InnovidXP FAQs: Privacy and Security

Last Updated: October 22, 2026 15:57

Purpose

This article answers commonly asked questions about InnovidXP privacy and security.

What information does the InnovidXP Impression Tracker collect?

Our impression tracker collects the following:

IP Address
Timestamp
User Agent
User Ref
Name of publisher
Origin
ID of publishers
ID of placement group/targeting strategy

In addition to these fields (and information that can be derived from them), we can set up macros to capture other data parameters. Please contact Innovid if you need additional macros.

What information does the InnovidXP Response Tracker collect?

You need only one InnovidXP visit tag per website, and you must implement it on all website pages to measure total visits.

The web and action tags fire on the page(s) they are placed, while obeying the required opt-in/opt-out mechanisms. Any comparison of web volumes and Google Analytics is on a like-for-like basis, as the tag is intended to interact consistently with the consent criteria.

The web manager should place web tags on the client's website. We recommend installing tags two weeks before your campaign goes live to allow time for data QA.

The visit tag can also measure visits to specific pages or sections of a website if they have the same parent URL.

The web tag code is provided via the InnovidXP platform. You can paste it directly on each page or implement it using a Tag Management System, such as Google Tag Manager.

The JavaScript-based InnovidXP response tracker collects the following information:

IP address
Unique ID for the visitor (1st-party cookie)
User Agent *
Timestamp: date and time when the session starts
URLs of the pages visited and any actions
Referrer URL (if applicable)
Device ID (if available)

* A user agent is a short piece of text that attempts to describe the software/browser (the "agent") that is making the request to a website. Web browsers include the user agent string in the requests they make to websites. The user agent may include descriptions of the Operating System and device type that the browser/agent is running on.

Learn more about the cookies placed using our web tracker.

Note: The TCF EU is designed to help all parties in the digital advertising chain ensure that they comply with the EU's General Data Protection Regulation (GDPR) and ePrivacy Directive. Our web response tracker is available in a TCF EU-compliant version. Refer to the IAB TCF EU support materials for more details.

Can website visitors "opt out" of being tracked by InnovidXP?

For opt-out, the website owner must ensure visitors can opt out of any cookies or tracking when using the website.

Note: Innovid is TCF EU compliant and respects any opt-out requests sent via a third-party cookie consent manager. The TCF EU is designed to help all parties in the digital advertising chain ensure that they comply with the EU's General Data Protection Regulation (GDPR) and ePrivacy Directive. Our web response tracker is available in a TCF EU-compliant version. Refer to the IAB TCF EU support materials for more details.

Response tracker

To let users opt out of our web response tracker, we recommend that the website owner integrate a third-party cookie consent manager that provides a consent mechanism for users to opt out of the Innovid web tracker.

Impression tracker

An opt-out tag lets users opt out of impression tracking. This tag passes Innovid the users' consent (or lack of consent), and we adjust accordingly.

Note: End users may also wish to manage their cookies more broadly through their browser or operating system settings on their computer or device. They can find instructions in their browser or operating system.

Do InnovidXP reports include personally identifiable information?

No. You can generate an export report of all attributed responses, but it does not include any identifiable information.

Note: An internal user/customer ID can be supplied to InnovidXP within the web response tag. You can then include it in an export report. However, this is a customized setting and does not happen by default.

How does consent work if Innovid is not the ad server?

If Innovid is not serving the ad impressions, advertisers and publishers must ensure that the InnovidXP impression pixel is trafficked correctly. Consent would therefore be managed by the media publisher or media viewing app, and only information for consented viewers would be sent to InnovidXP.

Note: Impression data is gathered from publishers via Innovid impression pixels. We have tested, approved, and calibrated all publishers to ensure the correct volume of impressions is sent to Innovid.

If you are experiencing any impression pixel issues, see the information in FAQs: Analyzing Data.

I have different agencies. How do I make sure they do not see each other's data?

Data groups let you restrict access to certain spot data to specific users.

InnovidXP allows the setup of data groups, and you can request a new data group by submitting a ticket here (or through your brand portal).

Using the roles and permissions function, you can give users from different agencies access to certain data groups. Users will only see data in data groups they can access.

Apple Privacy Relay

What did the Apple Privacy Relay change involve?

An improved approach to correct for external factors such as Apple iCloud Private Relay, which affects how TV-driven web responses are counted and attributed, particularly when (hashed) IP addresses are used as identifiers.

Why did Innovid make the Apple Privacy Relay change?

Apple rolled out additional privacy protections across countries, including Privacy Relay, making it harder to count web visits and accurately use IP addresses as identifiers.

What does this mean for me?

Almost all clients that use analysis to understand TV-driven impact on web visits were affected. Depending on the measurement and outcome models you use, you may have noticed changes in attribution metrics since the update. The impact is hard to quantify as it varies depending on:

Geographic location
Rollout speed of Apple's Private Relay
Particulars of individual campaigns
Mix of Safari users vs. others who visit your website

When did the Apple Privacy Relay change happen?

We began upgrading in April 2023, and the rollout continued through Q2 2023.

How do I know if my platform has the Apple Privacy Relay change?

This is applied to all platforms by default.

How does InnovidXP collect my data?

Data is collected by InnovidXP using our web and action tags that fire on the page(s) they are placed, while obeying the required opt-in/opt-out mechanisms:

Website tagging

InnovidXP provides JavaScript and image tags you can place on your website, either directly or through a tag management system. More information can be found in our Quick Tagging Guide.

Web response files

InnovidXP lets you upload web files with historical or current data if you cannot place tags. The files are generally in CSV, XLS, or XLSX format and contain individual session data or aggregated minute counts. There are instructions on creating a response file in Uploading Web/App Response Files.

App tagging

Though rarely used, we offer JavaScript tags for iOS and Android if our Integrations don't provide a solution for you. You can deploy the tags through a tag manager or directly in the app. Deploying tags directly in your app requires users to update the app to activate the change.

App integrations

We offer a wide range of app integrations that are easy to set up. More information can be found in the App Integrations article.

App response files

Innovid lets you upload app files with historical or current data if you cannot place tags or integrate with a third-party tracking system. The files are generally in CSV, XLS, or XLSX format and contain individual session data or aggregated minute counts. There are instructions on creating a response file in Uploading Web/App Response Files.

Phone and SMS files

Innovid allows you to upload phone or SMS response files. Files are generally in CSV, XLS, or XLSX format and contain individual Phone/SMS data or aggregated minute counts. There are instructions on creating a phone or SMS response file in Uploading Phone/SMS Response Files.

Do tags work with cookie permissions?

Tags are affected according to how cookies are handled on your website. For example, if cookies are only accepted when a user selects another link on the site, the tag will fire late and will not fire at all for people who visit only a single page. This will create a discrepancy when we compare volumes against Google Analytics.

Follow these guidelines:

Tags should only be set to fire after a user has accepted cookies because the tag does use and place cookies
Tags will not fire until the user accepts cookies, so ensure this happens as soon as possible after the user lands on your website