Welcome to The Monopoly Report! Today, Ari Paparo examines what Judge Brinkema’s remedy means for Google, publishers, exchanges, and the cases still to come.

A Decision on Google, At Last

Since writing Yield, my book about ad tech, Google, and the resultant antitrust trial, I’ve been anxiously scanning Twitter every day waiting for the final remedy from Judge Brinkema. Last week it finally dropped, and – of course – I wasn’t online that day. With a little time for the news to marinate, I’ll now do my best to summarize the situation and likely next steps.

As a side note, for those keeping score, I put odds on these outcomes last fall and they were spot on.

The Facts

If you’re a regular reader you probably already know the facts, but to boil it all down:

• The structural remedies of spinning out AdX and GAM were rejected.

• The behavioral remedies (details below) were accepted.

• The exact order is under seal for 14 days.

• The parties have 30 days to jointly propose a final judgment.

The Hot Takes Have Been Not So Hot

The hot takes have all been of two flavors:

• Woe is antitrust! The government has now won two cases against Google (and prosecuted one against Meta) with nothing to show for it.

• Those sneaky folks at Google got away with it!

I don’t agree with these takes for two reasons. First, I believe the behavioral remedies are very significant and are probably the least disruptive of the potential options for the market. Did Google get away with it? Maybe. But in the near future the market will act in a mostly competitive fashion, and the fruits of their past misconduct will be subject to lots of fines, civil suits, legal fees, and more.

Second, we shouldn’t assume that the DOJ’s proposed remedy of a break-up was necessarily the most just or logical outcome, and reflexively should not assume that when that remedy was denied justice was also denied.

There were a lot of problems with the DOJ’s remedy proposal. As an observer of the remedy trial, I found myself doubting the feasibility or logic of their arguments, and Google’s defense did a great job of poking holes. The Trump DOJ proposed a structural remedy that was phased and complex, perhaps in an effort to appear more business-friendly as a contrast to the anti-tech Biden administration. This nuanced approach gave Google a wide range of targets for casting doubt. When the DOJ said AdX should be spun but GAM should wait three years, Google could make the argument that the two products couldn’t be separated. When the DOJ said the “final auction logic” should be open sourced, Google could say that was vague, difficult, and impossible. I wrote about the complexity of the AdX spin-out in my coverage of day 7 of the remedies trial.

I can also just be cynical and point out that when your presiding judge is 82 years old, and is possibly seeing this trial as the capstone to her distinguished career, maybe it's not wise to propose remedies that will play out over a decade.

The Case for Behavioral Remedies

Rather than reflexively pronouncing the lack of structural remedies as a defeat for competition and a win for Big Tech, let’s look at what is about to change in the market because of this case. As a reminder, Google was found to be a monopolist in the ad tech market for “open web display ads” and was held as abusive in this market in two ways – the tie between the AdX exchange and the GAM ad server, and the tie between Google Ads and AdX. So how will the behavioral remedies try to solve these problems?

AdX Will Bid into Prebid

AdX currently bids directly into GAM and does not divulge its real-time price to the publishers or their header bidding implementations. This prevents publishers from applying yield management to the AdX bids. Before Google implemented its so-called “unified auction,” this was a huge advantage for AdX as it gave them a “last look” to bid one cent higher than all other bidders. From roughly 2018, the last look advantage was removed and the main impact was to prevent publishers from using other non-GAM ad servers. Bidding into Prebid solves this problem and should allow publishers to move off of GAM and still retain AdX demand, if they choose.

Google witnesses on the stand agreed that this is possible, and something they would be willing to do within 12 months. So this remedy is a lock. However, some details are really important here:

1. Will the Prebid integration only be for “open web display ads” or will it also include in-app, video, and native ads? If the former, it will still be difficult to switch ad servers, though not impossible.

2. Will this include private deals and programmatic guaranteed deals? DOJ argued forcefully “yes,” but Google said “no.” Given the decision was in favor of the DOJ, let’s assume it will.

3. Will the Prebid integration be an option for publishers or the primary way to get demand? Google wants this to be an option, which could mean that in practice it provides lesser yield (latency, etc.).

Google Ads Will Bid into Other Exchanges

The demand from Google Ads currently bids into exchanges other than AdX about 5-10% of the time. The remedy will force Ads to bid in a non-discriminatory manner across multiple exchanges. Since Google is the single largest source of demand in the open web category, this remedy should greatly benefit independent exchanges, which should then spur competition at the publisher level, which should benefit competition either through lower take rates or higher media prices.

