IAB Europe on November 12, 2026 published a 30-page guide to privacy-enhancing technologies in digital advertising that asks European data protection authorities to treat these techniques as evidence of GDPR compliance, to weigh them as at least a mitigating factor when setting fines, and to let them tip legitimate interest assessments in favour of advertisers. The document, titled "IAB Europe's Guide to Privacy-Enhancing Technologies (PETs) in Digital Advertising," is addressed first to regulators and policymakers rather than to the companies that buy and sell media.

It arrives at a crowded moment. Two days earlier, on November 10, the European Data Protection Board adopted the final version of its guidelines on legitimate interest. Three weeks earlier, EU governments agreed their negotiating position on the Digital Omnibus, the package that would rewrite parts of the GDPR, including the definition of personal data. The guide's recommendations speak to both.

In Short

The trade body for Europe's digital advertising industry has published a guide explaining privacy technologies such as encrypted matching, added statistical noise and sealed-off processing chips, and arguing that regulators should reward companies that use them. It matters to advertisers, publishers and ad tech firms in the EU because the guide wants these tools to count during investigations, in fines and in decisions about whether personal data can be used without asking for consent. Nothing changes until regulators or EU lawmakers act on it, and the guide's two live examples of the technology at work both trace back to Google.

What IAB Europe published

The guide appeared on IAB Europe's policy hub on November 12, 2026, in a post by Lauren Wakefield. The cover is dated November 2026, and the downloadable PDF weighs 2.64 MB. Questions and feedback go to Lucio Gagliardi, IAB Europe's Digital Advertising Product Manager, whose name also sits on the back cover.

"Written primarily for regulators and policymakers, the Guide provides a practical reference for understanding PETs and considers how these technologies could be better recognised within the EU regulatory framework," according to IAB Europe's announcement. The same page says the document is "also relevant to the digital advertising industry, encouraging a shared approach to auditability."

According to the guide's introduction, IAB Europe builds on existing work by FEDMA, the Federation of European Direct and Interactive Marketing, and the OECD "to provide a practical taxonomy grounded in how PETs function in digital advertising." The FEDMA source is a paper on the marketers' perspective on PETs, published on FEDMA's site on January 26, 2026. The OECD source is "Emerging Privacy Enhancing Technologies," Digital Economy Paper No. 351 from March 2023, which PPC Land examined in August 2025 when it reported the OECD's list of barriers: high computation costs for encrypted processing, information leakage, no agreed standards for noise, a shortage of skilled data scientists and unclear regulatory acceptance.

The guide runs through six parts: definitions, current regulatory recognition, auditability, practical use cases in measurement and audience targeting, common misconceptions, and recommendations for policy-making. The definition it adopts is broad. PETs, according to the introduction, "are a broad suite of engineering techniques that safeguard and enhance privacy and security by minimising the collection, use, retention and exposure of data, while still enabling the insights that power products and services."

Seven techniques in two families

The guide groups PETs into two themes: those that add isolation protection, and those that pseudonymise or anonymise data to make it safer to process. It then defines seven categories, "including (but not limited to)" the following.

Differential privacy makes small changes to raw data, described as "adding noise," to mask individual inputs while keeping the explanatory power of the aggregate. Noise can be added at collection (distributed) or at a central point before release (centralised).

Federated learning trains machine learning models without collecting the training data centrally. Each participating device computes an update to a shared model and sends only that update to a server, which aggregates the contributions. The guide is candid about the limits: "Some trust in the coordinating server is still required, and the strength of the privacy benefit depends on what the updates reveal," which is why the technique is often combined with differential privacy or secure multi-party computation.

Homomorphic encryption lets a third party, such as a cloud provider, compute on encrypted data without seeing it. Fully homomorphic encryption, which the guide credits to Craig Gentry in 2009, supports any computable function, but citing a 2018 survey, the guide notes that "the computational cost of FHE remains a barrier to practical use in many settings."

