As regulators place greater emphasis on documented, risk-based privacy accountability, vendor diligence practices are evolving across the digital advertising industry. The IAB Authorized Assessor Program is designed to help companies meet these expectations through a standardized platform and expert assessment support. We sat down with Michael Hahn, EVP and General Counsel at IAB, to discuss why the program was launched and how it fits into the broader compliance landscape.
Q: The IAB recently announced the Authorized Assessor Program in connection with the IAB Diligence Platform. What prompted this?
Michael Hahn: Over the last few years, we’ve seen a clear shift in obligations and, recently, regulations from California. It’s changing how privacy diligence is expected to work. It’s no longer enough for companies to say they’ve conducted simple assessments of their partners. Regulators, internal stakeholders, and counterparties are expecting diligence to be consistent, documented, and defensible. The IAB Diligence Platform focuses specifically on the digital advertising ecosystem and therefore, is able to capture the nuanced risks and requirements unique to ad tech use cases that a generalized due diligence process may overlook.
Many IAB members were already doing this work, but often in fragmented or ad hoc ways that lacked the depth and ecosystem-specific rigor necessary to meet these expectations. The Authorized Assessor Program is about bringing more structure and consistency to that process, especially for companies that want expert support layered into their diligence efforts.
Q: What problem does this program actually solve for IAB members?
Once an IAB member has the right data from its partners about its privacy practices – something that IAB Diligence Platform is instrumental in securing – the next challenge is identifying which responses introduce meaningful privacy risk and which don’t.
The Authorized Assessor Program supports a more mature model. Companies can use the IAB Diligence Platform to establish a standardized baseline for diligence and, when appropriate, engage an authorized assessor such as FTI Consulting, to stress-test responses for higher-risk vendors. That helps teams move from intake to informed decision-making.
Q: What kind of impact do new regulatory expectations have, particularly in California?
Regulators are increasingly focused on process and evidence. For example, the CPPA’s risk assessment requirements emphasize documented, risk-based decision-making, not just outcomes, and they introduce greater accountability at senior levels of the organization.
What we hear from state regulators is that they want businesses to be able to demonstrate how they evaluated vendor risk, not just that they performed an assessment. The IAB Diligence Platform’s standardization, combined with the Authorized Assessor program, helps create that kind of record in a way that’s meaningful, efficient, and repeatable over time.
Q: Is the use of an Authorized Assessor required for IAB members or platform users?
No. This is not a mandate. The platform and the Authorized Assessor Program are designed to be flexible and an optional service.
Some organizations have the internal expertise and capacity to handle diligence entirely in-house. Others prefer to bring in external experts when vendor volume increases, when risks are higher, or when they need additional validation. The program exists to support those needs, not to prescribe a single approach.
Q: Why launch this program now?
Timing matters. Privacy compliance has become more complex, and expectations have risen across the ecosystem, even as deal velocity and operational needs have not slowed.
We felt it was important to provide a model that helps our members balance rigor with efficiency. Formalizing an assessor-enabled approach within a standardized platform gives companies a clearer, robust path forward as pressures continue to increase.
Q: FTI Consulting was announced as the first Authorized Assessor. Why start there?
We were very deliberate about this. FTI brings deep experience in privacy, data governance, and risk assessment at scale. Launching with a firm that understands both the regulatory and operational realities helps set the bar for what an Authorized Assessor should be.
Establishing a strong, credible foundation from the outset was essential.
Q: What does success look like for the Authorized Assessor Program?
Ideally, privacy diligence would become more consistent across the industry, easier to evidence, and less burdensome for the teams doing the work.
If companies can spend less time reinventing processes and more time focusing on actual risk, that’s a meaningful step forward for the industry.