IAB Europe has opened a "specific review" of ad tech vendor Volasim's place on its industry vendor registry, a spokesperson told Rapporteur today, after the European policy outlet reported that the company was still listed 13 days after Citizen Lab researchers set out possible links between it and Discover-Tech, the Israeli ad firm they accuse of delivering mercenary spyware through targeted ads.

In Short

IAB Europe, the trade group that runs the list of ad companies allowed to plug into the consent pop-ups shown on many European websites, kept a company called Volasim on that list after researchers pointed to possible links between it and a firm accused of using ads to deliver spyware. Being on the list lets a company receive people's consent choices and take part in ad buying across a large share of sites and apps, so who gets on it matters to anyone who buys or sells ads in Europe. Volasim denies any role in spyware and the researchers found no conclusive proof it knowingly took part, but IAB Europe has now started a review of the listing without saying when it will finish.

One update, two decisions

The exclusive, written by Claudie Moreau and published by Rapporteur at 04:00 on October 28, 2026, before an update at 16:38 that added IAB Europe's comment, turns on a single change to the Global Vendor List. According to Rapporteur, the IAB Europe update that removed Discover-Tech from the list on October 8 added Volasim to it on the same day. IAB Europe's archive shows that version 180 of the list was published at 16:00 UTC on October 8, 2026.

Discover-Tech had held vendor ID 778 on the list since July 2, 2020, as PPC Land reported on October 18. The removal therefore came a full week before the Citizen Lab, the digital rights and cybersecurity research group at the University of Toronto, published its report on October 15. IAB Europe was among 13 companies the researchers had contacted for comment before publication.

The same courtesy did not extend to Volasim. According to Rapporteur, IAB Europe "wasn't made aware of the alleged links between Volasim and Discover-Tech prior to Citizen Lab's report becoming public." What happened afterwards is the core of the story. "But following publication, and at the time of writing, Volasim remains on the GVL," Rapporteur wrote. IAB Europe has since published two further weekly versions of the list, version 181 on October 15 and version 182 on October 22.

What the Citizen Lab found

The underlying report, "Exposing AdFection," found that at least 45 devices at Al Jazeera had been targeted with mercenary spyware via ads run through Discover-Tech, according to Rapporteur. It also found that Discover-Tech ads had been shown on devices using EU institution and NATO networks. Rapporteur also notes a limit on that finding: the appearance of an ad "did not, however, establish that a user had been targeted or infected with spyware."

After the findings, both Google and IAB Europe removed Discover-Tech from their lists of approved ad vendors, according to Rapporteur, and Google also suspended the company's access to its ad exchange platform. PPC Land's analysis of the case on October 19 described how the technique, which the researchers call AdFection, sent code only to devices on a target list while scanners received empty responses - a form of malvertising that requires no click.

Where Volasim fits

Rapporteur refers to "multiple links" between Discover-Tech and Volasim highlighted in the report, without listing them. The report's own account, summarised in PPC Land's earlier coverage, identifies Volasim Ltd as the Cypriot developer of the MyIPInfo and Akedo apps. Those two names dominate the advertiser data the researchers pulled from Discover-Tech's publicly exposed bidding database.

Between March and June 2026, according to the report, Discover-Tech's MyDSP platform bid on 3,770,286,576 impressions. The database listed only three advertisers. Ads under the Discover-Tech name promoting akedo.gg accounted for 37.31% of bids, and ads under the MyIpInfo name for 12.65%. Together, by PPC Land's calculation, that is 49.96% of all recorded bids - roughly half of the platform's bidding activity over four months tied to products the report connects to Volasim.

Volasim rejects any connection to spyware. Per Citizen Lab, Rapporteur reported, Volasim denied involvement in any spyware-related activities, telling the researchers that it has "never commissioned, authorised, participated in, or knowingly facilitated any such activity." The company attributed perceived links to Discover-Tech to ordinary ad activities. The Citizen Lab's report states that it found no conclusive evidence Volasim had knowingly participated in the delivery of spyware attacks.