Pseudonymisation removes potentially identifying information while leaving a residual risk, because the data can be reconstructed with additional information kept elsewhere. Here the guide leans on case law. It cites the Court of Justice's ruling in EDPS v SRB, case C-413/23 P, which PPC Land covered when the judgment was handed down on September 4, 2025. In IAB Europe's reading, the case confirmed that "pseudonymised data held by a recipient without reasonable means to re-identify the dataset (i.e., the key remains with the controller) should not be considered personal data and therefore falls outside of the scope of the GDPR." The guide notes that the Commission's Digital Omnibus proposal reflects this relative approach in its amendment to the definition of personal data and in a mandate for an implementing act on when pseudonymised data stops being personal data, citing Articles 4 and 41a.

Anonymisation goes further: once data is truly anonymous and no one is identifiable, the GDPR no longer applies.

Secure multi-party computation lets several parties compute a function jointly over their inputs while keeping those inputs private, removing the need for a trusted third party to see the data.

Trusted execution environments are dedicated, isolated areas of a processor. "TEE assumes the operating system is corruptible and untrustworthy," according to the guide, so the operating system cannot read what happens inside the secure area.

How regulators already talk about PETs

The second chapter collects statements from authorities that already recognise PETs. Its conclusion is a complaint. "Regulators have started to acknowledge PETs in these domains, but advertising-specific recognition has been slower to materialise," according to the guide. "This regulatory delay often leaves a vacuum where technical solutions are available but lack the explicit endorsement needed to be fully integrated into the AdTech landscape."

The evidence assembled is mostly about privacy by design. The EDPB's Guidelines 4/2019 on Article 25, version 2.0, adopted on October 20, 2020, say PETs can "be employed as a measure in accordance with the DPbDD [data protection by design and by default] requirements if appropriate in a risk-based approach." The guide reproduces the board's caveat in the same breath: "PETs in themselves do not necessarily cover the obligations of Article 25. Controllers shall assess whether the measure is appropriate and effective in implementing the data protection principles and the rights of data subjects."

ENISA, the EU cybersecurity agency, described PETs in January 2022 as "building blocks towards meeting data protection principles," according to the guide, and Spain's AEPD, the OECD and the UK's Information Commissioner's Office are cited for similar positions.

A second group of citations treats PETs as security measures. France's CNIL has a statutory duty to promote PETs, in particular encryption, under Law No. 2016-1321 of October 7, 2016, for a Digital Republic. Trusted execution environments, anonymisation and federated learning are being deployed in the EU's digital identity wallets and Common European Data Spaces, and the EDPB's Guidelines 02/2025 on blockchain, version 1.1 adopted on April 8, 2025, mention PETs as a security measure. Researchers and ENISA, according to the guide, rank differential privacy, trusted execution environments, federated learning, secure multi-party computation and anonymisation as the most mature PETs, to be combined with other measures. The ENISA document cited for that assessment is dated December 2015.

None of the quoted regulatory texts concerns advertising directly. That gap is the guide's point.

Auditability: trust the maths, or check the logs

The chapter on auditability is the most technical, and the one aimed most squarely at the industry. "For PETs to maximise their utility as advanced compliance and accountability tools, the Digital Advertising industry must converge on a layered approach that combines mathematical verifiability, attestation mechanisms, auditable process logs, open-source transparency, and independent third-party certification," according to the guide.

It splits the question in two: whether a system's architecture is open to inspection, and whether a given instance of processing can be verified after the fact.

The system architecture

Three layers apply to design. An open algorithm is a publicly documented, peer-reviewed method whose implementation is cryptographically signed. "Cryptographically signing the specific implementation running in production closes the gap between what a company claims to run and what is actually deployed," the guide says. An open TEE produces verifiable cryptographic proofs that code ran exactly as specified. An open stack publishes the wider code that orchestrates and deploys a PET; the guide points to IAB Tech Lab's PETs Working Group, which it says has adopted open-source development as a core pillar.

