SoundStack Legitimate Interest Assessments

Legitimate Interest Assessment for IAB TCF V2.2 Purpose 7

Purpose Description: Measure ad performance

This Legitimate Interest Assessment (LIA) evaluates the processing of personal data for Purpose 7 under the IAB Europe Transparency and Consent Framework v2.2: "Measure advertising performance” for the limited purposes of collecting information to measure whether and how ads were delivered to a user, determining the duration and percentages of ads that were presented to users, and providing reporting to publishers about the ads displayed on their properties.

This does not include:

Measuring or reporting on ads effectiveness and marketing campaign performance;
Personalizing ads under Purpose 4;

Section 1: Purpose Test

1.1 Identify the legitimate interest

The legitimate interest being pursued is the measurement and reporting of ad delivery for verification of contractual obligations, including:

Measuring the delivery of an advertisement using aggregated or non-aggregated data
Measuring the duration and percentage of an advertisement presented to a user
Measuring where (approximately) users interact with an advertisement
Measuring how users interact with an advertisement
Analyzing ad delivery patterns to uncover potentially fraudulent activity

1.2 Why is the processing necessary for this purpose?

The processing is necessary because:

Contract fulfillment requires accurate and comprehensive data on ad delivery metrics.
Ad delivery measurement requires collecting data on user interactions
Publishers need objective ad delivery metrics to evaluate advertising strategies

1.3 Is the interest legitimate?

Yes, the interest is legitimate for the following reasons:

Business need to measure ad delivery and fulfill contractual obligations
Economic interest in understanding the effectiveness of ad delivery
Industry standard practice to provide ad delivery metrics to publishers
Recognized by regulatory authorities as a legitimate business activity
Supports the sustainability of the advertising business model which underlies digital content creation and distribution
Supports measures to identify and mitigate fraud in the audio ecosystem

Section 2: Necessity Test

2.1 Is the processing necessary and proportionate?

Only data directly relevant to measuring ad delivery is processed
Processing is limited to data necessary for accurate measurement
Alternative methods without personal data processing would provide insufficient metrics and data for identifying and mitigating potential fraud
The scope of data collection is proportionate to the measurement needs
Data minimization principles are applied where possible

2.2 Can the same result be achieved in a less intrusive way?

Anonymous measurement provides insufficient accuracy for contract fulfillment and publishers
Anonymous measurement is insufficient to prevent fraud

Section 3: Balancing Test

3.1 What is the nature of the relationship with the individual?

Individuals are consumers of advertising content delivered through publishers who are business customers of SoundStack
Users typically expect some form of measurement as part of advertising delivery
The relationship is built around content consumption and engagement which is supported by advertising delivery

3.2 What type of data is being processed?

Counting of ads delivered
Duration of advertising content transmitted
Device used to receive advertising content
Approximate location from which advertising is received
Non-sensitive personal data related to contextual content consumption
Typically does not include special category data

3.3 Would people expect this processing to take place?

Most users understand that advertising delivery is measured
Industry transparency efforts have increased awareness
The TCF framework itself provides notice about this purpose
Ad measurement is a widely established practice in digital publishing
Most privacy notices explicitly mention delivery of advertising as a data use case

3.4 What is the possible impact on individuals?

Minimal direct impact on user experience
Potential for improved content relevance and quality
Limited profiling compared to personalization purposes
Generally no automated decision making that affects users
Potential privacy impact from data collection and processing

3.5 Are there additional safeguards that could be put in place?

Data retention limitations specific to measurement data
Technical and organizational measures to protect measurement data
Aggregation where possible for reporting purposes
Regular review of necessity and proportionality
Staff training on data protection requirements for measurement

Section 4: Outcome and Implementation

4.1 Outcome of the Balancing Test

Based on the assessment above, the legitimate interests in measuring advertising delivery performance outweigh the potential impact on individuals' privacy for the following reasons:

The processing is necessary for a legitimate business purpose
The data processed is generally non-sensitive
The impact on individuals is limited and potentially beneficial
Appropriate safeguards can be implemented
The processing is in line with reasonable user expectations

4.2 Implementation Requirements

To ensure compliance when relying on legitimate interest for Purpose 7:

Provide clear and accessible privacy information about measurement practices
Implement data minimization principles
Establish appropriate retention periods for measurement data
Ensure security measures are in place to protect data
Regularly review measurement practices and technologies
Document all processing activities related to measurement
Train staff on data protection requirements
Consider additional consent where local laws may require it

4.3 Ongoing Compliance

This LIA will be reviewed at least annually
Changes to measurement technologies or methodologies will trigger a review
Regulatory developments will be monitored for impact on this assessment
User feedback and complaints will be considered in ongoing evaluation
Data protection impact assessments will be conducted for high-risk measurement activities

Conclusion

Based on this assessment, legitimate interest can be an appropriate legal basis for Purpose 7 (Measure ad performance) under the IAB TCF v2.2, provided the implementation requirements are met and ongoing compliance is maintained.