Rapporteur contacted both IAB Europe and Volasim for comment. The article, as updated at 16:38, carries a response from IAB Europe only.

IAB Europe's position

The spokesperson's statement draws a clear boundary around what the association checks. "IAB Europe is not mandated to carry out broad ex ante vetting of organisations wishing to conduct business in the digital advertising ecosystem," the spokesperson told Rapporteur. "It takes reasonable steps to vet and approve vendor applications to participate in the TCF, not vendors' ownership structure and historical ties."

The second part of the statement shows the association does examine such ties once concerns surface. According to Rapporteur, the spokesperson said "separate findings by IAB Europe of likely ties between Volasim and Discover-Tech" have triggered a "specific review" of the listing. The spokesperson could not say more "at this stage." No timeline was given.

Two details stand out. First, IAB Europe's own wording - "likely ties" - goes further than the "possible" link in Rapporteur's headline and further than the Citizen Lab's statement that it lacked conclusive evidence of knowing participation. Second, the description of vetting differs from the one the Citizen Lab quoted from IAB Europe's own framework materials. As PPC Land reported on October 18, the report cites IAB Europe's description of its approval process as covering the identity of the party or parties controlling a vendor. Identifying who controls an applicant at registration is a narrower exercise than tracing ownership structures and historical ties, so the two statements are not necessarily in conflict. They do, however, leave open how deep the identity check goes.

"An absolute lack of care"

Wolfie Christl, described by Rapporteur as a senior researcher at Citizen Lab and one of the AdFection report's authors, was blunt about the delay. "This shows an absolute lack of care and responsibility," he told Rapporteur.

His criticism extends beyond Volasim. Citizen Lab's report argues that Discover-Tech's listing on the industry registry helped the company participate in the ad ecosystem and reach users' devices, criticising IAB Europe for failing to weed it out, according to Rapporteur. "IAB Europe is unfit to serve as an enabler and gatekeeper of digital advertising in Europe," Christl said.

He also described the ad tech ecosystem as a "systemic security threat" and urged cybersecurity agencies, regulators and lawmakers to "investigate and fix the systemic risks that enable malicious ad targeting."

What a listing does

The Transparency and Consent Framework (TCF) is IAB Europe's standard for asking web users about ad targeting and passing their answers along the supply chain. According to Rapporteur, the framework pulls from the GVL vendor database and, while voluntary, is widely used across the ad tech ecosystem. Publishers and ad targeting firms use it to collect and manage users' preferences for sharing, or not sharing, personal data with ad companies. The answers travel as a TC String, which vendors read to check whether they may process a given user's data.

Rapporteur adds an interpretive point: IAB Europe presents the TCF as a compliance tool for EU privacy laws, including the GDPR, "implying listed vendors are legitimate and trustworthy."

The mechanics of getting listed are mostly self-declared. Vendors register, receive a permanent numeric ID, and declare their own purposes, retention periods and legal bases, according to PPC Land's explainer on the list; IAB Europe checks only a sample of those declarations, and removal is its main sanction. The list carried 953 registered vendors at the end of 2025.

IAB Europe does enforce rules on listed companies, and that enforcement has grown. In 2025 the association opened 587 vendor enforcement procedures, up 118.2% from 269, and imposed 41 temporary suspensions, up from 23, according to its 2025 compliance report. The checks behind those numbers look at compliance forms, device storage disclosures, privacy policy links and whether cookies are set before consent. The vendor compliance programme launched in August 2021 audits how vendors' technology behaves on publisher sites. None of these mechanisms, as described, examines who owns a vendor or what other companies it is connected to - the gap IAB Europe's spokesperson acknowledged.

A framework with a regulatory history

This is not the first time the TCF's design has drawn scrutiny from authorities. Back in 2022, the Belgian Data Protection Authority found multiple GDPR infringements in how IAB Europe operated the framework and fined it €250,000, according to Rapporteur. IAB Europe appealed. Rapporteur reports that the DPA's decision was later annulled on procedural grounds, though the fine and some liability were upheld.