The devil is in the details on this, and there are a lot of details. As the AIs say, the phrase "non-discriminatory" is load-bearing. The implementation of this bidding will have to account for latency, pricing, inventory quality, privacy, and a host of other parameters that go into the bidding decisions. Plus, there’s the issue of pricing, where currently the Ads -> AdX route takes a total of 28%, whereas the Ads -> external route takes 28% before the third-party exchange takes its fee.

UPR is Dead

Unified Pricing Rules (UPR) is the “feature” that prohibits publishers using GAM from offering different pricing to different exchanges. This has already been rolled back in Europe and will now be killed in the U.S. This is unambiguously good for publishers and should not be controversial.

Fees and Escrow Funds

The DOJ proposed a fund to be created as a percentage of AdX gross revenue with the purpose of defraying publisher costs related to switching ad servers. I’m very unclear on whether this will be part of the final judgment or not, and it was barely debated during the trial.

The Loose Ends

Like Ted Lasso, you may have thought this whole thing was brought to a satisfying conclusion. But actually, there’s a lot more. In no particular order, here’s the uncertainty we’re heading into.

The EU is Out on a Limb

Like Slow Horses, the political mechanizations of the EU are causing trouble for everyone involved. The EU fined Google €2.95 billion last fall and gave it 60 days to respond to the demand for a breakup. They then started getting feedback from market participants and issued a vague statement last December. What’s German for “kicking the can”?

Despite really, really wanting to force the spinout of AdX and GAM, the EU finds itself in conflict with the U.S. courts and potentially inviting the trade wrath of the Trump administration if they try to move forward. It will be interesting to see them wiggle out of this.

The States Want Blood

Like Silo, the multi-party state AG case against Google is going on forever, and no one knows what’s happening. The Texas trial was postponed from last summer while waiting for the federal result, and now will likely get moving again. My take is that, like the recent Meta settlement, the primary purpose of this effort is to close state budget shortfalls, and a very large dollar amount might make this go away.

Civil Cases Are Moving Quickly

Finally, like The Morning Show, there is a lot of money going into the civil cases, but no one is really watching. I used to keep track of all the civil cases but there are so many it can be difficult. The key thing to know is that the monetary damages may be quite significant, and the facts are being accepted from Judge Brinkema’s rulings. This means that it is Google’s interest to appeal and fight the original finding of their monopoly as high as the courts will allow, lest they get on the wrong side of their own “tobacco settlement.”

This isn’t the last you’ve heard from me. Stay tuned as events unfold.

A version of this article was originally published on Marketecture.

Advertising Week New York 2026 is fast approaching and Marketecture Media will be there to capture the conversations moving the industry forward in a New York minute. 

Have a perspective that needs to be heard? Meet us at the Moxy Chelsea to transform your expertise into influence with the Big Apple Hot Takes series.
Sign-up to share your take.

When it comes to happy hours, only one will have an unmatched view of NYC at sunset. Hosted by the infamous AdTechGod in the Fleur Room at Moxy Chelsea, the Skyline Social happy hour will gather like-minded industry leaders for upscale bites and elevated conversation. 
Save your spot here.

Be in the rooms defining the future of advertising and brand building.

This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.

The Windy City established the blueprint for world-class brand work. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.

There’s no better place for brand and agency professionals to revamp their strategies for an AI- and creator-led future of brand building.

Tickets are going fast. Secure your seat at chicago.marketecturelive.com.

Tickets are complimentary for qualified agency and brand attendees.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Marc Guldimann, Co-Founder and CEO of Adelaide. We discuss why attribution may be solving the wrong problem, how Adelaide measures media quality, and whether attention can become a true currency for digital advertising.

The great ones make it look easy.

AI Vampires Came for Spirit Airlines

As you may know, Spirit Airlines announced in May that it was shutting down operations and is in process of selling off its assets. Those assets include a trove of data that Spirit has built over the past 50 years. Google outbid another AI firm to purchase that data set for $10 million dollars.

On the one hand, it’s encouraging to see an AI company paying for data. :)

On the other hand, if you happened to have sent an email to Spirit complaining that their food gave you diarrhea back in 2005*, it probably never crossed your mind that your correspondence would ultimately make its way into an AI company and be memorialized forever. Same with decades of Spirit’s internal correspondence and confidential employee records.

Wait. Is This Legal?

Well, it’s certainly legal in that there’s no law that prevents it from happening. A labor union representing the employees of Spirit Airlines has filed an objection with the bankruptcy court, and as a result, the sale hearing has been pushed back a few weeks. But just know that bankruptcy law only mandates that a debtor engage a consumer privacy ombudsman to evaluate the sale of data in a very narrow set of circumstances. (I should know. I’ve been appointed as CPO in over 25 bankruptcies over the years.)

