Legitimate Interest Statement
This statement explains the only processing for which Veridia relies on legitimate interest (Article 6(1)(f) GDPR) within the Transparency & Consent Framework, why that interest is legitimate, why the processing is necessary, and how we have weighed it against your rights. It supplements our Privacy Policy.
Scope
Veridia relies on legitimate interest for TCF Special Purpose 1 (ensure security, prevent and detect fraud, and fix errors) and TCF Special Purpose 2 (deliver and present advertising and content) only.
We rely on consent, never legitimate interest, for every advertising purpose we have registered: storing or reading identifiers (Purpose 1), basic ad selection and delivery (Purpose 2), profiling and personalised advertising (Purposes 3 and 4), measurement (Purpose 7), audience research (Purpose 9) and service improvement (Purpose 10). If you have not consented to Veridia for Purposes 1, 3 and 4, we do not recognise you across websites at all.
The interests we pursue
| Special purpose | Interest | Who benefits |
|---|---|---|
| 1 — Security, fraud prevention, error correction | Detecting invalid traffic (bots, spoofed sites, click farms), protecting our systems from abuse, and diagnosing delivery failures | Advertisers, who should pay only for genuine human impressions; publishers, whose inventory value depends on a fraud-free market; users, who are protected from malicious ad delivery; Veridia itself |
| 2 — Technical delivery of advertisements | Responding to a bid request, serving the creative in the correct size and format, and confirming that it rendered | Users, who receive a working page; publishers and advertisers, whose transaction depends on delivery actually happening |
Both interests are recognised in Recital 47 GDPR (fraud prevention) and in the TCF Policies, which treat these activities as strictly necessary to any advertising transaction and therefore not subject to a consent choice in the framework.
Data used
For these special purposes we process only what a bid request and an ad-delivery event necessarily contain: page domain and ad slot, browser and device class, the IP address at the moment of the request, timing information, and — only where you have consented to Purpose 1 — the pseudonymous identifier in our cookie, which improves invalid-traffic detection. On the contextual path, invalid-traffic detection works on the request alone, without any persistent identifier.
Necessity
There is no less intrusive way to detect fraudulent traffic than to examine the traffic itself. Invalid-traffic patterns are visible only in the combination of IP, timing, device signals and request behaviour. Likewise, an advertisement cannot be delivered without processing the request that asks for it. We have limited the processing to what these outcomes require:
- IP addresses are used at ingress for geolocation and invalid-traffic scoring, then shortened before storage (IPv4 /24, IPv6 /48). A full address is retained only under an open fraud investigation, for 30 days.
- Sampled requests kept for fraud analysis are pseudonymised and deleted after 90 days.
- No profile is built and no segment is inferred for these purposes.
Balancing
We have weighed our interests against the impact on you and concluded that the balance favours the processing, for these reasons:
- Reasonable expectations. A person visiting an ad-supported website expects advertisements to be delivered and expects the ecosystem to protect itself from fraud. These activities do not extend beyond that expectation.
- Low intrusiveness. The processing does not reveal anything about your interests, does not track you across websites, and does not influence which advertisement you see other than by excluding fraudulent placements.
- Short retention and minimisation. See the limits above; all retention is enforced by technical expiry.
- EU-only processing. No data leaves the European Union; no third-country transfer risk arises.
- Independent from consent choices. Declining consent does not increase what we process for these purposes; it reduces it, because the identifier is then absent.
The full legitimate interest assessment is maintained in our records of processing and reviewed with our Data Protection Officer at least annually and whenever the processing changes.
Your right to object
You may object to this processing under Article 21 GDPR by writing to dpo@veridiaeu.com. We will assess each objection individually. Because fraud prevention and secure delivery protect all participants in a transaction and are impossible to perform selectively, we will usually be able to demonstrate compelling legitimate grounds that override the objection for traffic that reaches us; we will tell you our decision and the reasons for it. Independently of any objection, you can prevent us from recognising you across websites by withholding or withdrawing consent in publishers' privacy settings, or by using our opt-out at t.veridiaeu.com/optout.
You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.