PII Encryption

PII Encryption lets you send the personal information your landing pages collect (name, email, phone, address, date of birth, city) to MyAdOptimizer already encrypted, instead of in plaintext. Advertisers can later recover the original values on demand through the PII Recovery API.

Caution

This only applies to server-side integrations — where your own server submits data to MAO and needs to encrypt it first. If you use MAO’s client-side script (Client-side integration) to render ads, MAO already captures and encrypts PII automatically on our end; there’s nothing to set up on this tab.

Where to Find It

Go to Account Info → Exchange Manager, select your Publisher, then open the PII Encryption tab.

Note

Each publisher has its own key. Make sure the correct Publisher is selected at the top of Exchange Manager — the key shown only applies to that publisher.

Getting a Key

Caution

Only MAO’s account manager can generate or rotate a publisher’s key — this isn’t self-service. If no key exists yet, the tab shows:

No encryption key has been generated yet for this publisher. Contact a system administrator to generate one.

Request one through your account manager. Once it’s issued, it appears on this tab for you to view and use — the steps below describe what you’ll see once that’s done.

Your Public Key

Once a key exists, the tab shows the MAO Public Key panel:

Field	Description
MAO Public Key	The public key value, masked by default. Use Show to reveal it, or Copy to copy it directly.
Key ID	Identifies this specific key version (e.g. pub-21-v1).
Algorithm	The encryption algorithm this key uses (RSA-OAEP-256).
Issued	The date this key version was generated or last rotated.

Use this public key to encrypt PII on your server before sending it to MAO — the matching private key stays in MAO’s key vault and is never shared.

Sending Encrypted PII

Encrypt the visitor’s PII fields into a single token using the public key above, then send it as a query string parameter named PIIToken on your existing server-side request (e.g. MAOListingsServerAPI) — in place of sending FName/LName/Email/Phone/Address/City as plain query parameters.

Caution

If PIIToken is present on the request at all, MAO ignores any plaintext FName/LName/Email/Phone/Address/City sent alongside it — the two are never mixed. Send one or the other, not both.

Rotating Your Key

Requesting a rotation also goes through your account manager — see Getting a Key above.

Caution

Rotating doesn’t invalidate the previous key immediately — the old key stays valid for decryption for 90 days after rotation. Update your integration to encrypt with the new public key as soon as it’s issued; the 90-day window exists so nothing sent during the transition gets rejected, not as a reason to delay updating.