These are not a checklist. "These three layers should be considered as independent axes of transparency, not a single pass/fail test," according to the guide, and "a company might reasonably keep its stack proprietary while still pointing to a signed algorithm and a TEE backed by a valid Attestation Certificate." What counts, in IAB Europe's framing, is whether an organisation can account for its posture at every layer when asked.

The live processing

For individual processing runs, the guide ranks mathematical proof highest. "The strongest form of auditability is one that requires no trust at all, where operational trust is established with absolute mathematical verification," it says. Multi-party computation protocols provide cryptographic proof that a joint computation ran correctly. Differential privacy offers a formal parameter, epsilon (ε), "which bounds the maximum privacy loss any individual can suffer from a query." Zero-knowledge proofs, used in private set intersection, let parties verify a match without exposing personal data.

Below that sit audit logs that record which operations ran, when, under what parameters and at whose initiative, without exposing records; the guide cites a 2024 ISACA white paper on an automotive company whose PET-based audit trails fed into its data protection impact assessments. Remote attestation in trusted execution environments adds a third check, proving that the code inside the enclave is the code that was promised. "The auditability of a TEE can be verified without running any private data through the TEE and therefore trust can be established in advance," according to the guide.

What the chapter does not contain is equally telling. It names "independent third-party certification" as one of five ingredients but identifies no certification scheme or body. It explains epsilon but proposes no value for it, and no ceiling on privacy loss that a regulator might accept.

Measurement: from pixels to proofs

The use-case chapters open with definitions familiar to marketers and perhaps new to some regulators. Measurement has three layers in the guide's account: reach and frequency, attribution or conversion measurement, and incrementality. "Without robust measurement, digital advertising shifts from a data-driven exercise to a speculative expense," it says. The examples are illustrative rather than empirical, such as a $1,000 ad spend linked to $5,000 in sales, and a campaign reported as delivering a 4x return on ad spend.

Traditional measurement, according to the guide, relies on deterministic tracking through third-party cookies or mobile ad IDs: a pixel records an ID at the ad, the same ID shows up at purchase, and the system concludes that "the person who saw the ad at 10:00 AM is the same person who bought the product at 2:00 PM." The guide says this model "is still being used today extensively due to its high level of accuracy and ease of implementation for small and large businesses alike." It frames the move away from it as voluntary. "This transition is not merely a response to regulation; it is driven by a fundamental evolution in industry thinking," the guide says.

The replacement it describes is modular: multi-party computation for co-computing results such as sales matches, trusted execution environments for isolated processing, on-device processing so raw data never leaves a phone or browser, and differential privacy as a final layer on aggregate reports. The advertiser learns what worked without learning who converted.

Google's on-device measurement

The first live example is Google's. "A leading example of the shift toward privacy-preserving measurement is Google's On-Device Measurement (ODM) for iOS app campaigns," according to the guide. A user clicks an ad for an app; the app's SDK later records an install or open; and instead of two companies swapping lists, the check runs on the user's phone.

The guide lists four PETs built into the product. Matching happens on the device. Private set intersection lets two parties find common data points without seeing each other's lists; "It's like two people comparing locked suitcases to see if they contain the same item without ever opening them," the guide explains. Identifiers are hashed into one-way codes which, in newer versions, change daily and are unique to each app, "making it impossible to track a user across different advertisers." Differential privacy adds placeholder data so that one user's actions are hidden in a group.

PPC Land reported in August 2025 on Google's expansion of on-device conversion measurement to de-identified app event data, which required Firebase iOS SDK 11.14.0 or a standalone SDK. One detail matters for a guide addressed to EU regulators. According to Google's help page for the product, the event-data version of on-device conversion measurement is inactive for all users located in the European Economic Area, the United Kingdom and Switzerland; the page lists no such exclusion for the first-party data version. The guide does not mention this. Google's help page also describes the technical approach only in general terms and does not detail the daily rotating codes or the placeholder data the guide describes.

