How do you map a campaign's data flows before legal review?
Part of US and Canada targeting
The short answer
An advertising data flow map lists each point where a campaign collects, receives or sends information: who collects it, which fields, where it goes, where it is stored and who can access it. Canadian and US regulators ask organizations to know what personal information they hold. The map gives the privacy lead facts to review; it does not decide compliance.
Key takeaways
- The FTC's first principle for businesses is "TAKE STOCK": know who sends personal information, how it comes in, what kind, where it is kept and who has access.
- Canada's federal, Alberta and BC commissioners call a personal information inventory the starting point of a privacy management program and say it is never a finished product.
- The organization that controls the information carries the responsibility under BC's act, including for information not in its custody, such as data a vendor holds.
- A campaign with no cookies can still pass IP addresses, user agents and location fields through bid requests and measurement tags.
What is an advertising data flow map?
Definition
- Advertising data flow map
- A record of each movement of information in a campaign, from the point of collection to each system and company that receives, stores or uses it, written in plain words so a privacy or legal reviewer can assess it.
The idea comes straight from regulator guidance. The FTC's guide Protecting Personal Information: A Guide for Business (opens in a new tab) opens with five principles, the first of which is "TAKE STOCK": "Know what personal information you have in your files and on your computers." In Canada, Getting Accountability Right with a Privacy Management Program (opens in a new tab), issued by the OPC with the Alberta and BC commissioners, says an organization "needs to know what personal information it holds, how it is being used" and whether it really needs it at all.
A campaign is a good unit for that inventory because it adds flows for a short time: a new tag on the site, a list uploaded to a platform, a survey vendor, a reporting feed. A map written at planning time captures them while the people who set them up are still in the room.
How should a team document each data flow before legal review?
Use one row per flow. The fields below follow the FTC's TAKE STOCK questions (who sends information, how it is received, what kind at each entry point, where it is kept, who has access) and the Canadian inventory guidance, which says documenting "the types of personal information that an organization collects and where it is held" is "critically important."
| Field | What to write | Where the field comes from |
|---|---|---|
| 1. Flow name | A plain label, such as checkout conversion tag or customer list upload | Team convention |
| 2. Collected from | The people or systems the information comes from | FTC: who sends personal information |
| 3. Entry point | Website tag, form, app SDK, file upload, bid request or vendor feed | FTC: how your business receives it |
| 4. Fields | Each field by name, such as email, IP address, user agent, order value, postal code | FTC: what kind at each entry point |
| 5. Purpose | Why the campaign needs the flow, in one sentence | Canadian inventory guidance: why it is collected, used or disclosed |
| 6. Recipient | Every company that receives the data, including subcontractors | FTC: outside service providers |
| 7. Storage and country | System, location and retention period | FTC: where you keep it; Canadian cross-border considerations |
| 8. Access | Roles and companies that can read it | FTC: who has or could have access |
| 9. Notice and consent record | Where people were told, and the consent basis the advertiser has recorded | Recorded fact for the reviewer to assess |
| 10. Owner and review date | The person accountable for the row and the next check | Canadian guidance: a designated Privacy Officer |
Which party determines whether a campaign data flow is in scope?
Regulators place the duty on the organization that controls the information. Section 4(2) of British Columbia's Personal Information Protection Act (opens in a new tab) says "An organization is responsible for personal information under its control, including personal information that is not in the custody of the organization," and section 4(3) requires it to designate one or more individuals responsible for compliance. The accountability guidance adds that someone "must be assigned responsibility for overseeing the organization's compliance with applicable privacy legislation."
Which law governs a flow is itself a fact pattern. The OPC (opens in a new tab) states that "Determining which law applies must be done on a case-by-case basis," and that PIPEDA continues to apply to personal information transferred across borders even in Alberta, BC and Quebec. That is why the worksheet records storage country and recipients rather than inferring the governing law from where the audience lives.
| Party | Facts it can supply | What it cannot settle alone |
|---|---|---|
| Advertiser | Site tags, customer lists, CRM, consent records, privacy notice text | How each vendor processes data downstream |
| Agency or media team | Platforms used, files uploaded, targeting settings, reporting feeds | The advertiser's legal position |
| Ad tech vendors | Fields received and passed on, storage location, subprocessors | Whether the advertiser's notice covers their use |
| Privacy or legal lead | Assessment of each row against applicable law | Facts nobody wrote down |
Could a cookie free measurement workflow still involve personal information?
The definitions turn on identifiability, not on cookies. The OPC's guidelines on online behavioural advertising (opens in a new tab) say information is about an identifiable individual "where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information," and name device fingerprinting among technologies individuals cannot control. California's privacy agency, CalPrivacy (opens in a new tab), lists "IP address", "Browsing history" and pseudonymous profiles such as "user1234" as personal information under the CCPA.
