Adoption records

IAB Tech Lab Data Deletion Request Framework

Version pinned

IAB Tech Lab Data Deletion Request Framework version 2.0, August 2026 (version 1.0 was May 2024), read from the file in the Data-Subject-Rights repository on 4 October 2026. The repository's commit could not be recorded, because GitHub API access was denied in this session; the version and date come from the file's own history. The framework's name is the Data Deletion Request Framework; "Data Subject Rights" is the repository name.

What is taken

The concepts, not the wire format: a deletion request signed by the party that holds the authority, forwarded to each recipient, and an acknowledgement signed by the recipient carrying a result. The framework uses signed JSON Web Tokens for the request and the acknowledgement and publishes verification keys at well-known locations.

Why

Purge reuses established deletion-request concepts rather than defining its own. Recipients in advertising may already implement this framework.

What is extended

A10 binds each purge instruction to the grant that ended and the pairwise subject, uses the reason grant_ended for both revocation and expiry, and records the acknowledgement as purged, not_held or legal_hold. An acknowledgement is the recipient's assertion, never proof of erasure.

What is replaced or not used

The framework's hop-by-hop forwarding and its /.well-known/iabtl/ key locations are not used; Open Personal Context delivers instructions directly to each recipient and verifies keys against the recipient's registration (A10).

Deviations

The framework is sometimes described as a "Data Subject Rights framework"; this record uses its own name.

Conformance checks

PURGE-01 and ADS-02 in the conformance manifest, with runtime evidence pending.

References to other standards and projects describe intended technical alignment only and do not imply endorsement or partnership.