IAB Europe Retains Volasim on Global Vendor List
Despite reports linking the company to potential spyware activity, Volasim remains on the industry-standard list.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Should industry groups be held responsible for the security practices of the companies they certify?
IAB Europe added Volasim to its Global Vendor List on 8 October 2026, where the firm remains as of 28 October 2026. This decision follows a 15 October report from Citizen Lab identifying potential links between Volasim and an ad vendor associated with mercenary spyware.
Why it matters
The Global Vendor List is a critical component of the Transparency and Consent Framework, which publishers and ad firms rely on to manage user privacy preferences. The inclusion of a firm under investigation raises questions about the vetting processes for digital advertising standards.
Citizen Lab identified 45 targeted devices at Al Jazeera, while Discover-Tech ads were found on devices connected to EU institution and NATO networks. Volasim has denied any involvement in spyware activities.
The players
IAB Europe
This trade association manages the Global Vendor List to help companies comply with privacy requirements.
Citizen Lab
This interdisciplinary laboratory focuses on research at the intersection of human rights, global security, and digital technologies.
Volasim
This company is currently listed on the Global Vendor List despite facing scrutiny over alleged links to spyware activities.
Belgian Data Protection Authority
This government agency oversees privacy regulation and previously penalized IAB Europe for framework non-compliance.
The details
IAB Europe uses the Global Vendor List to support its Transparency and Consent Framework. While IAB Europe and Google previously removed Discover-Tech from their approved lists, Volasim continues to be listed despite the technical findings published by Citizen Lab.
Timeline
In 2022, the Belgian Data Protection Authority issued a 250,000 euro fine to IAB Europe.
IAB Europe added Volasim to the Global Vendor List on 8 October 2026.
Citizen Lab released its technical report regarding mercenary spyware on 15 October 2026.
As of 28 October 2026, Volasim remains on the Global Vendor List.
The Tech Race
This situation highlights the complexities of maintaining the Transparency and Consent Framework in an environment where ad vendors face accusations of facilitating spyware. It reflects a shift in the digital advertising industry toward higher scrutiny of data management partners.
Users whose devices interact with the Transparency and Consent Framework may be subject to data tracking managed by vendors on the list. The presence of questioned entities suggests that privacy protections may vary depending on the transparency of the listed advertising partners.
The takeaway
The scrutiny surrounding Volasim serves as a reminder for organizations to verify the security credentials of third-party ad vendors. Maintaining a consistent vetting process is essential for platforms that handle user privacy data at an international scale.
Further reading
Learn more about evolving digital safety standards in the Cybersecurity section.
Source note: This article includes information reported by Euractiv DE.
Live Poll
Should industry groups be held responsible for the security practices of the companies they certify?