So, one can certainly argue that the transfer of this information to Google here is inappropriate, but I’m not sure there’s a clear legal foothold for those seeking to prevent its sale. Also, the $10 million dollars would help get creditors paid, and that’s certainly a valid consideration.

As part of the sale, Google commits not to “intentionally associate the Deidentified Data with any person or household” and may only “transfer Deidentified Data to third parties, provided that [Google] contractually obligates such transferees to comply with the provisions.”

So yeah. The data is all de-identified by Google. Accordingly, it’s privacy safe — right?

How Can We Judge “Privacy Safe”?

At the end of the day, the bankrupcty court judge and everyone else will probably have to take Google’s word that this incredibly vast data set has been sufficiently de-identified and that privacy interests are safeguarded.

And that is precisely the issue I want to examine today. Because any assurance Google provides here should be evaluated in the context of statements Google has made in other venues.

For a more thorough analysis of the cookie banner effort, please subscribe to the Chapell Regulatory Insider.

Search Data Is Always Unsafe as It Leaves Google

I’ve written, podcasted, and even done a Daily Show-style video about this issue. Google is legally required to share search data with rivals in two separate legal proceedings:

1. The U.S. Search Antitrust case against Google

2. EU Commission decision against Google under the Digital Markets Act.

But in those cases, Google is effectively stating that that a good chunk of its search data is so detailed and sensitive that is all but impossible to anonymize, de-identify, or render it as privacy safe — even though the recipients (i.e., rival search engines) are legally required to protect the data and undergo audits.

Advertising Data Is Only Safe If It Remains with Google

And the search data-sharing claims are coming in the wake of Google’s attempt to establish the Chrome browser as the central repository for all advertising data, under the framing that the company’s use of privacy-enhancing technologies (PETs) rendered the advertising data set as privacy safe.

Here’s the Bottom Line

You don’t have to be a privacy or regulatory expert to see there’s a jiu-jitsu move or three being played. Google is effectively making the following claims:

• Google’s receipt of decades of sensitive data pursuant to a bankruptcy sale is privacy safe, and we should all take its word for it.

• Google’s provision of search data is not privacy safe, regardless of anonymization techniques used and the number of audits conducted.

• Google’s collection and processing of all ad data via Chrome is not only privacy safe but also would make for a “better” ad-supported internet.

At some point, privacy, data protection, competition, and perhaps even bankruptcy law will ask Google to actually show its math.

__________________________________________

* allegedly gave you diarrhea. This is not meant as a broader statement on the quality of Spirit airlines’ food, or airline food more generally.

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Be in the rooms defining the future of advertising and brand building.

This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.

The Windy City established the blueprint for world-class brand work. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.

There’s no better place for brand and agency professionals to revamp their strategies for an AI- and creator-led future of brand building.

Tickets are going fast. Secure your seat at chicago.marketecturelive.com.

Tickets are complimentary for qualified agency and brand attendees.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Alissa Cooper from the Knight-Georgetown Institute. We talk about Google’s legally mandated search data sharing and ask, “Does competition law trump privacy?”

When Google and some of the advocates are copying each other’s historical arguments, hijinks ensue.

Google Is Required to Share Search Data

Google's search business is under pressure from several directions at once. The DOJ's antitrust remedy, the EU's Digital Markets Act, the UK's Competition and Markets Authority, and the proposed US SEARCH Act all impose requirements that Google share its search data with rivals. And every one of those efforts runs into the same wall. Sharing the data means grappling with privacy law, and privacy law keeps tripping over a single word.

I recently sat down with Alissa Cooper, Executive Director of the Knight-Georgetown Institute, for the Monopoly Report podcast to work through some of these concepts. What follows draws from that conversation.

I’m not going to provide a deep analysis of each of the competition laws that would require that Google turn over this data. Rather, my goal here is to analyze Google’s arguments for why turning over the data will create issues. I offer this for two reasons:

1. It demonstrates the inherent tension that exists between privacy and competition law.

2. It highlights that arguments being made by Google and others can be contradictory — and perhaps even opportunistic — depending on which room they are in.

Why Granting Data Access to Search Rivals Is Important

Of course, most rival search engines want access to Google’s data. I don’t think there’s much debate when it comes to how much larger Google’s search business is when compared to any of its competitors. Even with that in mind, a few data points shared by Alissa jump out:

1. Thirteen months of Google's query and click data is worth roughly 17 years of the same data from Bing, the second-largest search engine in America.

2. Users enter about nine times more queries on Google than all its rivals combined, and 19 times more on mobile.

3. In one analysis of 3-4 million unique queries, 93% were seen only by Google. Bing, its closest competitor, saw about 5%.

That's the case for sharing in a nutshell. A rival can't build a quality search engine without seeing what people search for and how they react to the results. Google sees almost everything. Nobody else sees much. As Cooper put it, the smaller competitors live and die on whether the first result feels good enough that a user doesn't switch straight back to Google.

