basis does the processing take place?
- Legitimate interests (Art. 13(1)(d) GDPR, if relevant): If legitimation is based on legitimate interests, these must be disclosed.
- Recipients or categories of recipients (Art. 13(1)(e) GDPR): To whom is data shared?
- Third-country transfers (Art. 13(1)(f) GDPR): Is data transferred to countries outside the EU/EEA? What safeguards apply to the transfer?
- Storage duration (Art. 13(2)(a) GDPR): How long is data stored?
Common error: Many website operators use tool-specific text templates directly from the providers' privacy policies. This contradicts the transparency requirement of Art. 12(1) GDPR. Instead, it is recommended to choose a topic-oriented approach: The privacy policy should be structured by processing purposes (e.g. "web analytics", "advertising", "CRM"), not by individual tools. The tools used can then be listed in an appendix or recipient list.
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
C. Provider of The Trade Desk: The Trade Desk Inc. / The Trade Desk GmbH
| Aspect | Information |
|---|---|
| Legal name | The Trade Desk Inc. (USA) and The Trade Desk GmbH (EU establishment) |
| Address (USA) | 42 N. Chestnut St., Ventura, CA 93001, USA |
| Address (Germany) | The Trade Desk GmbH, Ballindamm 17, 20095 Hamburg, Germany |
| Country of seat | USA (Ventura, California) |
| DPF status | Certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework |
| Privacy Policy | https://www.thetradedesk.com/us/privacy |
| Role | Independent controller vis-à-vis the website operator; for EU visitors also data recipient in the case of third-country transfer |
D. Data Processing by The Trade Desk – Workflow
Collection
The Trade Desk collects data when the TTD pixel loads on the website. This happens every time a visitor accesses the website. The web server log data, click paths, device data and technical identifiers listed below are collected. The visitor's consent is obtained by the website operator before data storage.
Storage
Data is stored by The Trade Desk on its servers, some of which are located in the USA (see third-country transfers). According to the provider, the standard storage duration for tracking cookies is approximately 13 months.
Use
The Trade Desk uses the stored data to segment visitors into target groups (audiences). These target groups are made available in the bidding platform. Advertisers can query and address these target groups when purchasing advertising space.
Sharing
The data is shared with advertisers who book advertising space via The Trade Desk and want to specifically address these target groups. In addition, data may be exchanged with other data brokers, advertising networks and programmatic platforms (see also: subprocessors and partners).
Deletion
After the storage period (default: 13 months) has elapsed, the data assigned to the cookie is automatically deleted. A manual deletion request by visitors must be processed by the website operator and forwarded to The Trade Desk.
E. Data Collected when Using The Trade Desk
The Trade Desk collects a wide range of data about website visitors. This includes:
- The unique identifier of the visitor (cookie ID or TTD Unified ID)
- IP address (partly hashed)
- Time and duration of the website visit
- All pages visited on the website (URL and referrer)
- Clicked links and buttons
- Scroll movements and time spent on pages
- Device type, operating system, screen resolution
- Browser name and browser version
- Coarse location data based on the IP address
- External data that the website operator passes to The Trade Desk (e.g. from CRM systems)
This data can be classified into the following standardized data type classes:
- Web server log data: IP address, date/time/time zone, URL, referrer, browser/OS/device, technical metadata
- Click paths: Visited pages incl. referrer, clicked links/buttons with date/time
- Device data: Device type, operating system, screen resolution/size, orientation, touch support
- Browser information: Browser name, browser version, installed extensions
- Coarse location data: IP-based coarse location at city/municipality level
- Interaction data: Scroll movements, mouse movements, key presses, clicks
- Usage profiles: Interest categorizations, audience assignments, usage histories
F. Purposes of Use when Using The Trade Desk
The Trade Desk processes data for the following purposes:
- General marketing: Targeting of advertising campaigns overall, performance measurement and optimization of ad placements
- User profile creation: Automatic segmentation of visitors into target groups (audience building), categorization by interests and behavior
- User-individual marketing: Remarketing and retargeting for targeted personalized advertising campaigns that the visitor sees on other websites
- General product improvement: Optimization and development of platform functionality through evaluation of usage data
These purposes are necessary for the operation of the platform and are legitimized by the website operator via consent.
