When EU users enter a GDPR supported website, such users get presented with a "are you sure we can follow you?" question. If those users click "yes" than it stores a cookie with a Base64 consent string. This string includes a sequence of ones and zeroes, depends on which vendors the user chose to approve. See example screenshot.
The list of ones and zeroes is based on vendorlist.json - a list of possible vendors to approve/unapprove.
My question is - what if the traffic is being sent to an ad reseller/intermediary?
That is, the website sends traffic to the middleman, and the middleman resells this traffic to OpenX, SpotX, etc.
In this case, is it enough to include, say, OpenX in the publisher's vendorlist.com or should it include the middleman too?
i.e. website=>middleman=>SSP
For example, had this have been sellers.json than the answer would have been a big "yes" - every party that is involved should be mentioned in the supply chain. But what is the case for GDPR consent?
Looking at https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework but can't find the answer there.
