Xandr

Overview

Xandr, now part of Microsoft's advertising ecosystem, is a programmatic advertising platform that powers the buying and selling of digital display and video advertising through real-time bidding (RTB) auctions. Its scripts are among the most data-intensive third-party embeds a website can load — they participate in millisecond-level ad auctions, sync cookies across advertising networks, and transmit detailed visitor behavioral data to Microsoft's advertising marketplace.

For website operators, Xandr scripts represent the full spectrum of programmatic advertising infrastructure. They are not simply ad-serving tags — they are active participants in a global data marketplace where visitor information is shared with potentially hundreds of demand-side platforms, data management platforms, and advertisers in real time during each ad auction.

What This Script Does

Xandr scripts perform comprehensive advertising and data collection functions:

• Real-time bidding participation: Scripts initiate and manage RTB auctions for ad placements on the page. For each auction, information about the visitor (browser fingerprint, cookie identifiers, browsing context, geographic data) is transmitted to multiple demand-side platforms that evaluate whether to bid on the impression.
• Cookie placement and syncing: Xandr sets third-party cookies to assign persistent identifiers to visitors. These identifiers are synced with other advertising platforms through cookie-syncing pixels, enabling cross-site tracking and audience matching across the advertising ecosystem.
• Audience segment matching: Scripts evaluate visitors against pre-built audience segments (based on demographics, interests, purchase intent, browsing history) to determine which advertising campaigns are eligible to target them.
• Behavioral data collection: Page URLs, referrer data, content categories, and on-page engagement signals are collected and associated with the visitor's advertising identifier to build and refine behavioral profiles over time.
• Conversion tracking: Post-impression and post-click conversion pixels track whether visitors who saw or clicked ads subsequently completed desired actions (purchases, sign-ups, form submissions) on the advertiser's site.
• Ad rendering: Scripts load and display the winning creative from the auction — display banners, video ads, or native ad units — and monitor viewability, completion rates, and interaction events.
• Data transmission to Microsoft marketplace: All collected signals feed into Microsoft's broader advertising data infrastructure, where they may be combined with data from other Microsoft properties and partners.

The data sharing involved in programmatic advertising is among the most extensive of any third-party script category.

Consent & Compliance

Xandr scripts trigger some of the most significant consent requirements of any third-party vendor. Under GDPR, the real-time bidding process itself has been subject to regulatory scrutiny because it involves sharing personal data (visitor identifiers, behavioral data, location) with numerous third parties during each auction. Several European data protection authorities have found aspects of RTB to be non-compliant with GDPR principles.

The cookie syncing, cross-site tracking, and behavioral profiling all require explicit, informed consent under both GDPR and the ePrivacy Directive. Under CCPA/CPRA, Xandr's data collection constitutes both "sale" and "sharing" of personal information, requiring prominent opt-out mechanisms and honoring Global Privacy Control signals.

Xandr participates in IAB's Transparency and Consent Framework (TCF), but website operators bear ultimate responsibility for ensuring valid consent is obtained before Xandr scripts load. The scripts must be categorized under "marketing" or "advertising" in your consent management platform and must not fire until explicit consent is granted.

Should You Block This Without Consent?

Xandr scripts exist entirely for programmatic advertising purposes — real-time bidding, behavioral profiling, cross-site tracking, and ad targeting. They provide no functionality that serves the website visitor. The data sharing involved is extensive, involving transmission of personal data to numerous third parties during each ad auction. Blocking without consent is not only appropriate but is effectively required by GDPR and similar frameworks.

Yes.