Data matching inside a sealed chip

The second measurement example is generic. An advertiser, which knows who bought, and a publisher, which knows who saw the ad, both encrypt their lists and send them into a trusted execution environment, which the guide calls a "Digital Safe Room." Inside, the data is decrypted, matched and turned into an aggregate report, such as a campaign that produced 500 sales, after which the raw data is deleted. Attestation proves to both companies which code is running before any data is sent. K-anonymity or differential privacy guards the output: "If only one person bought a product, the TEE might refuse to report it to prevent that person from being identified."

The guide does not name a vendor here. Google, though, has run a similar architecture since 2024. PPC Land reported in September 2024 that Google made confidential matching, built on trusted execution environments with attestation, the default for Customer Match and Google Ads Data Manager connections, and in April 2025 that Google presented its confidential computing work at its Data Protection Forum, saying the technology covered Enhanced Conversions for Web and Customer Match.

Audience targeting: AI takes the place of the identifier

The targeting chapter is the most openly persuasive in the document. It defines four layers - first-party targeting, retargeting, interest-based targeting and lookalike or predictive modelling - and then argues for their economic value. "Effective targeting is what makes the modern internet economy viable. It transforms advertising from a nuisance into a helpful service for both consumers and businesses," according to the guide. A local bakery reaching people within a five-mile radius who like pastries, rather than an entire country, is its example of why "it levels the playing field for smaller spenders." Targeting also, the guide argues, lets publishers charge more and show fewer ads.

The traditional model, built on third-party cookies, mobile ad IDs and hashed emails, "remains a highly precise and effective way for businesses to reach the right audience and is still a primary method used across the industry today," according to the guide. Its stated goal for the alternative is modest in one word: "to reach a nearly equivalent level of ad relevance and business utility."

Artificial intelligence does the heavy lifting in the new model. "As PETs obscure individual identities, AI steps in with improved prediction capabilities, allowing systems to model high-performing audiences based on aggregated, privacy-safe signals rather than individual tracking," the guide says. Customer lists would be matched inside trusted execution environments, behaviour categorised on devices, and segments kept too coarse to single out a person. The result, in the guide's words: "The advertiser gets an audience that provides high chances of driving sales, while the consumer's identity remains completely anonymous."

That last claim deserves a second look. The EDPB's draft anonymisation guidelines, adopted on July 7, 2026, cite identity resolution, clean rooms and hashed identifiers as examples of data that can fall anywhere between personal and anonymous, depending on who holds it and what they can do with it, and warn that pseudonyms shared with a common ad provider can keep people identifiable from that provider's point of view. Anonymity, in the board's framework, is a conclusion reached case by case, not a property of an architecture.

PAIR, an open standard with a Google past

The targeting example is PAIR, the Publisher Advertiser Identity Reconciliation protocol. "A leading industry standard for first-party data collaboration is the PAIR (Publisher Advertiser Identity Reconciliation) protocol, which is managed as an open standard by the IAB Tech Lab," according to the guide.

The mechanics are double encryption. Advertiser and publisher each encrypt their first-party data, such as logged-in users' emails, with their own private keys, send the lists into a data clean room, and the clean room applies both keys to find overlapping users without decrypting anything. Each match gets an abstract PAIR ID, which the advertiser's buying platform uses to bid on the publisher's inventory. "Once the campaign is over, the ID cannot be used to reverse-engineer the user's identity," the guide says. The underlying technique, commutative cryptography, "allows data to be encrypted by multiple parties in any order and still matched successfully," and PAIR is designed so that advertiser and publisher can use different clean room vendors.

