Compliance for Audiences

Use this page before you send an audience to an advertising platform. It describes product behavior and the terms you accept in the product. It is not legal advice; your own counsel decides whether a particular audience may be shared.

---

Three things to know

Advertising platforms are not HIPAA business associates. Meta, Google, Vibe, and MNTN do not sign business associate agreements, and their terms prohibit uploading protected health information or consumer health data.

The Export Name travels with the audience. It is displayed in the platform's interface, so it must not describe a condition, treatment, or medication. Meta and Google both prohibit audience names that reflect or imply health information. See Export names.

Consent is yours to apply. An audience of "viewed a page in the last 30 days" matches everyone who did, whatever they told your banner, and a sync sends exactly the audience you defined. If consent bears on who may be shared, add it as a condition.

---

The data-sharing acknowledgement

Before an audience can sync, someone on your account accepts data-sharing terms covering the points above and confirms they have the authority and a lawful basis to share the audience. Who accepted, and when, is recorded on the audience and shown in the Sync to Destinations card.

Removing the last destination from an audience clears the acknowledgement, so turning a sync back on later means accepting the terms again.

---

Consent

Two conditions cover the common cases, both in Visitor Properties:

• Opt-out posture: Rejected Consent Categories does not contain advertising. Excludes recorded rejections.
• Opt-in posture: Accepted Consent Categories contains advertising. Matches only visitors who actively accepted, which is a smaller group.

Because the condition is part of the audience, the preview counts it. What you see is what the sync sends.

---

Naming

Put the description in Name and press Generate for the Export Name. An audience named Post-Discharge Follow-Up, No Appointment Booked internally with an Export Name of copper_lantern_cove gives you both: your team knows what it is, and the platform learns nothing.

Rewording a descriptive name is not the fix. A slightly less obvious description is the same disclosure.

---

What leaves Ours Privacy

On a sync: the Export Name and the identifiers you enabled for that destination. Advertising platforms receive hashed identifiers. Mailchimp and Braze match on the literal value, so they receive plain email addresses (and, for Braze, phone numbers). Nothing else goes: not your conditions, your internal name, or any other visitor attribute.

On a CSV export: what you chose. The all-fields format contains raw values and is for internal use. The Google and Meta formats are hashed to each platform's specification. You control where the file goes, which makes a downloaded CSV the higher-risk artifact of the two.

---

For a compliance review

• The acknowledgement records who authorized sharing the audience.
• The audience definition records who was included. Keeping the internal name descriptive is what makes that legible later.
• For wider activity across your account, see Audit Log, Compliance Report, and Consent Analytics.

---

Practices worth adopting

• Descriptive internal name, meaningless Export Name, every time.
• Put consent in the audience so the preview counts it.
• Decide who may accept the terms. Selecting destinations and accepting the terms are governed by permissions. Ask your account administrator.
• Review synced audiences on a schedule. A sync runs until someone stops it.
• Re-download a CSV rather than keep a copy. A file on a laptop is outside every control the product has.

---

Next Steps

• Export names for setting the platform-facing name.
• Syncing to destinations for the sync setup.
• Cookie Consent for collecting the consent an audience can then require.

Need help? Contact support@oursprivacy.com.