DATA PROTECTION DEFINITIONS

LAST UPDATED: February 2, 2026

1. DEFINITIONS

For purposes of these Global Privacy Obligations and Digital Tech Agreement, the following terms have the following meanings:

“Ad Auditing” means counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this Agreement and other standards;
“Ad Fraud Detection” means detection of potential ad fraud with respect to ads served on one or more WBD Properties;
“AI” or “Artificial Intelligence” means and includes—unless otherwise defined in the Agreement—any form of artificial intelligence or information technology, regardless of the specific techniques or approaches employed, that exhibits the capability to perform tasks, simulate human-like cognitive abilities, or generate outputs such as content, predictions, recommendations, or decisions. This includes but is not limited to technologies and methodologies such as machine learning (supervised, unsupervised, and reinforcement learning, including deep learning and neural networks), generative AI, natural language processing, computer vision, large language models (“LLM”), logic- and knowledge-based approaches (including knowledge representation, inductive logic programming, knowledge bases, inference engines, deductive engines, reasoning, and expert systems), as well as statistical techniques. AI includes all current and future advancements, methodologies, and applications within the field of artificial intelligence, as well as any other technologies not explicitly mentioned herein that are developed or emerging within this domain;
“AI Output” means the outputted results of an AI generated from inputted prompts;
“Analytics” means analyzing WBD services or content on behalf of WBD;
“Anonymous”, “Anonymized”, “Aggregated” or “De-identified” shall have the meanings set out in applicable Data Protection Rules;
“Apply Market Research to Generate Campaign Insights” means to generate reports through panel-based and similarly derived insights or to associate measurement data or offline data with a Consumer for purposes of better understanding the impact of an ad campaign or the types of audiences served (e.g., brand awareness and offline sales lift);
“Automated Decision Making” means a decision about a Data Subject using any system, software or process (including through the use of AI) made without any human involvement or which facilitates human decision making;
"Bulk U.S. Sensitive Personal and Government-Related Data", "Country of Concern", "Covered Person", "Foreign Person" and "Government-Related Data" shall have the meanings set out in Title 28 of the Code of Federal Regulations (CFR) § 202;
“Business” shall have the meanings set out in applicable Data Protection Rules;
“Business Purpose” means, collectively, the following activities when they involve the Processing of WBD Personal Information in a manner that meets data minimization requirements and the secondary use limitations as set out in applicable Rules: (i) First Party Advertising, (ii) Frequency Capping, (iii) Negative Targeting, (iv) Measure Ad Performance, (v) Apply Market Research to Generate Campaign Insights, (vi) Ad Fraud Detection, (vii) Ad Auditing, (viii) Determine Ad Viewability, (ix) Short-Term, Transient Use and (x) First Party Advertising;
“Child” or “Children” shall have the meanings set out in applicable Data Protection Rules;
“Company”, “Partner” or “you” means the non-WBD entity identified in and who is a party to the Agreement;
“Consumer” shall have the meaning as set out under the Rules;
“Contextual Advertising” means ads that are selected and served to a user without utilizing Personal Information, and includes ads based on the context of a consumer’s current search query, visit to a website, or online application;
“Controller” means a person or entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Information;
"Country of Concern" shall have the meanings set out in 28 CFR § 202.209;
"Covered Person" shall have the meanings set out in 28 CFR § 202.211;
“Cross-Context Behavioral Advertising” and “Sharing” shall have the meanings set out in applicable Rules. This may encompass activities such as combining WBD Information with third-party Personal Information to create, categorize and utilize Consumer ad profiles; Third-Party Segment Creation; predict future Consumer actions for advertising purposes; or evaluate and respond to ad requests. Sharing shall not include activities that fall under the definition of Business Purpose;
“Customer”, “WBD”, “we”, “us” and “our” means: (i) the Warner Bros. Discovery entity identified in and who is a party to the Agreement; and (ii) any affiliate or subsidiary that controls, is controlled by or is under common control with the Warner Bros. Discovery entity named in the Agreement;
“Customer Affiliates” or “WBD Affiliates” include all entities identified here: https://www.wbdprivacy.com/policycenter/affiliates/;
"Customer Information" or “WBD Information” means all materials, content, data, information, personal information, intellectual property, inferences, and derivatives of the foregoing that are accessed, provided, or obtained from Customer or its assignees under the Agreement;
“Data Broker” shall have the meanings set out in applicable Data Protection Rules;
“Data Protection Rules” or “Rules” means (i) any federal, state, provincial, local, municipal, foreign, international, multinational or other constitution, law, statute, treaty, rule, regulation, ordinance, code, and guidance issued by regulatory authorities competent to interpret or enforce the same, relating to processing personal data, privacy, data protection (the protection of Personal Information), or cybersecurity, as may be amended from time to time, (ii) platform and developer policy requirements; (iii) Child Online Protection Laws and Health Privacy Laws; and (iv) any industry and self-regulatory frameworks relating to online advertising or privacy that are enforceable against Partner or Customer;
