GDPR and DOOH: Why DOOH Is the Most Privacy-Friendly Ad Medium

30-second takeaway: DOOH at adyoutiser processes no personal data at the screen — no cameras, no Bluetooth tracking, no Wi-Fi sniffing. Delivery is anonymous to a location, not a person. That puts DOOH in a fundamentally different GDPR position than online ads — no cookie consent, no TCF strings, no profiling. What advertisers still need to manage: a proper data processing agreement with the platform and clean separation between DOOH reach and any downstream online conversion tracking.

The GDPR (Regulation (EU) 2016/679) has reshaped digital advertising — cookie banners, consent management, IAB TCF, Schrems II, pixel bans. Out-of-Home, especially DOOH, enters this landscape with a fundamental advantage: the medium works without personal data. This post explains why, where the limits are, and what a GDPR-compliant DOOH workflow looks like.

1. What GDPR regulates — and why most of it doesn't hit DOOH

GDPR governs the processing of personal data (Art. 4(1)). That means information relating to an identified or identifiable natural person — IP addresses, cookie IDs, device fingerprints, ad IDs. Once those are processed, you typically need a legal basis under Art. 6 — for ad cookies, usually consent.

A DOOH delivery via adyoutiser technically looks like this:

• A campaign is assigned to a location, not a person
• Screens play content on a schedule (queue engine recalculated every 5 minutes)
• No camera, no Bluetooth beacon, no Wi-Fi sniffing
• No mobile data is read from passers-by
• Reach estimates use statistical location data (footfall, daypart), not identifiers

It's comparable to a classic poster: content goes out, no one knows who saw it. The bulk of GDPR obligations at the display itself simply do not arise. No cookies, so no cookie banner. No TCF string, so no TCF question.

2. Where DOOH still touches GDPR

DOOH isn't entirely GDPR-free. Several touchpoints remain:

Advertiser ↔ platform contract. Booking requires master data (company name, billing address, VAT ID, contacts) — Art. 6(1)(b) (contract performance).

Creative upload and asset storage. Uploaded creatives may contain personal data (e.g. a CEO photo). The platform acts as processor under Art. 28; a DPA is part of the booking.

Audience measurement / third-party tools. Measurement that adds telco data, camera analytics, or cross-device attribution requires its own assessment. adyoutiser uses none of these and works only with aggregated location stats.

Post-view online conversion tracking. Some advertisers combine DOOH with geofence retargeting. That bridges anonymous DOOH visibility and identifiable mobile devices and is privacy-sensitive. adyoutiser does not offer this by default.

3. Online vs. DOOH at a glance

This is why brands in regulated sectors (pharma, banking, public sector) increasingly prefer OOH and DOOH over programmatic display.

4. What advertisers should check

More detail in our advertising tax & compliance overview.

Checklist: GDPR-compliant DOOH booking

• DPA available? Platform provides a data processing agreement (Art. 28)
• EU hosting? Data and creatives processed only in EU data centres
• No person-tracking components at the screen (camera/Bluetooth/Wi-Fi)? Confirmed in writing?
• Privacy policy of the platform public and current?
• Creatives free of unexpected personal data
• If conversion tracking is planned: separate review of the online part
• Ad labelling for regulated sectors (finance, health) ensured

Book compliantly today

adyoutiser runs without person tracking, with EU hosting and a DPA. Plan and book your campaign.

This article is information, not legal advice. Consult a tax advisor or attorney for individual cases.