Special Purpose 3

Save and Communicate Privacy Choices

PubX AI Ltd | IAB Europe TCF Vendor ID: 1485 

Version: 1.0

Date: 17 August 2026

Review schedule: Annual, or upon any material change to this processing activity 

Legal basis assessed: Article 6(1)(f) UK GDPR / EU GDPR — legitimate interests

About this document

PubX relies on legitimate interests as its lawful basis for a number of processing activities carried out in connection with its Agentic Advertising Platform. This document sets out PubX’s assessment of one specific activity — reading and retaining the IAB TC String under TCF Special Purpose 3 — using the three-part test required before relying on Article 6(1)(f):

1. Purpose test — is there a legitimate interest being pursued?
2. Necessity test — is the processing necessary for that purpose, and is there a less privacy-intrusive way to achieve it?
3. Balancing test — do PubX’s legitimate interests override the data subject’s interests, rights, and freedoms?

This document covers Special Purpose 3 specifically, for transparency to publishers and users under the IAB TCF. It does not cover PubX’s other legitimate-interest processing activities (contextual advertising signals, aggregated performance reporting, and platform improvement, among others) — a copy of PubX’s complete Legitimate Interests Assessment is available to publisher partners on written request via privacy@pubx.ai.

1. Description of processing

As a registered IAB Europe TCF vendor, PubX reads the IAB TC String generated by a Publisher’s Consent Management Platform (CMP) on each relevant bid request, to determine which TCF purposes and vendors the user has consented to (or for which another legal basis applies), any publisher-set restrictions, and applicable opt-out signals.

The TC String is retained by PubX for 90 days, for internal audit purposes and to demonstrate compliance — specifically, so PubX can show that a given request was processed on the basis the user actually signalled at the time. It is stored separately from other request-level data for performance reasons, but remains linked to it rather than isolated or anonymised.

The TC String is not passed or forwarded to SSP partners or any other third party. This processing is internal to PubX only, and is separate from PubX’s subsequent collection of additional data where consent is confirmed — that collection is governed by the relevant TCF purpose’s own consent basis, not by this assessment.

This processing is assessed under TCF Special Purpose 3 — “Save and communicate privacy choices,” introduced by IAB Europe’s TCF v2.2 Policies amendment (June 2024) following an EU court ruling that a TC String can itself constitute personal data.

2. Purpose test

The legitimate interest pursued: the ability to determine, and subsequently demonstrate, a user’s consent/legal-basis status at the time a given request was processed — both to ensure PubX only collects further data where a valid basis exists, and to maintain an internal audit record capable of showing PubX acted on the basis actually signalled, in the event of a dispute, publisher query, or regulatory enquiry.

Whose interest this serves: PubX (a necessary precondition for operating within the TCF, for making correct real-time processing decisions, and for accountability under GDPR Article 5(2)); indirectly, publishers and users, who benefit from PubX only collecting data where a valid basis existed.

Is this a genuine legitimate interest? Yes — determining and evidencing consent status is the specific processing IAB Europe introduced Special Purpose 3 to cover across the industry.

3. Necessity test

Reading the TC String is the only mechanism the TCF provides for a vendor to know a user’s consent/legal-basis status at the point of a request — there is no less intrusive way to determine this.

Retention beyond the point of processing is necessary for the stated purpose: an internal audit and compliance record is only useful if it persists long enough to be checked afterward. A real-time-only check would give PubX no way to subsequently demonstrate what basis applied to a past request. The 90-day period aligns with PubX’s standard retention period for other request-level data.

PubX does not extract or retain more from the TC String than the standardised consent/legal-basis fields needed to make this determination and evidence it later.

4. Balancing test

Data subjects affected: end users of Publisher properties.

Nature of the data: standardised consent-state metadata. It is stored separately from other request-level identifiers for performance reasons, but remains linked to them, and so is assessed here as part of the same identifiable dataset rather than as isolated, non-identifying data.

Reasonable expectations: the IAB TCF is a publicly documented, industry-wide standard, and Special Purpose 3 is shown in the standard CMP notice at the point a user gives their consent choices. A user interacting with a TCF-compliant site can reasonably expect this processing to occur as part of how their choice is determined and evidenced.

Impact on data subjects: contained — because the TC String is not forwarded to SSP partners or any other third party, the impact is limited to PubX’s own systems rather than propagating across the advertising supply chain.

Safeguards: PubX applies the following measures to this data, consistent with the technical and organisational measures it applies to personal data across its systems: encryption in transit (minimum TLS 1.2) and at rest; role-based access controls and least-privilege access; multi-factor authentication for systems processing personal data; logging and monitoring of access; regular vulnerability scanning and penetration testing; and documented incident response procedures. Data is deleted or irreversibly anonymised at the end of the 90-day retention period, unless a longer period is required by law.

Can data subjects object? Yes. Data subjects can object to this processing under Article 21 GDPR by contacting privacy@pubx.ai. Special Purposes are not individually toggle-able within the TC String by TCF design, but the underlying right to object is unaffected, and PubX will assess any objection on its individual merits.

5. Conclusion

The linkability of the retained TC String to other request-level data increases its identifiability beyond a standalone, abstract metadata record, and PubX has weighed that honestly in this assessment rather than treating the data as risk-free. Against that, the processing is necessary and proportionate to a genuine interest, is not forwarded to any third party, is protected by the technical and organisational measures described above, and is deleted or anonymised within 90 days. On balance, PubX’s legitimate interest in this processing is not overridden by its impact on data subjects. Legitimate interests is an appropriate lawful basis for this activity.

Contact: Questions or objections regarding this assessment can be directed to PubX’s privacy team at privacy@pubx.ai.

Next scheduled review: August 2027, or sooner upon material change to this processing activity.