“Data Subject” or “Consumer” means the individual to whom Personal Information relates;
“Data Subject Request” means a request by a Data Subject for information, access, rectification, erasure, restriction, portability, objection, do-not-sell, deletion, and any other similar requests;
“DCR Environment” means a mutually agreed upon processing environment that provides secure data matching and analysis capabilities in a manner that allows Customer to control the extent to which Customer Information is accessible by Partner;
“Description of Processing” means the description of Personal Information Processed by Partner under the Agreement;
“Determine Ad Viewability” means determination of whether an ad was viewable by a Consumer on a WBD Property;
“Directly identifying information” means data that points explicitly to a specific person, like a full name, Social Security Number (SSN), driver's license, email address, phone number, or biometric data (fingerprints, retinal scans);
“EEA” means the European Economic Area;
“EEA Data Transfer” means a transfer of Personal Information: (a) that is subject to the GDPR; (b) to a recipient in a country or territory outside of the EEA; and (c) which is not subject to an adequacy decision by the EU Commission;
“EEA Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021 C(2021) 3972, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?url=CELEX:32021D0914&locale=en;
“First Party Advertising” means advertising delivered to a Consumer on a WBD Property, whether through a direct transaction or through real time bidding where the Consumer’s activities used to determine such advertising are limited to the Consumer’s activities on the WBD Properties or WBD’s interactions with the Consumer;
"Foreign Person" shall have the meanings set out in 28 CFR § 202.221;
“Frequency Capping” means limiting the number of times a Consumer sees a certain ad or ads during an advertising campaign on WBD’s Properties;
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation);
“Global Privacy Obligations” means the privacy obligations which are available at: www.wbdprivacy.com/dpa, as updated or amended by WBD from time to time;
"Government-Related Data" and shall have the meanings set out in 28 CFR § 202.222;
“Health Privacy Laws” include all sectoral, state, federal, and international privacy and data protection laws that regulate the Processing of Personal Health Data;
“Information Security Obligations” means any applicable information security obligations which are attached to or otherwise form a part of the Agreement;
“Location Information” shall have the meanings set out in applicable Data Protection Rules, and includes GPS coordinates;
“Measure Ad Performance” means (i) measure whether and how ads were delivered to, and interacted with by, Consumers; and (ii) provide reporting about ads, including their effectiveness and performance, such as Consumer interactions with such ads (e.g., view and click information, conversions, and attribution);
“Minor(s)” shall mean any individual(s) (i) under the age of eighteen, or (ii) the age of majority if greater than eighteen in a relevant jurisdiction;
“Minors’ Online Protection Laws” mean sectoral, state, federal, or international laws, rules, and regulations that restrict the Processing of Personal Information of Children, Teens, or Minors or regulate online apps or websites directed to Children, Teens or Minors, including age assurance laws, app store accountability laws, online safety laws, and other similar laws;
“Minors’ Online Protection Obligations” mean the privacy and online protection obligations available at www.wbdprivacy.com/mda;
“Minors’ Properties” means websites, apps, and online services (i) that are directed to children as either a primary or secondary audience, (ii) that are likely to be accessed by minors, and/or (iii) for which WBD or Vendor has actual knowledge are accessed by minors. Minors’ Properties include without limitation: (i) properties identified by WBD in writing (email to suffice) or through technical request and event signaling (e.g. COPPA Flags), and (ii) properties that Vendor should know are likely to be accessed by minors and/or directed to minors by reference to publicly available information or by virtue of access to nonpublic information obtained in providing the Services provided, however, WBD’s determination as to whether a website, app, or online service is directed to minors is controlling on Vendor.
“Negative Targeting” means a designation of a set of Consumers who are not to be targeted with certain ads;
“Other Data Transfer” means a transfer of Personal Information: (i) that is subject to the laws of a country which restricts the transfer of Personal Information to another country not deemed adequate to receive such Personal Information (a “Restricting Country”); and (ii) which is not an EEA Data Transfer or UK Data Transfer;
“Personal Health Data” means any information that is reasonably linkable to an individual, or a device, and is collected or processed in connection with the physical or mental health of an individual, including location or payment information that relates to an individual’s physical or mental health or any inference drawn or derived about an individual’s physical or mental health that is reasonably linkable to an individual, or a device. “Personal Health Data” includes all Regulated Health Information, Consumer Health Data, Protected Health Information, and other similar terms defined by Health Privacy Laws;
“Personal Information” means any information relating to an identified or identifiable natural person including any Directly Identifying Information, Pseudonymous Information, and any information defined as “personally identifiable information”, “personal information”, “personal data” or similar terms as such terms are defined under Data Protection Rules, limited to that Personal Information Partner Processes in connection with the Agreement;
