IAB Europe Keeps Volasim on Global Vendor List
The trade association retains the vendor despite research linking ad-tech firms to mercenary spyware targeting Al Jazeera.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Should industry groups be held responsible for the security practices of the companies they certify?
IAB Europe added the firm Volasim to its Global Vendor List on 8 October 2026. This registry supports the Transparency and Consent Framework used by publishers to manage advertising privacy preferences across Europe.
Why it matters
The inclusion of Volasim highlights ongoing oversight challenges within the digital advertising ecosystem after Citizen Lab researchers linked similar vendors to spyware incidents.
IAB Europe manages the Global Vendor List, a database underpinning the Transparency and Consent Framework. This system tracks user privacy preferences, though the mechanism for vetting vendors remains distinct from the 250,000 euro fine levied by the Belgian Data Protection Authority in 2022.
The players
IAB Europe
An industry association that manages the Transparency and Consent Framework for digital advertising in Europe.
Citizen Lab
A research laboratory based at the University of Toronto that identifies and documents mercenary spyware and digital surveillance.
Volasim
A technology firm currently included on the IAB Europe Global Vendor List that denies involvement in spyware operations.
Belgian Data Protection Authority
The national regulatory body responsible for enforcing data privacy standards and oversight of advertising frameworks.
The details
The Transparency and Consent Framework acts as a standardized protocol allowing publishers to signal user consent for data collection to ad-tech partners. Citizen Lab, a research lab at the University of Toronto that investigates state-sponsored surveillance, identified Discover-Tech ads on secure institutional networks before IAB Europe and Google removed that firm. While Volasim remains on the list, the organization explicitly denies any involvement in spyware activities.
Timeline
2022: Belgian Data Protection Authority issued a 250,000 euro fine against IAB Europe.
8 October 2026: IAB Europe officially added Volasim to its Global Vendor List.
15 October 2026: Citizen Lab released a technical report regarding mercenary spyware.
28 October 2026: Volasim continues to appear on the active Global Vendor List.
The Tech Race
This development follows previous security lapses involving ad-tech vendors like Discover-Tech that compromised secure networks. It underscores the broader industry race to implement effective vetting in ad-tech supply chains.
Users browsing European sites will continue to interact with consent banners governed by the Transparency and Consent Framework. The current vendor registry remains live, meaning firms on the list still receive signal data from users navigating privacy settings.
The takeaway
IAB Europe faces pressure to reconcile its open vendor registry with the security risks identified by research groups. Watch for updates to the Global Vendor List criteria following the recent Citizen Lab report.
Further reading
Explore deeper analysis on supply chain security in our Cybersecurity section.
Source note: This article includes information reported by Euractiv DE.
Live Poll
Should industry groups be held responsible for the security practices of the companies they certify?
