How Ethyca's Fides Became the Basis of the IAB Tech Lab Privacy Taxonomy

The problem privacy had before a common language existed

For years, the digital advertising and data ecosystem operated without a shared vocabulary for privacy. Legal teams described data risk in one language. Engineers labeled datasets in another. Compliance frameworks used a third. The result was a costly game of telephone: interpretive inconsistency, integration debt, and regulatory exposure that compounded at every layer of the supply chain.

Standardized consent frameworks like the IAB's TCF and MSPA helped structure consent signals — but the underlying data governance layer, the way organizations actually described what data they held, why they processed it, and what rules applied, had no interoperable standard.

In practice, this produced interpretive gaps: the same data field meant different things depending on who was asking and which system was responding. And the problem scaled poorly. In digital advertising specifically, data about a single user may pass through dozens of systems — each with its own labeling conventions — before a privacy obligation is triggered. Without a shared taxonomy, automating the enforcement of consent decisions, data subject requests, or deletion obligations required bespoke translation work at every integration point. The cost compounded.

That gap was the problem Ethyca set out to solve.

What Fides is

Fides (pronounced fee-dhez, from Latin Fidēs — the Roman goddess of trust) is an open-source privacy engineering platform created by Ethyca and publicly released in 2021. It is licensed under the Apache Software License 2.0. At its core is Fideslang — the language specification component of Fides, licensed under CC BY 4.0 — which defines a structured ontology for labeling data categories (what data exists), data uses (why it is processed), and data subjects (whose data it is).

Fideslang is written in human-readable YAML, designed to live in version-controlled codebases alongside the systems it describes. The intent is to make privacy declarations part of the software development lifecycle — verifiable, auditable, and enforceable at the infrastructure level — rather than a layer of documentation maintained separately from the systems it governs.

Over five years of engineering and real-world deployment across some of the world's most privacy-demanding organizations, Fideslang matured into a production-tested taxonomy ready for industry-wide adoption.

The donation to the IAB Tech Lab

• 2018 — Ethyca founded. Work begins on a privacy-first data governance framework and the ontology that would become Fideslang.
• 2021 — Fides publicly released. Fideslang introduced as an open-source description language for privacy declarations in codebases and data systems.
• Early 2024 — Ethyca donates Fideslang to the IAB Tech Lab. The IAB Tech Lab's Privacy Implementation & Accountability Task Force (PIAT) assumes stewardship and begins expanding the taxonomy in collaboration with publishers, privacy tech vendors, and AdTech organizations.
• September 2024 — IAB Tech Lab Privacy Taxonomy released for public comment. Built on Fideslang, the taxonomy is opened to industry stakeholders for review and feedback before final ratification.

The rationale for the donation was interoperability. Ethyca founder and CEO Cillian Kieran put it plainly at the time: "There is a direct alignment with the Privacy Taxonomy initiative from Tech Lab and our belief that privacy can only be solved with an interoperable standard language adopted across industries."

The IAB Tech Lab characterized the taxonomy as a foundational shift in how data privacy is managed across the industry — a new standard for how privacy information is conveyed between organizations.

How the IAB Tech Lab Privacy Taxonomy works

The taxonomy is organized around three classification groups. Data Elements describe the type of data being processed. Data Uses describe the purpose for which it is processed. Data Subjects describe the individual the data pertains to — a customer, an employee, a generic user.

This structure allows organizations to:

• Consistently label personal data across internal systems, databases, and third-party vendors
• Automatically map data uses to major regulatory frameworks including GDPR, CCPA, MSPA, and the IAB TCF
• Streamline consent enforcement by standardizing how consent purposes are communicated across partners
• Automate data subject requests by making data identifiable, retrievable, and deletable across systems in a reliable, repeatable way

For engineering teams, the same ontology their data systems use for labeling is the one their legal and compliance counterparts are working from. The translation layer between privacy counsel and infrastructure teams narrows considerably when both sides are operating from a shared, documented standard.

What it means to build on Ethyca

The IAB Tech Lab Privacy Taxonomy, built on Fideslang, is now the reference standard for privacy data classification in the digital advertising ecosystem. The Fideslang repository is maintained by the IAB Tech Lab at IABTechLab/fideslang on GitHub, with Ethyca maintaining a contributing fork.

Ethyca's commercial platform implements the taxonomy as its operational data governance layer. That means the labeling, consent enforcement, and DSR automation our customers rely on is grounded in the same open standard the IAB ratified — not a proprietary framework that lives and dies with a single vendor.

For organizations evaluating Ethyca, the implication is straightforward: the work you do on this platform is work you do on an externally validated, industry-wide standard. It is the difference between building on a foundation the industry has collectively agreed upon, and building on one you have to maintain and defend alone.

Speak with us

If your organization is navigating the gap between what your privacy program promises and what your systems can actually deliver — the same gap we built Fides to close — we should talk.

Ethyca works with companies like The New York Times, Condé Nast, and Ramp to operationalize privacy at enterprise scale on top of the standard we built and donated to the industry.

No slide deck. No 30-minute demo. A real conversation about what you're trying to solve.