The guide does not mention where PAIR came from. PPC Land reported when IAB Tech Lab launched the protocol for public comment on September 26, 2024 that Google's Display & Video 360 team first developed PAIR in October 2022 and later donated it to IAB Tech Lab as an open industry standard. Version 1.0 was finalised in January 2025, and PAIR 1.1 followed on July 16, 2025 with an Open PAIR Prebid module replacing a Google-developed version. PAIR today is an IAB Tech Lab standard. Both of the guide's real-world proofs that PETs work in advertising, however, began life at one of the largest companies in the business - the kind of company the guide's own policy chapter says is best placed to fund PETs.

Five objections, answered

A chapter on "common misconceptions" responds to criticism the guide says it has heard. "Many of these misconceptions make for intriguing soundbites, but they either ignore the technical reality of PETs or are based on assumptions about the behaviour of certain actors," according to the guide. No critic is named.

The first objection holds that PETs let technology companies circumvent privacy law, a form of "privacy-washing." The guide calls this "a false dichotomy," adding that "PETs turn legal requirements into verifiable code." The second, that PETs make processing impossible to audit, is answered with the auditability chapter's arguments.

The third holds that PETs are theoretical. "The deployment of PETs in digital advertising is a relatively new development, despite the technologies being well-established in other fields," the guide concedes, before citing Google's on-device measurement and PAIR as live products. It does not discuss Google's Privacy Sandbox, the most ambitious attempt to rebuild browser advertising around privacy-preserving APIs, most of whose technologies Chrome said on October 17, 2025 it would retire after adoption failed. The retired list included the Attribution Reporting API, Protected Audience, Private Aggregation and Topics.

The fourth objection, that anonymisation is merely a data transformation, gets a short answer. The OECD lists it among the most mature PETs, and "from the perspective of data protection law, the process of anonymisation is, moreover, the ultimate PET," according to the guide, because anonymous data falls outside data protection law altogether.

The fifth concerns clean rooms. The guide says they are categorised as "High Risk" in the context of data brokerage, citing an EDPB data brokers market study, and replies that "labelling them 'High Risk' ignores the fact that they are a highly sophisticated technical solution designed to facilitate data collaboration while keeping datasets completely decentralised and mathematically obscured." The guide attributes the study to the EDPB. The board's own page, which dates it to March 4, 2026, says the study was prepared by an external expert, Ruben d'Hauwers, under its Support Pool of Experts programme at the request of the Belgian data protection authority, and that the study was not produced by the EDPB and does not necessarily reflect the board's position.

Regulators elsewhere have been sceptical too. The US Federal Trade Commission wrote in November 2024 that most clean room services are not privacy-preserving by default and that using one does not excuse an otherwise unlawful disclosure. And an IAB framework published in September 2026 found that nine of 14 common commerce data uses can often be handled without a clean room at all.

The asks: evidence, mitigation, legitimate interest

The final chapter, "Recognising PETs in Policy-Making," is where the guide stops describing and starts lobbying. It makes four sets of requests.

PETs in investigations and fines

Because PETs reduce identifiability and add measurable safeguards, the guide argues they help organisations demonstrate compliance with Article 32 (security of processing) and Article 5(2) (accountability) of the GDPR. "During investigations, the use of PETs should count as evidence of compliance with Data Protection by Design and by Default and should be treated as a mitigating factor where appropriate," according to the guide. On sanctions it goes further: "regulators should take the use of (and investment in) PETs into account as at least a mitigating factor, since failing to do so removes much of the incentive to adopt these tools in the first place."

A relative definition of personal data

The guide backs the Commission's Digital Omnibus proposal, presented on November 19, 2025, on a "clear, consistent and context-based approach to the definition of personal data." Where PETs reduce identifiability, that should be reflected in whether information counts as personal data at all. "Failing to recognise the legal significance of such safeguards risks creating a disincentive to invest in privacy-enhancing technologies, by exposing organisations to legal uncertainty precisely when they take steps to reduce privacy risks," it warns. That relative approach has opponents. The Dutch government concluded, as PPC Land reported in December 2025, that the Commission's wording goes further than the SRB judgment it claims to codify.