"Precise Geolocation" means (i) any data derived from a device that is used or intended to be used to locate a consumer within a geographic area equal to or less than the area of a circle with a radius of 1,850 feet, (ii) GPS coordinates with a precision greater than two decimal places, or (iii) as otherwise defined in the Rules.
“Process” or “Processing” means any operation or set of operations performed upon Personal Information, whether or not by automatic means, including the collection, recording, organization, structuring, storage, adaption or alteration, consultation, use, disclosure by transmission, transfer, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Information;
“Processor” means a person or entity which Processes Personal Information on behalf of the Controller;
“Pseudonymous” shall have the meanings set out in applicable Data Protection Rules;
“Sale” shall have the meanings set out in applicable Rules. This may encompass activities such as collecting Personal Information from WBD Properties for categorizing and utilizing Consumer ad profiles or using Consumer behavior data to predict future Consumer actions for advertising purposes (e.g., enriching third-party ID spines or ad profiles). Sales shall not include activities that fall under the definition of Business Purpose. “Security Incident” shall mean: (i) any unauthorized acquisition, loss, access, use or misuse, loss of access to, or loss of use of Personal Information (including loss of any storage medium on which Personal Information is stored); or (ii) any breach of security leading to the accidental or unlawful destruction, loss, alteration, use or misuse, unauthorized disclosures of, or access to, Personal Information;
“Sensitive Personal Information” shall mean Personal Information revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; Personal Health Data; Minor Data; sex life or sexual orientation; the Processing of genetic data, biometric data for the purpose of uniquely identifying a Data Subject; Personal Information relating to criminal convictions and offences or related security measures; government-issued identification number; account credentials; financial account numbers including payment card numbers; precise geolocation data; contents of communications not directed to Partner or Customer; and such subsets of Personal Information that are deemed “sensitive” or require enhanced protections under applicable Data Protection Rules;
“Services” has the meaning provided in the Agreement or, if not defined by the Agreement, means the products or services rendered by Partner to us pursuant to the Agreement;
“Service Provider” shall have the meanings set out in applicable Data Protection Rules;
“Short-Term, Transient Use” means that the Personal Information is not disclosed to another third party and is not used to build a profile about a Consumer or otherwise alter an individual Consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;
“Sub-Processor” means a person or entity which Processes Personal Information on behalf of a Processor;
“Targeted Advertising” shall have the meanings set out in applicable Rules. This may encompass activities such as combining WBD Information with third-party Personal Information to create, categorize and utilize Consumer ad profiles; Third-Party Segment Creation; predict future Consumer actions for advertising purposes; or evaluate and respond to ad requests. Targeted Advertising shall not include activities that fall under the definition of Business Purpose.
“Teen” or “Teens” shall have the meanings set out in applicable Data Protection Rules or, if not defined by the applicable Data Protection Rules, means individuals between the age of a Child and the age of a Minor.
“Third Party” shall have the meanings set out in applicable Data Protection Rules;
“Third-Party Segment Creation” means Processing of Personal Information for generating and matching audience segments for the purpose of Targeted Advertising or Cross-Context Behavioral Advertising;
“Tracking Technologies” is defined broadly and means technologies such as HTTP cookies, locally shared objects, HTML5 web storage, SDKs, pixel tags, creative pixels, web beacons, browser or device fingerprinting, and all other technologies which store or access information from user web browsers, devices, hard disks, or other terminal equipment;
“Training Data” means information used to train or otherwise improve or enhance the capabilities of any AI;
"UK Data Transfer” means a transfer of Personal Information: (a) that is subject to the UK GDPR; (b) to a recipient in a country or territory outside of the UK; and (c) which is not subject to an adequacy decision by the UK’s Secretary of State;
“UK GDPR” means the GDPR as it forms part of the laws of England and Wales, Scotland and Northern Ireland by virtue of Section 3 of the European Union (Withdrawal) Act 2018;
“UK SCC Addendum” means the template addendum issued by the UK’s Information Commissioner’s Office and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18, available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf;
“WBD Affiliates” include all entities identified here: https://www.warnermediaprivacy.com/policycenter/b2c/affiliateslist/;
“WBD Information” means all materials, content, data, information, personal information and intellectual property, and inferences and derivatives of the foregoing, that are accessed, provided, or obtained from WBD, its affiliates or its assignees under the Agreement; and
“WBD Property” or “WBD Properties” means websites, apps, events or other services provided to Consumers by WBD or WBD Affiliates.

HOME