# CTV Identity and Privacy

Source: https://docs.ezoic.com/docs/ctv/privacy/


CTV has no cookies. Identity and consent travel only in the parameters you send. This page lists them.

## Device identity: `ifa` and `ifa_type`

The advertising identifier (IFA) is the resettable, user-controlled ad ID each CTV platform provides. Buyers use it for frequency capping, audience matching and attribution. Requests without a typed IFA are discounted or skipped by most CTV buyers.

**Always send both parameters together:**

| Platform | IFA source | `ifa_type` |
|---|---|---|
| Roku | RIDA, through the RAF macro `ROKU_ADS_TRACKING_ID` | `rida` |
| Fire TV | Fire OS advertising ID | `afai` |
| Android TV | Google advertising ID | `aaid` |
| Apple TV | IDFA, behind App Tracking Transparency | `idfa` |
| Samsung Tizen | TIFA | `tifa` |
| Vizio | VIDA | `vida` |
| Xbox | MSAI | `msai` |
| Other, publisher-provided | Your own session ID | `sspid` |

Rules:

1. **Send the platform's value as returned,** including the zeroed ID when tracking is limited. Never generate, substitute or persist an IFA.
2. **Send `lmt=1` whenever the viewer has limited ad tracking.** Each platform exposes this flag next to its IFA API. Sending a real IFA when the viewer has opted out breaks platform policy.
3. `dnt` mirrors any do-not-track signal you have. Most CTV integrations use only `lmt`.

## Universal IDs: `eids`

If you use an identity solution such as UID2, RampID or ID5, send its tokens as a URL-encoded OpenRTB EID array:

```json
[{"source":"uidapi.com","uids":[{"id":"<token>","atype":3}]}]
```

Limits. A parameter that breaks any of these is dropped:

- At most 4 KB raw and 8 entries.
- Each entry needs a string `source` and at least one `uids[].id`. `atype` is optional and must be an integer.
- Unknown keys are stripped.

Validate the JSON before you wire it into a macro.

## Regulatory signals

Send exactly the signals that apply. An absent parameter is accurate. A made-up value is a compliance problem.

| Parameter | When | Value |
|---|---|---|
| `us_privacy` | US traffic | The IAB US Privacy string from your CMP or platform settings, for example `1YNN` |
| `gdpr` and `consent` | EEA and UK traffic | `gdpr=1` with the TCF v2 consent string. `gdpr=0` only where you have determined GDPR does not apply. |
| `gpp` and `gpp_sid` | When your CMP emits GPP | The GPP string and the CSV of applicable section IDs |
| `coppa` | Child-directed content | `1`. This is set per property. If your app or channel targets children, send it on every request. |

Notes:

- Many CTV platforms expose their own consent surfaces. Pass whatever your platform or CMP provides, and do not invent strings.
- `coppa=1` restricts demand. Where it applies it is required by law, and platform certification often requires it too.
- A consent macro that fails to expand is dropped, which means no signal is sent. In regulated regions, buyers then skip the request. Check that macros expand.

## Geo

The IP address (`ip`, or `ipv6`) drives geo targeting on the buy side, which is why server-side callers must forward the viewer's IP. You can also send `lat`, `lon`, `country`, `region`, `city` and `zip` when your app has them. `country` takes alpha-2 (`US`) or alpha-3 (`USA`), and both are normalized to alpha-3. If you omit it, Ezoic fills it from the request IP.

## What Ezoic does with these values

Identity and privacy parameters go to buyers in the standard OpenRTB fields: typed IFA in the device object, EIDs in `user.eids`, and consent in the regulations objects. Ezoic does not enrich, substitute or infer identity you did not send. The values you put on the tag are the values buyers see.