The smaller-player argument

The guide also makes a competition argument. Deploying PETs requires cryptographic and engineering expertise, substantial computing resources and integration work. "Large, established companies are far better placed to fund these investments than start-ups, independent publishers or smaller advertisers," it says, and legal uncertainty hits smaller organisations hardest. "Left unaddressed, this risks entrenching the position of the largest players and weakening the competition on which privacy-protective innovation depends." The proposed remedies are clear guidance on how PETs are assessed, recognition as evidence of compliance and as a mitigating factor, and support for open standards and interoperable solutions.

The most consequential request concerns the legal basis for processing. "In the GDPR, legitimate interest as a legal ground is on equal footing with consent (as well as contract), yet regulators have often sought to dismiss this legal ground or heighten the requirements for a Legitimate Interest Assessment (LIA) to be deemed acceptable in their view," according to the guide. The result, it says, is that consent remains the default for processing under the GDPR and for device access under the ePrivacy framework.

PETs, in IAB Europe's argument, should strengthen the balancing test at the heart of a legitimate interest assessment. Recognising them there would give organisations "a credible route to relying on legitimate interest, rather than defaulting to consent." The guide then makes an incentive argument: under the current approach, "consent to a non-PET approach is then just as valid and likely allows the use of more data (in raw form), without the need to invest in PETs." Why spend on cryptography, it asks in effect, if a consent click unlocks the raw data anyway? Greater standing for PETs would also, the guide argues, ease consent fatigue, because "reserving consent requests for processing that is genuinely high-impact would make those requests more meaningful and easier for users to evaluate." It points to IAB Europe's February 2026 position paper on the draft Digital Omnibus, which recommended giving PETs explicit standing.

IAB Europe is not alone in this. Alliance Digitale, the French association, asked in May 2026 for PETs to be recognised as state-of-the-art safeguards within the Omnibus's Article 41a assessment.

AI, and the EDPB's own to-do list

The guide extends its argument to AI systems inside the advertising stack. It notes that the European Data Protection Supervisor discussed machine unlearning and confidential computing in its TechSonar reports for 2024-2025 and 2025-2026, and that the EDPB's Guidelines 03/2026 on web scraping for generative AI, adopted in July 2026, point to machine unlearning and PETs as possible future tools. "This growing body of regulatory engagement suggests that PETs are being read by supervisory authorities as a powerful mechanism for further embedding data protection by design into AI systems, not merely a nice-to-have," according to the guide.

It also cites the EDPB's 2026-2027 work programme, which includes finalising the board's pseudonymisation guidelines, first published in January 2025, and new guidance on anonymisation. At an EDPB stakeholder event on December 12, 2025, participants asked for concrete examples of PETs and guidance on key management, according to the guide. "That gap is precisely what IAB Europe's guide can help fill by offering regulators a specific taxonomy grounded in how PETs function in digital advertising," it says. The closing recommendation asks for standardisation, assessment methodologies and regulatory sandboxes.

Where the guide meets the rulebook

Timing complicates several of these asks.

On legitimate interest, the EDPB answered before the guide was published. Its final Guidelines 1/2024, adopted on November 10, 2026, name privacy-enhancing technologies among the safeguards a controller may implement to limit the impact of processing. The same final text keeps the position that marketing involving tracking individuals across websites, locations, devices or services is very unlikely to pass the balancing test, a passage IAB Europe's 2024 consultation submission had argued against, and it says consent would likely be the appropriate basis for storing and reading information on users' devices. PETs, in other words, appear in the final guidelines as a mitigating measure, not as a route around consent for cross-site tracking. A case digest of 62 one-stop-shop decisions, written by Dr TJ McIntyre and published by the EDPB in March 2026, found that most controllers who relied on legitimate interest failed at the balancing stage.