G. Legal Bases for The Trade Desk
Category: The Trade Desk is a tracking tool for programmatic advertising.
Legal basis: Consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (Telecommunications Telemedia Data Protection Act).
Under German law, a website operator may only set a tracking cookie or use a tracking technology with the visitor's prior consent. This consent must:
- Be specific, informed and unambiguous (Art. 4(11) GDPR)
- Be obtained before the data processing
- Be documented (duty of proof)
- Be granularly structured – i.e. different tracking purposes should be approved individually
Consent mechanism: The website operator should use a cookie banner or a consent management tool (CMP) that asks before The Trade Desk pixel loads: "May The Trade Desk track your behavior for the purpose of advertising?" A simple "Accept all cookies" is not sufficient – the consent must be specific to The Trade Desk (or at least to the category "marketing tracking").
Note: In each case, the legal basis should be reviewed with a lawyer. Special rules may apply to B2B websites.
H. Special Features and Notes regarding The Trade Desk
- Opt-out option: Visitors can opt out of The Trade Desk tracking at https://www.thetradedesk.com/us/privacy (opt-out link). This should be mentioned in the privacy policy.
- TTD Unified ID: The Trade Desk is working on a first-party alternative (TTD Unified ID) to ensure targeting functionality after the end of third-party cookies. This technology is not yet widely deployed.
- Role of the website operator: The website operator is the controller for collecting consent; The Trade Desk is the data recipient and acts under its direction.
- No independent processor relationship: The Trade Desk does not act as the website operator's processor, but as an independent controller. There is no classic processor relationship (DPA).
- DPF certification: The Trade Desk is certified under the Data Privacy Framework, which ensures the legal compliance of data transfers to the USA.
I. FAQ on The Trade Desk
J. Conclusion and Recommendation regarding The Trade Desk
Summary: The Trade Desk is an invasive tracking technology for programmatic advertising. It requires the visitor's explicit, specific and informed consent. Without consent, its use is unlawful.
Why text templates are problematic: Many website operators simply copy The Trade Desk's privacy policy into their own privacy policy. This is not compliant with Art. 12(1) GDPR, which requires clarity and readability. Visitors should understand which of their data is being processed and why – not be confused by the provider's legal documentation.
Recommended approach: A topic-oriented privacy policy with a recipient appendix is clearer and more legally compliant. The statement should, for example, explain under the heading "Programmatic advertising and remarketing" that visitor data is collected, stored and shared with advertising networks such as The Trade Desk – transparently, comprehensibly, without jargon.
This article serves as general information about The Trade Desk and does not replace legal advice in individual cases. As of: 2026-04-22.
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
Authorship
This knowledge article is provided by matterius GmbH. matterius is not a law firm and does not provide legal advice.
matterius is editorially accompanied by Dr. Thomas Helbing, a German-based lawyer specialised as Fachanwalt für IT-Recht (certified specialist for IT law) in Munich.
Dr. Helbing has been continuously recognised by Handelsblatt since 2020 through to today (2026) as one of "Germany's best lawyers" in the fields of IT law and data protection law.
According to Kanzleimonitor.de (editions 2024–2026), he ranks among the leading lawyers for data protection and IT law and is listed in the Top 100 lawyers in Germany. Kanzleimonitor is regarded as a particularly meaningful market study, as it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes — from startups to high-growth SaaS companies and unicorns through to international corporations.
His professional background covers the full spectrum of practice in IT and technology law. He began his career at an international major law firm, subsequently gained in-house experience at a DAX corporation, and is himself an entrepreneur and founder of several digital projects. He also has hands-on programming experience, allowing him to understand technical systems, software architectures, and digital business models not only from a legal but also from a technical perspective.
For many years his clients have included technology companies and SaaS providers, leading German research institutions, and a systemically important German major bank. His advisory focus lies in particular in the areas of GDPR compliance, the data economy, SaaS, AI regulation, and IT contract law.
More about Dr. Helbing: www.thomashelbing.com
Tawk.to and Data Protection – What Belongs in the Privacy Policy
Tawk.to live chat: data processed, GDPR legal bases, DPA and what website operators must include in the privacy policy.
TikTok Pixel and Data Protection – What Website Operators Need to Know
Concise guide to TikTok Pixel: data processed, purposes, legal bases (GDPR) and what website operators must include in their privacy policy.