For a more thorough analysis of the cookie banner effort, please subscribe to the Chapell Regulatory Insider.

Google: Yeah, but Don’t Forget Privacy!

Google's response to these requests focuses heavily on core tenets of privacy, such as anonymization and re-identification. Google’s security team told WIRED it could re-identify supposedly anonymized search users in under two hours, and argued that if data can be re-identified, it was never anonymous to begin with. In fairness to Google, the company isn’t pulling all this out from the ether; it is merely pointing to the law.

Anonymization as a Condition Predicate to Data Sharing

Article 6(11) of the Digital Markets Act (DMA) requires that Google share ranking, query, click, and view data with its rivals. But it also requires that any “such query, click, and view data that constitutes personal data shall be anonymised.”

The anonymization requirements work at cross-purposes to the data-sharing requirements.

EU Data Protection Law Is Rather Strict on Anonymization

Just last month, an influential group of EU data protection regulators (the EDPB) issued guidance on anonymization. I’ll admit, the EDPB tends to take the most privacy-protective positions. Moreover, its view is seemingly at odds with recent CJEU decisions and the EU Digital Omnibus. But this view (which effectively hasn’t changed since 2014) makes clear that anonymization is all but impossible and that the ability to single out a user effectively trumps anonymity.

And all this provides Google with a pretty solid perch from which to make its argument in connection with anonymity.

The Curious Case for Being Reasonable

Alissa and her colleagues at KGI note that there are provisions in place designed to address privacy concerns. For example, rivals receiving the search data would be subject to audits and governed by robust contractual provisions. If you frame the privacy and data-sharing questions around practical incentives rather than theoretical capability, then Google's focus on anonymity starts to look less compelling.

Irony Alert!

That said, if you feel like you’ve heard this argument before, it’s because you have. (Hence, the Freaky Friday reference.)

The argument Alissa is making is very similar to the harms argument that “the ads industry” (including Google!) has made for the better part of two decades. The idea being that contractual provisions, audits, and a robust analysis of data flows can sufficiently address the privacy issues that might arise here.

I’m not saying I disagree with that view. But as someone who’s attempted to make a very similar argument in EU privacy circles before, I can tell you that argument does not tend to hold much water over there.

Unfortunately, this turns the debate into an arcane fight over which European institution used which word, when it should be about people's actual privacy.

How Does This All Play Out?

I see two broad possibilities:

1. EU data protection law (and U.S. privacy law) each becomes more pragmatic when it comes to personal data and anonymity.

2. Google spends years discussing and debating these issues with all comers, recognizing that AI will render anonymization completely moot over time, and the company never shares anything useful with rivals.

Which do you think is more likely?

__________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Be in the rooms defining the future of advertising and brand building.

There’s no better place to discuss where advertising is headed than the city that helped lay its foundations. This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.

The Windy City has long been a hub for world-class brand work, commerce, and innovation. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.

There’s no better place for brand and agency professionals to revamp their strategies for an AI- and creator-led future of brand building.

Tickets are going fast. Secure your seat at chicago.marketecturelive.com.

*Tickets are complimentary for qualified agency and brand attendees.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies - and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Andy Dale. We talk about the value of a redefined version of industry self-reg where the industry associations are more collaborative. #Imagine.

Some advice for the poor souls who participate in a “kill the cookie banner” multi-stakeholder process.

Author’s note: My son was born this week. Baby and mom are doing great. But I’m literally typing this from the hospital room with hospital staff entering every 30 seconds, which means neither of us can sleep anyway. So…

Everyone Hates Cookie Banners. So Why Do They Exist?

I’m certainly no fan of the cookie banner, and I have been on record for a long time that European regulators and policymakers are over-reliant on consent. Seems like every privacy problem impacting the ads space in Europe has a single solution, and its name is consent.

Recently, a number of civil society organizations across Europe have banded together to create KillTheCookieBanner.eu, an initiative designed to support the EU Digital Omnibus’ idea of moving away from cookie banners and toward a single-choice mechanism that resides in the browser. (i.e., the Global Privacy Control). The group is claiming that the EU Commission had all but decided to adopt GPC under the Digital Omnibus GDPR reform process, and that Google and “the ad industry” had thrown a wrench in the process. In response, the group is encouraging an old-school letter-writing campaign to put pressure on EU politicians to push these reforms forward.

Is Google to blame for this? Typically, I find my answer to this type of question an unmitigated YES!

But in this case, I believe that there’s a lot more nuance. I don’t think one can solve the cookie banner problem in Europe simply by having the EU adopt the Global Privacy Control, as some are suggesting. And I don’t believe the Commission’s Digital Omnibus approach to cookies as currently construed is viable. I explain why on the podcast here and here.

