View as Markdown

CTV Identity and Privacy

CTV has no cookies. Identity and consent travel only in the parameters you send. This page lists them.

Device identity: ifa and ifa_type

The advertising identifier (IFA) is the resettable, user-controlled ad ID each CTV platform provides. Buyers use it for frequency capping, audience matching and attribution. Requests without a typed IFA are discounted or skipped by most CTV buyers.

Always send both parameters together:

Platform IFA source ifa_type
Roku RIDA, through the RAF macro ROKU_ADS_TRACKING_ID rida
Fire TV Fire OS advertising ID afai
Android TV Google advertising ID aaid
Apple TV IDFA, behind App Tracking Transparency idfa
Samsung Tizen TIFA tifa
Vizio VIDA vida
Xbox MSAI msai
Other, publisher-provided Your own session ID sspid

Rules:

  1. Send the platform's value as returned, including the zeroed ID when tracking is limited. Never generate, substitute or persist an IFA.
  2. Send lmt=1 whenever the viewer has limited ad tracking. Each platform exposes this flag next to its IFA API. Sending a real IFA when the viewer has opted out breaks platform policy.
  3. dnt mirrors any do-not-track signal you have. Most CTV integrations use only lmt.

Universal IDs: eids

If you use an identity solution such as UID2, RampID or ID5, send its tokens as a URL-encoded OpenRTB EID array:

[{"source":"uidapi.com","uids":[{"id":"<token>","atype":3}]}]

Limits. A parameter that breaks any of these is dropped:

  • At most 4 KB raw and 8 entries.
  • Each entry needs a string source and at least one uids[].id. atype is optional and must be an integer.
  • Unknown keys are stripped.

Validate the JSON before you wire it into a macro.

Regulatory signals

Send exactly the signals that apply. An absent parameter is accurate. A made-up value is a compliance problem.

Parameter When Value
us_privacy US traffic The IAB US Privacy string from your CMP or platform settings, for example 1YNN
gdpr and consent EEA and UK traffic gdpr=1 with the TCF v2 consent string. gdpr=0 only where you have determined GDPR does not apply.
gpp and gpp_sid When your CMP emits GPP The GPP string and the CSV of applicable section IDs
coppa Child-directed content 1. This is set per property. If your app or channel targets children, send it on every request.

Notes:

  • Many CTV platforms expose their own consent surfaces. Pass whatever your platform or CMP provides, and do not invent strings.
  • coppa=1 restricts demand. Where it applies it is required by law, and platform certification often requires it too.
  • A consent macro that fails to expand is dropped, which means no signal is sent. In regulated regions, buyers then skip the request. Check that macros expand.

Geo

The IP address (ip, or ipv6) drives geo targeting on the buy side, which is why server-side callers must forward the viewer's IP. You can also send lat, lon, country, region, city and zip when your app has them. country takes alpha-2 (US) or alpha-3 (USA), and both are normalized to alpha-3. If you omit it, Ezoic fills it from the request IP.

What Ezoic does with these values

Identity and privacy parameters go to buyers in the standard OpenRTB fields: typed IFA in the device object, EIDs in user.eids, and consent in the regulations objects. Ezoic does not enrich, substitute or infer identity you did not send. The values you put on the tag are the values buyers see.