Bid requests carry fields like these whether or not a cookie is set. The OpenRTB 2.6 specification (opens in a new tab) defines Device fields including ip, "IPv4 address closest to device", ua, the browser user agent string, geo, the location "assumed to be the user's current location", and ifa, an ID sanctioned for advertiser use. The User object adds buyeruid and eids for identity providers. A map lists which of these fields reach each party in the campaign; the specification does not decide their legal status.
Non-cookie fields to look for in a measurement or reporting flow
- IP addresses, full or truncated, in tag requests, bid requests or server logs.
- User agent strings and device identifiers such as advertising IDs.
- Location fields, including postal codes or coordinates passed by apps.
- Hashed emails or phone numbers uploaded for matching or measurement.
- Order or survey records that can be joined back to an exposure log.
Can a planning document guarantee compliance with provincial law?
The regulators describe documentation as a starting point. The accountability guidance says "Every component of an accountable, compliant privacy management program begins with this assessment," and that a program "should never be considered a finished product; it requires ongoing assessment and revision in order to be effective and relevant." BC's act requires an organization to "develop and follow" the policies and practices it needs to meet its obligations, which is a duty about conduct as well as paperwork.
Who should own the data flow map?
The Canadian guidance names a Privacy Officer as "the one accountable for structuring, designing and managing the program, including all procedures, training, monitoring/auditing, documenting, evaluating, and follow-up," and lists among that officer's actions: "monitor and update personal information inventory continuously to keep it current and identify and evaluate new collections, uses and disclosures." In a campaign, that maps to one accountable owner on the advertiser side, with the agency maintaining the rows it creates.
Five steps to run the worksheet on one campaign
- Name the owner. Record the advertiser's accountable person and the agency contact for each row.
- List every flow. Walk the plan from site tags to final report and write one row per movement of data.
- Fill the fields from source. Take field names from tag configurations, upload files and vendor documentation, not from memory.
- Send to the privacy lead. Hand over the worksheet with the notice text and vendor contracts before launch.
- Set a change trigger. Reopen the row when a tag, vendor, list or reporting feed changes during the flight.
What does a filled data flow map look like?
Fictional example
An online wallpaper retailer adding Canada
A fictional online retailer of peel and stick wallpaper and paint, based in Raleigh, North Carolina, plans its first display campaign in English Canada beside home decor and renovation coverage, alongside its usual US flight.
Its map has six rows. The contextual site list carries no personal information. Bid requests on the buying platform carry ip, ua and geo fields received by ad tech vendors. A checkout tag sends order value and a hashed email to an analytics vendor in the US. A swatch request form collects names and postal addresses, stored in the retailer's commerce system. A brand lift survey vendor receives an exposure log. The weekly report contains only aggregated counts.
Each row names the receiving company, the storage country and an owner. The Canadian rows note the OPC's statement that transfers across borders fall under PIPEDA, and the privacy lead receives the map with the notice text. No results or performance figures are implied.
How does PlacementGraph fit in a campaign data flow map?
In the worksheet, PlacementGraph's site selection is its own row.
Frequently asked questions
Does a data flow map need to include aggregated reports?
Listing them is useful because aggregation is a fact the reviewer will want to confirm. The OPC's test asks whether there is a serious possibility of identifying someone from information alone or combined with other available information, so the row should state what the report contains and whether it could be joined to other data.
What should a map record about vendors' subcontractors?
The Canadian accountability guidance lists sub-contracting among the minimum privacy requirements for service providers, alongside contract provisions, breach notification to the organization, training and audits. Recording each subcontractor in the recipient field lets the reviewer see the full chain of companies that receive campaign data.
How long should campaign data be kept?
The worksheet records the retention period; the regulators set the standard. The FTC's guide says that without a legitimate business need for sensitive personally identifying information, a business should not keep it. Alberta's act allows retention only as long as reasonably required for legal or business purposes.
Is a data flow map the same as a privacy impact assessment?
A data flow map records facts about a campaign: what moves, where and to whom. An assessment evaluates risks and measures against applicable law, and is a separate document with its own requirements where a law calls for one. A completed map is input that the person running an assessment can use.
Sources
- Protecting Personal Information: A Guide for Business (opens in a new tab)US Federal Trade Commission
- Getting Accountability Right with a Privacy Management Program (opens in a new tab)OPC, OIPC Alberta and OIPC British Columbia
- Personal Information Protection Act, SBC 2003, c. 63 (opens in a new tab)BC Laws, King's Printer
- Provincial laws that may apply instead of PIPEDA (opens in a new tab)Office of the Privacy Commissioner of Canada
- Guidelines on privacy and online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
- What is personal information? (opens in a new tab)California Privacy Protection Agency (CalPrivacy)
- OpenRTB 2.6 specification (opens in a new tab)IAB Tech Lab
- Personal Information Protection Act, SA 2003, c. P-6.5 (opens in a new tab)Alberta King's Printer
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.