For a more thorough analysis of the cookie banner effort, please subscribe to the Chapell Regulatory Insider.

A Little Bit of History Repeating

It seems like there’s some momentum toward the creation of a multi-stakeholder process to address the EU cookie consent problem. On one hand, that’s encouraging news. Nobody, and I mean nobody, wants to continue living in this consent hell.

However, we’ve been down this road before. As of today, I don’t know who will take part in this process. So let’s view this as an open letter to that group from someone who has lived through what you’re about to live through.

There are inherent challenges to solving “the cookie consent” problem in Europe. And unless the group wants to spend the next few years meandering toward the Open Internet’s version of Waterloo, the group would be be well served to keep the following in mind:

• Opt-in ≠ Opt-out: GPC signals are best for recording opt-out choice, while EU data protection law is an opt-in regime for cookies and profiling. That’s not a trivial distinction. If you want consent to be specific and informed as required under EU data protection law, you simply can’t have a single setting covering every website that one might visit.

• Browsers ≠ Unbiased: Putting these controls in the browser (all of which have competing business interests) requires one to include rules designed to avoid browsers from preferencing their own offerings. Otherwise, you’re at risk of violating EU competition law.

• Desktop ≠ the Internet: Whatever standard gets created needs to include CTV and mobile O/S platforms as well.

• Discourse ≠ Rock-Fight: In any multi-stakeholder process, the various constituencies need to be transparent about their goals and defined success criteria for this effort. If one part of the room wants to end any form of tracking because it believes tracking is illegal under EU law (it isn’t) while the other half is trying to create loopholes, it seems unlikely that the group will reach consensus. To be clear, I believe that both positions are inappropriate. But those two voices are often the loudest in the room.

• Finish What You Start: What seems to happen with these multi-stakeholder processes is that the group gets 90% of the way there and then someone (usually a politician) declares victory via a press release. The first 90-95% of progress is relatively easy. It’s during the last mile that these types of initiatives often die.

• Listen to Publishers: The idea that publishers aren’t smart enough to determine the tools they want — and that any form of tracking is against the interests of publishers — is a form of paternalism. Keep in mind: Publishers aren’t competing with newspapers circa 1990. Rather, they are competing with 2026 walled gardens for ad dollars. If they tell you they need third-party tools to give them a chance to compete, those views and the evidence suggesting that publishers are acting rationally should not be so quickly dismissed. Exempting publishers from consent requirements isn’t super helpful if they can’t use those tools.

• Be Wary of Further Empowering Big Tech: If this group does nothing else, I hope it keeps the following in mind as it looks to create rules: The past decade has brought a significant worldwide wave of privacy and data protection laws to the ads space. During that time, we’ve seen Big Tech reach the point where it is often “too big to regulate.” This is not a coincidence. I implore this group to avoid throwing Little Tech to the wolves under the illusion that this will somehow make it easier to come after Big Tech.

That said, I wish this group all the success in the world. If you can accomplish this, you’ll not only be heroes — you’ll make the world a better place.

I can only hope that you won’t let the search for the perfect get in the way of making incremental progress.

__________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

🎄Save the date: July 29

Christmas in July has LANDED. Tear off that wrapping paper, here’s what we’re gifting:

🎁 $100 Off Registration
Like Saint Nick, this deal is making a one-night appearance. Save $100 on your ticket by registering before 11:59 p.m. ET on July 29.

LOCK IN YOUR SPOT

Already registered? There’s no shame in the re-gifting game. Send that discount over to a friend, colleague, or client you want to join you in the Windy City.

🎁 First Look at the Agenda
Featuring the industry’s top voices, we’ll go deep on the new realities of brand building in an AI- and creator-led world. Scroll through for a first look at the conversations coming to Chicago.

VIEW THE FULL AGENDA

🎁 AdTechGod® Confessional
The AdTechGod® Confessional is a dedicated space for attendees to anonymously share their boldest predictions, cutting commentary, and biggest advertising confessions. Sponsored by Innovid NIVO.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! I spoke with Martin Thomson of Mozilla. We discuss the W3C Attribution API, a spec that many in the research community believe is deserving of far more scrutiny than it is currently receiving.

Google is bringing that process we all used to call fingerprinting to Europe.

The Fall and Rise of Fingerprinting

For a decade, Google told anyone who would listen that browser fingerprinting was bad. Google’s rationale at the time was that fingerprinting tech lacked sufficient user privacy controls. Then, in 2025, after the Privacy Sandbox collapsed, the company reversed course and blessed probabilistic identifiers inside its own ecosystem. We are now watching the next phase of that policy shift.