Legitimate Interest Assessment for IAB TCF V2.2 Purpose 8

Purpose Description: Measure Content Performance

This Legitimate Interest Assessment (LIA) evaluates the processing of personal data for Purpose 8 under the IAB Europe Transparency and Consent Framework v2.2: "Measure content performance - The collection of information, and combination with previously collected information, to measure, understand, and report on your use of the service, and the performance of content you may see or interact with.

This does not include:

Personalizing content under Purpose 2;
Personalizing ads under Purpose 4;
Storing and/or accessing information on a device which is under Purpose 1

Section 1: Purpose Test

1.1 Identify the legitimate interest

The legitimate interest being pursued is the measurement, understanding, and reporting on content performance and user engagement, including:

Measuring the duration of users’ interactions with content
Measuring where (approximately) users interact with content
Measuring how users interact with content
Measuring content viewability and engagement metrics
Reporting on content metrics using aggregated or non-aggregated data
Analyzing listening patterns to uncover potentially fraudulent activity

1.2 Why is the processing necessary for this purpose?

The processing is necessary because:

Content effectiveness measurement requires collecting data on user interactions
Understanding which content performs well helps publishers improve the user experience
Content optimization requires linking user behavior to specific content items
Publishers need objective performance metrics to evaluate content strategy
Accurate measurement helps create more relevant and engaging content for users

1.3 Is the interest legitimate?

Yes, the interest is legitimate for the following reasons:

Economic interest in understanding content effectiveness
Business need to measure content performance and engagement
Industry standard practice for digital publishing
Recognized by regulatory authorities as a legitimate business activity
Supports the sustainability of digital content creation and distribution
Supports measures to identify and mitigate fraud in the audio ecosystem

Section 2: Necessity Test

2.1 Is the processing necessary and proportionate?

Only data directly relevant to measuring content performance is processed
Processing is limited to data necessary for accurate measurement
Alternative methods without personal data processing would provide insufficient insights
The scope of data collection is proportionate to the measurement needs
Data minimization principles are applied where possible

2.2 Can the same result be achieved in a less intrusive way?

Anonymous measurement provides insufficient accuracy for publishers
Anonymous measurement is insufficient to prevent fraud
Contextual-only measurement would significantly impair the ability to understand user engagement

Section 3: Balancing Test

3.1 What is the nature of the relationship with the individual?

Individuals are consumers of content operated by publishers who are business customers of SoundStack
Users benefit from improved content quality through measurement and optimization
Users typically expect some form of measurement as part of content delivery
The relationship is built around content consumption and engagement

3.2 What type of data is being processed?

Time spent on content
Device used to access content
Approximate location from which content is accessed
Non-sensitive personal data related to content consumption
Typically does not include special category data

3.3 Would people expect this processing to take place?

Most users understand that content effectiveness is measured
Industry transparency efforts have increased awareness
The TCF framework itself provides notice about this purpose
Content measurement is a widely established practice in digital publishing
Most privacy notices explicitly mention site usage measurement as a data use case

3.4 What is the possible impact on individuals?

Minimal direct impact on user experience
Potential for improved content relevance and quality
Limited profiling compared to personalization purposes
Generally no automated decision making that affects users
Potential privacy impact from data collection and processing

3.5 Are there additional safeguards that could be put in place?

Data retention limitations specific to measurement data
Technical and organizational measures to protect measurement data
Aggregation where possible for reporting purposes
Regular review of necessity and proportionality
Staff training on data protection requirements for measurement

Section 4: Outcome and Implementation

4.1 Outcome of the Balancing Test

Based on the assessment above, the legitimate interests in measuring content performance outweigh the potential impact on individuals' privacy for the following reasons:

The processing is necessary for a legitimate business purpose
The data processed is generally non-sensitive
The impact on individuals is limited and potentially beneficial
Appropriate safeguards can be implemented
The processing is in line with reasonable user expectations
The benefits of improved content experiences are significant

4.2 Implementation Requirements

To ensure compliance when relying on legitimate interest for Purpose 8:

Provide clear and accessible privacy information about measurement practices
Implement data minimization principles
Establish appropriate retention periods for measurement data
Ensure security measures are in place to protect data
Regularly review measurement practices and technologies
Document all processing activities related to measurement
Train staff on data protection requirements
Consider additional consent where local laws may require it

4.3 Ongoing Compliance

This LIA will be reviewed at least annually
Changes to measurement technologies or methodologies will trigger a review
Regulatory developments will be monitored for impact on this assessment
User feedback and complaints will be considered in ongoing evaluation
Data protection impact assessments will be conducted for high-risk measurement activities

Conclusion

Based on this assessment, legitimate interest can be an appropriate legal basis for Purpose 8 (Measure content performance) under the IAB TCF v2.2, provided the implementation requirements are met and ongoing compliance is maintained.