On May 20th, the Interactive Advertising Bureau (IAB) released an updated, modular legal framework, built with industry input, to modernize how digital advertising agreements are structured, negotiated, and executed. The framework includes General Terms, Definitions, Order Specific Terms, and transaction type addenda, including the newly released Direct Buy Addendum. The announcement, along with the templates can be found HERE.
The IAB Diligence Platform, powered by SafeGuard Privacy, can play an important role in helping parties meet the diligence obligations contained in the framework.
Why the New Framework Matters
For years, the digital advertising ecosystem has relied heavily on customized agreements. Bespoke agreements can address specific business needs but they are also inefficient, creating friction, inconsistency and increased cost. Agencies, marketers, publishers and technology providers often spend substantial time negotiating similar provisions across multiple agreements and reconciling mismatched clauses.
The IAB modular agreement structure addresses these challenges through a modular structure consisting of:
- Evergreen General Terms
- Shared Definitions
- Transaction Type Specific Addenda
- Order Specific Terms.
This approach creates a common contractual foundation while preserving flexibility for different transaction types and specific contractual terms.
Understanding the Framework’s Diligence Obligations
The General terms include two-way obligations when parties share personal data. Section 16(b) requires parties to perform commercially reasonable due diligence on:
- Parties that receive personal data; and
- Parties from whom personal data is received.
In order to facilitate commercially reasonable due diligence and to help ensure that recipients of data are using data in accordance with usage restrictions and applicable law, Section 13(b) requires that a party that receives personal data inform the discloser of all 3rd parties with whom the recipient has further shared the personal data, along with agreed usage limitations between the receiver and such third parties.
Furthermore, Section 13(b) requires that the due diligence on data disclosers include a determination of whether all required consumer consents, permissions and opt-out have been obtained” and that use is consistent “with promises made to consumers.” [1]
Given the complexity and number of parties involved in the digital advertising ecosystem, manual due diligence if not completely unworkable, is extremely difficult, costly and time-consuming. Before we look at the role of the IAB Diligence Platform in reducing the complexity and time involved in implementing the diligence requirement, we will briefly examine how the Framework’s diligence requirements themselves reflect developments in privacy law.
Why Diligence is Becoming Increasingly Important
The diligence obligations reflected in the IAB Framework align with broader developments in privacy law.
Privacy laws such as the California Consumer Privacy Act have long recognized that businesses may rely on contractual protections, provided that they had no “reason to believe” that the contractual counterparty intends to commit a violation.[2] Later, in connection with the CPRA amendments, companies that properly communicated a consumer’s opt-out down the chain were relieved of liability, so long as they had no reason to believe the recipient of the opt-out signals intended to commit a violation. When the CPPA regulations were later issued, the agency made clear that a company’s diligence efforts were relevant to determining whether it had met the no reason to believe standard. [3]
Additionally, the Federal Trade Commission enforcement actions have reinforced the importance of documented diligence programs. In a 2023 complaint against Mobilewalla, Inc. the FTC alleged that the data broker failed “to take reasonable steps to verify that its suppliers have obtained consumer consent.” The FTC notes that even though Mobilewalla asked its suppliers “to complete a questionnaire” and even though they learned from these questionnaires that information is collected from “thousands of apps”, Mobilewalla “has typically only checked” a few of the Apps and “only checked these apps once, when evaluating whether to sign a contract with a new supplier.” [4] There was no ongoing, comprehensive evaluation of the many apps and consents associated with the many sources of their data. In the final decision and order Mobilewalla was required to implement a ‘Supplier Assessment Program.” This Program must be “designed to ensure that consumers have provided consent for the collection and use of Location Data” obtained by Mobile Walla from Location Data Suppliers.[5]
The FTC filed a similar complaint against Gravy Analytics, alleging that it failed to take “reasonable steps to verify that consumers” provided the requisite “informed consent”. While it, too, like Mobilewalla, used supplier questionnaires, it failed to act on or appropriately investigate “ambiguous or non-responsive answers.” The Decision and Order against Gravy Analytics included a similar requirement to implement a Supplier Assessment Program.[7]
The Direct Buy Module Addresses the Diligence Requirement
Recognizing the growing legal requirements and operational challenges associated with diligence, the Direct Buy Addendum expressly addresses the diligence requirement in Section 16(b) of the General Terms. The Direct Buy Addendum provides that:
“[i]f the Parties use the IAB Diligence Platform’s Direct Buy Module, available at https://safeguardprivacy.com/iab-diligence-platform/,[8]
This provision, pre-vetted and industry-endorsed, satisfies the framework’s diligence requirement, builds consistency, and helps remove the guesswork over what counts as “commercially reasonable” due diligence.
How the IAB Diligence Platform Helps
The IAB Diligence Platform, powered by SafeGuard Privacy, reduces the manual work and complexity of implementing a diligence program compliant with IAB’S Framework. The platform helps organizations:
- Streamline diligence workflows
- Standardize diligence across business partners
- Maintain documentation supporting diligence activities
- Demonstrate compliance efforts during audits and regulatory activities
- Scale diligence programs as partner ecosystems grow.
As privacy compliance obligations continue to evolve, maintaining a documented and repeatable diligence process is becoming increasingly important for organizations throughout the digital advertising ecosystem.
Get Started with the IAB Diligence Platform
The IAB Diligence Platform provides a practical way to implement requirements reflected in the contractual framework while reducing administrative burden and improving consistency and documentation.
To learn more and get started, contact: [email protected].
1. ↑ IAB-General-Terms-v1.1-Final_May-2026.pdf
2. ↑ Bill Text: CA AB375 | 2017-2018 | Regular Session | Chaptered | LegiScan
3. ↑7051(C) at CPPA – FINAL REGULATIONS TEXT (“Whether a business conducts due diligence of its service providers and contractors, factors into whether the business has reason to believe that a service provider or contractor is using personal information in violation of the CCPA and these regulations. For example, depending on the circumstances, a business that never enforces the terms of the contract nor exercises its rights to audit or test the service provider’s or contractor’s systems might not be able to rely on the defense that it did not have reason to believe that the service provider or contractor intends to use the personal information in violation of the CCPA and these regulations at the time the business disclosed the personal information to the service provider or contractor).
5. ↑FTC Decision and Order. (Mobilwalla)
7. ↑Gravy Analytics Decision and Order
8. ↑IAB-Direct-Buy-Addendum-to-General-Terms-and-Conditions-v1.0-Final_May-2026.pdf (Section 10(d)