And, dare I say, this policy shift is kind of ironic.

Effective Aug. 3, 2026, Google is launching "IP-based measurement and personalization" for AdSense publishers in the EEA, UK, and Switzerland. I haven’t seen a ton of coverage of this new offering to date. An overview of the program is available here and here.

What Actually Changes on Aug. 3

Google has always received IP addresses as a network byproduct for routing, fraud prevention, and ad delivery. Under the IAB Europe Transparency and Consent Framework (TCF), those count as non-consent purposes. That changes now. Under the new policy, Google will also use IPs for device identification, measurement, and personalization. Those are different purposes, and they carry both legal and TCF framework related obligations. For example:

• GDPR Requirements: Under GDPR Article 5(1)(b) (i.e., purpose limitation), new uses trigger a fresh legal-basis requirement.

• TCF Requirements: The IAB TCF requires that data features appear in the Consent Management Platform (CMP) interface. Accordingly, Google will add Feature 3, "Identify devices based on information transmitted automatically," to its IAB Europe registration.

Accordingly, anyone running a third-party CMP supporting Adsense must surface Feature 3 in Google's vendor entry before August 3 or risk understated-disclosure exposure and limited-ads degradation (not to mention legal liability).

PETs are rearing their head

Google is also relying on privacy-enhancing technologies (PETs) as the mitigation. Nothing wrong with that. PETs are all the rage right now in the ads privacy community. So under this new policy, Google will rely on on-device processing, Trusted Execution Environments (TEEs), and secure multi-party computation (MPC). There are a few additional components to this that are worth noting:

• Liability: Publishers are responsible for obtaining consent for Google’s use of these data points as per EU data protection law and Google's EU User Consent Policy.

• Opt-out Irony: There is also no dedicated user opt-out at launch. Google reportedly won't ship user-level IP-personalization controls until late 2026 or early 2027. In other words, after railing for over a decade that fingerprinting should be prohibited because it failed to offer user privacy controls, Google has opted to ship a fingerprinting tool that [checks notes] fails to offer privacy controls.

• Sequencing: These PETs engage after Google receives the IP address.

Privacy and regulatory issues are the “invisible hand” driving digital media strategy. If you want to be in the know, get a free trial by clicking the image above.

What’s Google’s Plan?

Irony aside, I’ve started to think about Google’s longer term plan. I suspect that Google’s use of PETs are designed as a liability shield in that they potentially enable Google to:

• Continue to impose consent and other requirements on publishers with respect to the input data.

• Take less responsibility for its own processing of those inputs and potentially even claim it is no longer processing personal data with respect to the output data (i.e., because it is aggregated and anonymized).

• Make it more difficult for regulators to understand the data flows (and potentially, more difficult to enforce against Google). The days of “slam dunk” penalty after a regulator or plaintiff locates a Google cookie or sees a Google pixel fire without proper consent appear to be at an end.

• Shield itself from CIPA liability (should Google choose to bring this process into the U.S.)

It’s a pretty smart strategy.

What About Cookies?

One other question might come to mind. Specifically, is this how Google finally kills the third-party cookie? I don’t think so.

Why not?

• Antitrust Liability: In my view, outright deprecation is now an antitrust liability Unilaterally killing third-party cookies in Chrome is precisely the Chrome-leveraging move the DOJ remedies phase, the UK CMA, and the EU Commission are awaiting.

• Sandbox Lessons Learned: Also, one of Google’s biggest mistakes with respect to the Sandbox was announcing a date to sunset cookies before it had a viable replacement. (Yeah, I’ll concede that there was a chicken-and-egg thing happening.) The market panicked, and perhaps even revolted, the CMA stepped in, and Google had to retreat. The lesson Google absorbed was not "cookies are fine." Rather, it was "build the replacement first." IP-based measurement is that replacement.

• Better, Faster: And this replacement has a bunch of additional features: (a) It works across browsers, (b) it survives at least the current wave of Safari and Firefox blocking, (c) it functions in-app, and (d) it lives at the network layer Google controls rather than the browser-storage layer that regulators and rival browsers keep attacking.

• Asymmetric Obsolescence: In that light, the smarter play is not killing the cookie. Rather, the smart move is making the cookie irrelevant to Google while leaving it standing for everyone else. Call it asymmetric obsolescence. Google migrates its own value onto a rail competitors cannot reach—IP at the network layer, authenticated first-party signals on its O&O—and lets the open web keep running on aging cookie and UID infrastructure that degrades a little more each year. Google does not need to sunset the cookie. It needs to stop needing it. This policy shift is exactly how they stop needing it.