On pseudonymisation, the guide describes the Commission's proposal. The Council has since moved on. Under the negotiating mandate EU ambassadors agreed on October 21, 2026, as PPC Land reported, a new Article 25a writes the rules on pseudonymisation into the regulation itself, removes the Commission's planned implementing acts, and instead asks the EDPB for an opinion on pseudonymisation and anonymisation within six months of entry into force. The guide's footnotes do not reflect that text. The European Parliament has not yet adopted its position, so trilogue negotiations have not begun.

On anonymisation, the guide refers to the EDPB's planned guidance as future work. The board adopted its draft Guidelines 02/2026 on anonymisation on July 7, 2026, with consultation running until October 30, 2026; the guide does not mention them.

And on consent fatigue, the Commission had proposed a different fix: automated, browser-level consent signals under a new Article 88b. The Council dropped that article from its June 18, 2026 compromise text. IAB Europe's guide offers PETs as an alternative route to fewer banners.

Why it matters for advertisers and publishers

The guide is a statement of where the EU's main advertising trade body wants enforcement to go, not a change in the law. Its practical stakes sit in three places. On legal basis, regulator acceptance of PETs in legitimate interest assessments could, in IAB Europe's reasoning, move some processing off consent, although the EDPB's November 10 text treats PETs as a safeguard rather than a substitute for consent in cross-site tracking, and device access stays under Article 5(3) of the ePrivacy Directive. On enforcement, a rule that PET investment mitigates fines would change how companies weigh clean rooms, enclaves and on-device processing against their cost - costs the guide itself says favour the largest firms. And on measurement, whether regulators adopt IAB Europe's taxonomy or the EDPB's case-by-case anonymity test will decide how much legal comfort clean rooms, PAIR and on-device tools actually provide.

What the guide leaves open

For a document that asks regulators to reward measurable safeguards, the guide offers few measurements. It contains no adoption data, no cost estimates and no enforcement outcomes in which PETs made a difference, and its numbers - $1,000 of spend producing $5,000 in sales, a 4x return, 500 sales, a five-mile radius - are illustrations. The differential privacy definition carries a footnote to GDMA's 2022 consumer research "Global Data Privacy, What the Consumer Really Thinks," produced with Foresight Factory, rather than to a technical source.

The two live examples share a Google origin, and one of them is partly switched off in the region whose regulators the guide addresses. Neither fact undermines the technical description, but both bear on how mature, and how available, these technologies are in European advertising today.

Timeline

Summary

Who: IAB Europe, the European association for digital marketing and advertising, with the post published by Lauren Wakefield and Lucio Gagliardi, Digital Advertising Product Manager, named as the contact. The guide is addressed to regulators and policymakers, including the EDPB and national data protection authorities, and to advertisers, publishers and ad tech companies.

What: A 30-page guide to privacy-enhancing technologies in digital advertising. It defines seven PET categories, collects regulatory statements recognising PETs, proposes a layered approach to auditability, describes Google's on-device measurement and IAB Tech Lab's PAIR protocol as live examples, rebuts five criticisms, and asks regulators to treat PETs as evidence of compliance, as at least a mitigating factor in fines, and as support for legitimate interest rather than default consent.

When: Published on November 12, 2026, two days after the EDPB adopted its final legitimate interest guidelines and three weeks after EU governments agreed their Digital Omnibus negotiating mandate on October 21, 2026.

Where: The European Union, under the GDPR, the ePrivacy framework and the pending Digital Omnibus. The guide's on-device measurement example is, according to Google's help page, inactive in its event-data version for users in the EEA, the UK and Switzerland.

Why: IAB Europe argues that advertising-specific recognition of PETs has lagged, that without regulatory credit companies have little reason to invest in them when consent unlocks raw data anyway, and that legal uncertainty favours the largest players. The guide seeks to shape how the EDPB finalises its pseudonymisation and anonymisation guidance and how EU lawmakers settle the definition of personal data in the Digital Omnibus.