PPC Land covered the outcome in May 2025. In a judgment announced on May 14, 2025, the Belgian Market Court kept the €250,000 fine and limited IAB Europe's joint-controller role to the processing of TC Strings within the framework, rather than the ad auctions that follow. That ruling defined responsibility for consent signals. It said nothing about the security background of the companies receiving them.

Christl's call for regulators to step in therefore lands on a framework whose legal obligations have been narrowed by a court, and whose operator says it has no mandate for broad vetting. Whether any authority sees the vendor list as within its remit is a separate question, and Rapporteur's article does not indicate that any regulator has opened an inquiry.

Why this matters for advertising

For publishers, the GVL is more than a directory. Consent management platforms draw on it to build the vendor lists shown in consent banners, and a user's "Agree" can extend to every vendor on the publisher's list. The Citizen Lab report argued that, through Discover-Tech's six-year listing, hundreds of millions of Europeans were shown consent requests that could be read as authorising Discover-Tech to process their data. A listed vendor with unresolved questions about its connections raises the same issue on a smaller scale.

For buyers and ad tech companies, vendor lists have long served as a shorthand for legitimacy. Discover-Tech was on IAB Europe's list and on several of Google's vendor lists for years before the Citizen Lab's findings. Volasim's position is different. When PPC Land checked Google's downloadable list of ads personalization providers on October 18, Volasim was not among its 1,687 entries, which leaves the GVL as the industry registry where its listing has drawn attention.

The case also adds to a run of reporting on how advertising data and delivery systems can be repurposed. In May 2026, PPC Land covered two Israeli firms selling tools that could identify Starlink users from advertising data. In January 2025, EPIC and the Irish Council for Civil Liberties filed an FTC complaint alleging that Google's real-time bidding system exposed Americans' data to foreign adversaries. Those cases concerned data flowing out of the auction. AdFection concerned code flowing in. Christl's "systemic security threat" framing draws on both.

Who, then, checks ownership? IAB Europe says it is not mandated to do so. Google's list of certified external vendors, according to the Citizen Lab, requires a business review whose nature is not specified. If neither registry examines ownership and corporate ties as a matter of course, the burden falls on individual DSPs, exchanges and publishers - or on regulators, which is where Christl wants it to go.

What is not yet known

IAB Europe has not said what its "separate findings" consist of, when the review began, or when it will conclude. Rapporteur's article does not detail the specific links between Volasim and Discover-Tech that the Citizen Lab raised, and it carries no response from Volasim to Rapporteur's request for comment. Whether Volasim will be removed, suspended or kept on the list after the review is open.

Timeline

Summary

Who: IAB Europe, which operates the Transparency and Consent Framework and its Global Vendor List; Volasim, an ad tech vendor the Citizen Lab report identifies as the Cypriot developer of the MyIPInfo and Akedo apps; Discover-Tech, the Israeli ad company the Citizen Lab accuses of delivering spyware through ads; Citizen Lab senior researcher Wolfie Christl; and Rapporteur, which reported the story.

What: According to Rapporteur, the IAB Europe update that removed Discover-Tech from the Global Vendor List on October 8 added Volasim on the same day, and Volasim remained listed after the Citizen Lab raised possible links between the two companies. Volasim denies involvement in spyware, and the Citizen Lab found no conclusive evidence of knowing participation. An IAB Europe spokesperson said the association does not vet ownership structures or historical ties, but that its own findings of likely ties have triggered a specific review.

When: Rapporteur published the story today, October 28, 2026, and updated it at 16:38 with IAB Europe's comment. The Citizen Lab report came out on October 15, 2026, and the vendor list change took effect on October 8, 2026.

Where: Europe, where the Global Vendor List underpins consent requests on websites and apps that use the TCF, and where the Belgian data protection authority and courts have already examined how the framework operates. Discover-Tech is registered in Israel; the report links Volasim to Cyprus.

Why: A listing on the Global Vendor List lets a company receive consent signals and take part in ad delivery across a large part of the European ad market. The case tests whether an industry registry that checks consent handling, but not ownership ties, can act as a gatekeeper, and whether regulators will step in, as Christl urged.