Chapell’s Take: Broadly speaking, Google is engineering a position where it keeps the one form of interoperability it needs (ingestion) as it exits the one that carries the exposure (open-web ad serving).

________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Be in the rooms defining the future of advertising and brand building.

There’s no better place to discuss where advertising is headed than the city that helped lay its foundations. This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.

The Windy City has long been a hub for world-class brand work, commerce, and innovation. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.

Meet the first wave of speakers and secure your seat at chicago.marketecturelive.com.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Martin Thomson of Mozilla. We discuss the W3C Attribution API, a spec that many in the research community believe is deserving of far more scrunity than it is currently receiving.

Q&A on the W3C Attribution Spec with Martin Thomson

Editor’s Note: This week, in addition to the podcast interview with Thomson, we’re sharing the Q&A notes, which go into additional depth in a variety of areas. We’ve resisted the temptation to attempt to counter some of Martin’s positioning on these pages, although Alan does so on the podcast. We are reprinting the Q&A with only light edits, and would strongly encourage you to listen to the podcast and review the comments provided via Github to get a more complete sense of Alan and Martin’s views. Hope you enjoy!

Alan: For my listeners who haven't followed the W3C’s Private Advertising Technology Working Group, give us the elevator pitch explanation for the Attribution API. What problem does the Attribution API solve that traditional forms of attribution in digital media (cookies, fingerprinting, and server-side attribution) do not?

Martin: A browser is in something of a unique position when it comes to helping ad measurement.

Traditionally ad measurement has taken something of a self-service approach. You see this in how third-party cookies and fingerprinting are used. Ad tech worked out how to take what they needed.

But the problem with that approach is that it depends on people’s online activity being something of an open book. Or it creates that situation, it’s hard to really know what cause and effect look like there. Either way, it’s a bit of a privacy nightmare. Browsers would like to be able to promise people that their activity on one website is not made available to other websites.

Of course, browsers end up seeing everything, so they could be very helpful in providing cross-site measurement. Attribution is browsers saying “we can help, but here are our terms.” That means that we have strong safeguards that prevent sites from using the API to recover your browsing history. The design intentionally gives people a lot of control over how their browser participates.

How does the Attribution API differ from Google's Privacy Sandbox attribution work, which also went through the W3C, and from the earlier IPA and PPA proposals? What did you learn from those efforts that shaped this one?

There are two main efforts in this area: Apple was the first to provide ad measurement, with Private Click Measurement (and a similar facility on iOS). That attempted to provide privacy essentially by not being very good. Limited information and long delays are the main “features.” The privacy ended up being not stellar. Google’s Privacy Sandbox included a more capable version of that same basic event-based design, using differential privacy, but the privacy was much worse.

The aggregated Attribution Reporting API in Google’s Privacy Sandbox isn’t fundamentally different from Attribution. It’s tuned differently, but anyone familiar with that should have a good idea of what to expect.

PPA is just an old name for this API.

IPA was a more ambitious effort. For us, this collaborative effort with Meta was so strange and wonderful — Mozilla and Meta are so often at odds — but the team there was great to work with. We produced a design and implementation that was clever and overall quite solid, all using the same privacy design. But we ultimately failed to get agreement on aspects of that design, despite it addressing some real shortcomings in the current approach. Maybe one day we’ll get there, who knows.

If this proposal didn't exist, what's the realistic alternative the industry lands on — and is it better or worse for the average person than what you're building?

The basic problem in the space of ad measurement is that there is a hard tension between the quality of measurement and privacy. Comprehensive tracking gives decent measurements, but it sucks for privacy. Full privacy — which is probably not achievable in practice — makes it virtually impossible to get useful measurements.

What we learned from previous attempts is that the midpoint tends to be very bad on both measures. Any attempt to back away from the panopticon approach leads to terrible measurement quality, but doesn’t help that much with privacy. The same in the other direction.

If you want to be strictly mathematical about it, participating in measurement has some privacy impact. But we think the actual meaningful impact on privacy is negligible.

Alternatives from the industry look far worse. They often involve asking people for email or phone numbers. This can work for some advertising objectives and interactions, but it leaves a lot to be desired in terms of measurement quality. That’s far worse for people. It’s annoying, because being badgered is annoying, and you always know that sharing contact information inevitably leads to more spam.

I think that there is also a fair expectation that this data, once handed out, is on the open market pretty promptly. No one believes the promises that companies make.

I’ve been pretty critical of the way PETs have been implemented in the ads space. The Privacy Sandbox is kind of the poster-child where my core issues are: First, the privacy or other benefits are a bit opaque. And second, there isn’t an earnest discussion of the tradeoffs in play. We can get into specifics in a bit, but at a high level, I’d love it if you’d walk us through what you see as the privacy wins in the spec: on-device attribution, aggregation, differential privacy noise. Where does the design actually move the needle versus the status quo? Why are those privacy wins important, how are they being measured?

