To properly collect consent from end-users, the following information needs to be presented to the data subject in a clear and understandable manner:

We recommend the use of a registered Consent Management Platform (CMP) to collect and manage consent from website visitors. A CMP integrates with BidTheatre and the rest of the advertising ecosystem to signal consent in a uniform manner. There is currently a lot of activity in the industry around CMP's, and we expect adequate and free CMP's to be available soon.

Read more about CMP's here: http://advertisingconsent.eu

Use of a CMP is not required, and it is also possible to collect consent with proprietary message dialgoues. Note that we cannot give specific recommendations on wordings that is complaint with GDPR, since this will depend on the specific site and its personal data use. Below are however some examples of wordings that we find accurately informs and collects consent for use of BidTheatre's services.

Our marketing partners use cookies and collect data on your surf behaviour on this website. This data may be used for purposes of analysis and to target personified advertisements to you on third party websites. Use the links below to read more about use of your personal data and how you can inspect, delete and export what is stored about your web browser.

By clicking Accept below you give your consent to the use of this data.

Våra marknadsföringspartners nyttjar kakor och samlar in data on din surfaktivitet på denna webbplats. Dessa data kan användas för analysändamål och i syfte att rikta personligt anpassade annonser åt dig på tredje parts webbplatser. Använd länkarna nedan för att läsa mer om behandlingen av din persondata samt hur du kan inspektera, radera och exportera vad som finns sparat om din webbläsare.

Genom att klicka "fortsätt" nedan lämnar du ditt medgivande till detta.

We recommend IAB Europe GDPR Implementation Working Group's working paper on consent for more information: https://www.iabeurope.eu/policy/gig-working-paper-on-gdpr-consent/

From this paper we'd like to highlight a few conclusions:

"The GDPR does not require that consent requests list the names of processors which will process the data on behalf of a controller. The processor can do so on the basis of the consent granted to its controller"

Advertisers are not required to explicitly list BidTheatre as a processor for the purpose of attributing ad effectiveness or do retargeting (purpose 1 & 2).

Publishers are not required to explicitly list BidTheatre as a processor for the purpose of selling ad inventory programmatically via an SSP (purpose 4).

However, for the purposes of performing user syncing between SSP and DSP (purpose 5), or targeting ads based on recorded personal data (purpose 6), publishers will need to name BidTheatre explicitly, since BidTheatre acts as a controller of the personal data handled.

"Importantly, the GDPR does not establish a prohibition on making access to a service conditional on consent, although it requires a context specific assessment. The ePrivacy Directive clarifies that access to 'website content may still be made conditional on the well-informed acceptance of cookies' and use of similar tracking technologies. As a result, digital services, such as websites or apps are generally permitted to require users to consent to the collection their personal data through cookies or similar technologies before allowing them to use a service"

"IAB Europe’s position is that, when read together, the GDPR and ePrivacy Directive clearly allow private businesses to deny access to users who do not consent to data processing. Publishers are free to decide themselves which methods of obtaining consent fit best with their respective business models, including whether access to their service should be conditional on such consent and/or whether user experiences should vary depending on the user’s choices."

"This means that, where appropriate, a controller could request and obtain consent for a number of purposes en bloc without offering the data subject the possibility to agree only to a subset of those purposes."

"Consent can be obtained by a first party on behalf of themselves and their partners (and partners’ partners) on a 'service-specific' or 'global' basis"

"The Article 29 Working Party has endorsed the principle of global consent on the basis that it will provide a better user experience. Specifically, in their view, for an average user, the number of consent requests will decrease over time as the user navigates and expresses their consent on the internet..."

"Consent is valid as long as the processing of personal data is necessary to fulfil its purpose or until the data subject withdraws consent"