Legal, privacy & security: questions and answers
Counsel, the DPO, or the security reviewer who signs off before anything goes live. 9 questions, grouped by stage.
Evaluate
How does Genuin handle viewing history under VPPA and similar laws?
Viewing history and identity are kept in two channels and joined only under your agreement and the viewer's consent state; identified viewing history is never shared with partners or buyers and never used to serve another customer's network.
Read: Privacy and VPPA: the two-channel data flow · Unified identity: auto login, SSO, and the ID graph
What personal data does Genuin receive, and from where?
By default only an anonymous session. With auto login, your user ID and the claims you choose. Under a commerce or retail agreement, hashed identifiers you supply for the ID graph, matched inside Genuin's identity service; raw identifiers never leave it.
Read: Auto login and token exchange · Unified identity: auto login, SSO, and the ID graph · Audience segments: onsite, offsite, and offline signals
Where is data stored and which attestations exist?
US by default; EU and other regions on Enterprise agreements. Security overview, subprocessor list, data processing addendum, and current attestations are under Settings → Trust and attached to Enterprise agreements.
Read: Security, data residency, and compliance · Choose your monetization agreement
Set up
How is consent captured and honored?
The SDK reads your CMP string (GDPR, US privacy, GPP) or a consent flag you set; consent is honored per viewer and per purpose for personalization, segments, and attribution; a privacy notice link is required in the player before go-live.
Read: Web SDK: install and configure · Privacy and VPPA: the two-channel data flow · Distribute your feeds across 7K+ apps and sites
What do the agreements cover and can we redline them?
Click-through terms for Free and Self-serve; Enterprise and commerce schedules cover rates, service levels, data-use terms, attribution windows, and margin reporting and are drafted by your CSM for your signatory, so redlines happen there.
Read: Choose your monetization agreement · Sign your agreement and authorize sellers · Plans, billing, and invoices
What security controls can we enforce on our side?
Role-scoped access, two-factor enforcement, SSO for BCC on Enterprise, per-environment API keys with rotation, domain and app allow-lists, signed webhooks, and an exportable audit log.
Read: Security, data residency, and compliance · Invite your team and assign roles · REST API: authentication and keys
Launch
How are paid partnerships disclosed?
Paid Partner Posts and Takeovers carry a label that cannot be removed; the creative format requires disclosure fields; creators disclose material connections on their posts.
Read: Paid Partner Posts and Paid Partner Takeovers · Content policies and community guidelines · AdCP: make your inventory discoverable to AI buyer agents
Who owns the content and the data?
You own your brand, content, audience relationship, and data; partner content stays the partner's and runs under the permissions you grant; creators keep rights to their posts and consent to specific uses such as offsite creative.
Read: Content policies and community guidelines · Accept partner content into your ecosystem · Offsite: generate IAB-standard tags for your media plan
Grow
What can partners and buyers see about our audience?
Segment sizes and names, never members or identifiers; cohort membership can be shared with partners only if you enable it; brand safety profiles are visible by design.
Read: Audience segments: onsite, offsite, and offline signals · Privacy and VPPA: the two-channel data flow · Set moderation, roles, and brand safety
