SoundStack

Legitimate Interest Assessment for IAB TCF V2.2 Purpose 8

Purpose Description: Measure Content Performance

This Legitimate Interest Assessment (LIA) evaluates the processing of personal data for Purpose 8 under the IAB Europe Transparency and Consent Framework v2.2: "Measure content performance - The collection of information, and combination with previously collected information, to measure, understand, and report on your use of the service, and the performance of content you may see or interact with.

This does not include:

• Personalizing content under Purpose 2;

• Personalizing ads under Purpose 4;

• Storing and/or accessing information on a device which is under Special Purpose 1

Section 1: Purpose Test

1.1 Identify the legitimate interest

The legitimate interest being pursued is the measurement, understanding, and reporting on content performance and user engagement, including:

• Measuring the duration of users’ interactions with content

• Measuring where (approximately) users interact with content

• Measuring how users interact with content

• Measuring content viewability and engagement metrics

• Reporting on content metrics using aggregated or non-aggregated data

• Analyzing listening patterns to uncover potentially fraudulent activity

1.2 Why is the processing necessary for this purpose?

The processing is necessary because:

• Content effectiveness measurement requires collecting data on user interactions

• Understanding which content performs well helps publishers improve the user experience

• Content optimization requires linking user behavior to specific content items

• Publishers need objective performance metrics to evaluate content strategy

• Accurate measurement helps create more relevant and engaging content for users

1.3 Is the interest legitimate?

Yes, the interest is legitimate for the following reasons:

• Economic interest in understanding content effectiveness

• Business need to measure content performance and engagement

• Industry standard practice for digital publishing

• Recognized by regulatory authorities as a legitimate business activity

• Supports the sustainability of digital content creation and distribution

• Supports measures to identify and mitigate fraud in the audio ecosystem

Section 2: Necessity Test

2.1 Is the processing necessary and proportionate?

• Only data directly relevant to measuring content performance is processed

• Processing is limited to data necessary for accurate measurement

• Alternative methods without personal data processing would provide insufficient insights

• The scope of data collection is proportionate to the measurement needs

• Data minimization principles are applied where possible

2.2 Can the same result be achieved in a less intrusive way?

• Anonymous measurement provides insufficient accuracy for publishers

• Anonymous measurement is insufficient to prevent fraud

• Contextual-only measurement would significantly impair the ability to understand user engagement

Section 3: Balancing Test

3.1 What is the nature of the relationship with the individual?

• Individuals are consumers of content operated by publishers who are business customers of SoundStack

• Users benefit from improved content quality through measurement and optimization

• Users typically expect some form of measurement as part of content delivery

• The relationship is built around content consumption and engagement

3.2 What type of data is being processed?

• Time spent on content

• Device used to access content

• Approximate location from which content is accessed

• Non-sensitive personal data related to content consumption

• Typically does not include special category data

3.3 Would people expect this processing to take place?

• Most users understand that content effectiveness is measured

• Industry transparency efforts have increased awareness

• The TCF framework itself provides notice about this purpose

• Content measurement is a widely established practice in digital publishing

• Most privacy notices explicitly mention measurement as a data use case

3.4 What is the possible impact on individuals?

• Minimal direct impact on user experience

• Potential for improved content relevance and quality

• Limited profiling compared to personalization purposes

• Generally no automated decision making that affects users

• Potential privacy impact from data collection and processing

3.5 Are there additional safeguards that could be put in place?

• Data retention limitations specific to measurement data

• Technical and organizational measures to protect measurement data

• Aggregation where possible for reporting purposes

• Clear opt-out mechanisms through the TCF interface

• Regular review of necessity and proportionality

• Staff training on data protection requirements for measurement

Section 4: Outcome and Implementation

4.1 Outcome of the Balancing Test

Based on the assessment above, the legitimate interests in measuring content performance outweigh the potential impact on individuals' privacy for the following reasons:

• The processing is necessary for a legitimate business purpose

• The data processed is generally non-sensitive

• The impact on individuals is limited and potentially beneficial

• Appropriate safeguards can be implemented

• The processing is in line with reasonable user expectations

• The benefits of improved content experiences are significant

4.2 Implementation Requirements

To ensure compliance when relying on legitimate interest for Purpose 8:

• Provide clear and accessible privacy information about measurement practices

• Implement data minimization principles

• Establish appropriate retention periods for measurement data

• Ensure security measures are in place to protect data

• Honor opt-out requests received through the TCF

• Regularly review measurement practices and technologies

• Document all processing activities related to measurement

• Train staff on data protection requirements

• Consider additional consent where local laws may require it

4.3 Ongoing Compliance

• This LIA should be reviewed at least annually

• Changes to measurement technologies or methodologies should trigger a review

• Regulatory developments should be monitored for impact on this assessment

• User feedback and complaints should be considered in ongoing evaluation

• Data protection impact assessments should be conducted for high-risk measurement activities

Conclusion

Based on this assessment, legitimate interest can be an appropriate legal basis for Purpose 8 (Measure content performance) under the IAB TCF v2.2, provided the implementation requirements are met and ongoing compliance is maintained.