generated: '2026-08-12'
method: derived
source: components/tnlmedia-components.yml (Ad2iction Prebid.js bidder adapter + Prebid.js module metadata)
description: >-
  Cross-cutting standards assertions for the only public contract TNL Mediagene
  publishes — the Ad2iction header-bidding adapter. Derived from the adapter source
  and from Prebid.js's own generated module metadata
  (metadata/modules/ad2ictionBidAdapter.json), which records the adapter's IAB
  Global Vendor List registration state. No compliance certifications, trust
  center, SOC 2 / ISO 27001 attestation, or audit report was found on any group
  host, so NO `Compliance` pointer is emitted.
standards:
  - id: prebid-js-bidder-adapter
    conforms: true
    evidence: >-
      Registered with the Prebid.js bidder factory via registerBidder(spec) and
      accepted into the upstream prebid/Prebid.js repository as
      modules/ad2ictionBidAdapter.js, with the required companion .md and a bidder
      page published at docs.prebid.org/dev-docs/bidders/ad2iction.html.
    source: https://github.com/prebid/Prebid.js/blob/master/modules/ad2ictionBidAdapter.js
  - id: openrtb-2.x
    conforms: partial
    evidence: >-
      The adapter forwards bidderRequest.ortb2 — the OpenRTB 2.x first-party data
      object — verbatim in its request body. It does not itself implement an
      OpenRTB bid request/response envelope; the wire format is an Ad2iction-specific
      JSON body and a bare array response.
  - id: prebid-server
    conforms: false
    evidence: >-
      The Prebid.org bidder page declares `pbjs: true` and no `pbs` entry, and no
      ad2iction bidder exists under prebid-server/static/bidder-info. Demand is
      client-side only.
  - id: iab-tcf-v2
    conforms: false
    evidence: >-
      Prebid.js module metadata records `gvlid: null` for both the `ad2iction`
      bidder and its `ad2` alias, meaning Ad2iction is not registered on the IAB
      Europe Global Vendor List. Publishers running a TCF consent management
      platform cannot map consent to this vendor.
    source: https://github.com/prebid/Prebid.js/blob/master/metadata/modules/ad2ictionBidAdapter.json
  - id: prebid-vendor-disclosure
    conforms: false
    evidence: >-
      The same metadata records `disclosureURL: null` and an empty `disclosures`/
      `purposes` block — the adapter publishes no machine-readable data-use
      disclosure alongside the module.
  - id: oauth2
    conforms: false
    evidence: No OAuth surface on any host; /.well-known/oauth-authorization-server 404s everywhere.
  - id: openid-connect
    conforms: false
    evidence: /.well-known/openid-configuration 404s on every probed host.
  - id: rfc9457-problem-details
    conforms: false
    evidence: The bid endpoint returns a bare JSON array; no problem+json error envelope is defined.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on every TNL Mediagene and Ad2iction host probed.
  - id: cloudflare-content-signals
    conforms: partial
    evidence: >-
      thenewslens.com serves Content-Signal directives (search=yes, ai-train=no,
      use=reference) in robots.txt; no other group host does.
    source: well-known/tnlmedia-content-signals.yml
  - id: eu-dsm-directive-article-4
    conforms: true
    evidence: >-
      The News Lens robots.txt states its content signals as an express reservation
      of rights under Article 4 of EU Directive 2019/790.
compliance_certifications: []
compliance_note: >-
  No trust center, no named certification (SOC 2, ISO 27001, PCI DSS, HIPAA,
  FedRAMP), and no compliance page was found on tnlmediagene.com, ad2iction.com or
  mediagene.co.jp. TNL Mediagene is a Nasdaq-listed issuer (TNMG) and publishes
  investor-relations disclosures, which are financial filings rather than an
  information-security compliance program.