You are absolutely right to be critical. PETs have great potential in theory, but the practice is pretty bad. Lots of using PETs to dress up real privacy abuses.

Attribution is very much a PET, but it differs from industry efforts in a key way: how it distributes control. That, for me, is how you determine whether someone is serious about their privacy technology.

The question I start with when it comes to any PET is not so much about the information flows. It is who decides. That is, whatever it does, who is truly in control?

That means asking who decides how the system operates, with what, and to whom is it accountable?

In Attribution, we have several layers of answers to the basic question of who is in control. The first is about the overall shape of the system. That’s decided at the W3C, which has a decent track record of putting end users first. Browsers will also ultimately decide who is trusted to do aggregation. Those are answers we can give that are rooted in governance. There will be procedures and rules and reports and all that boring stuff.

Of course, governance like that is not exactly accessible. So those systems only exist to support the main answer, which is that the end user is the real decider. If your browser ships with the Attribution API, there will be a switch that allows you to turn it off (or maybe even down). And we protect that right, because there is no way anyone can be punished for their choices, because sites can’t know what the decision was.

That philosophy underpins the entire design. Attribution gives sites a way to query a cross-site database. Without constraints, that would be bad for privacy. So the people whose data fuels this remain in control. Not through some annoying cookie banner, but through having a functioning off switch.

All the design features we use (aggregation, DP, etc.) are all in service of bounding the privacy cost, but ultimately those are just the guardrails. The W3C is really only shaping those guardrails. The design fundamentally is geared to protect user agency.

What do you see as the tradeoffs in play with respect to the Attribution API (Assuming there must be some.) Were there any which were particularly difficult for you to swallow?

For folks using this API, I’m sure that the question of the epsilon parameter will be high on their list of concerns. Or maybe the size of histograms we are able to support.

Those are second-order concerns for me. Most of what we have I’m happy with in its present state, while acknowledging that there are a lot of unknowns that we won’t learn about until it gets used out there in the wild.

The most difficult decisions we had were around scoping. IPA had some nice features that we did not keep. For instance, IPA had what I think is a good story for conversion stealing, but the complexity of that approach — both in engineering it and in the nature of the agreements that need to be penned — was rightly considered a bit much.

Privacy and regulatory issues are the “invisible hand” driving digital media strategy. Be in the know with a free trial by clicking the image above.

Differential privacy is the headline feature. How does that and other features map against user perceptions? (e.g., user research found that consumers may not view these types of systems as a privacy benefit — is that simply a consumer education issue or is there some validity behind it?)

I’m aware of that research. And it’s entirely fair for people to look at differential privacy and reach a somewhat negative conclusion. There is a lot about differential privacy practice that doesn’t serve end user needs. And some people will conclude that it doesn’t serve them here either. That’s fair. That’s exactly the sort of decision we aim to support.

But DP remains the best tool we have for getting verifiable guarantees. The mathematical rigor we get is key to being able to make people firm promises. Given a goal of putting people in control of their online experience, then those promises are something DP helps us deliver.

However, I want to stress that differential privacy is not the only tool we use. The aggregation design is part of the response, and there are anti-abuse measures too.

Apple, Google, Meta, and Mozilla all have editors on this spec. One might look at that roster of companies and think that there’s some "incumbent coordination" taking place. What does Mozilla (with a relatively small albeit growing ads business) get out of being at this table?

Mozilla sees the positive potential of advertising to support the health of the Internet. It can be an equitable way to support online services. Advertising has a terrible track record on privacy, but that doesn’t mean that it can’t do better. Our interest here is in guaranteeing that people, not businesses, determine what is acceptable.

As far as incumbent coordination goes, I’ll be the first to acknowledge the high costs of participation in the development of a standard like Attribution. So it is understandable that well-resourced companies are able to invest the most effort.

The companies with deeper pockets are shouldering the burden of doing the work, but it’s far from the case that this work was exclusively determined by that small set of companies. It’s an open process, and there have been many smaller entities involved in the decision-making process.

What is the value of having standards bodies policing the privacy harms of interoperability? Is the long-term goal for this (or similar) standards to be addressing privacy harms in other contexts? (e.g., the harms that may or may not happen behind the walls of a few dominant platforms?)

“Interoperability” is such a loaded term in this context. It took me a long time to understand that my use of the term does not align with the way in which it is used in the advertising industry. Understanding that we have such a key word in common, with such a deceptive and subtle difference in meaning unlocked a lot for me. I know what you mean, and I could go on at length about how much damage that word — and the practices it describes — has done. But we really  don’t have the time.

I can’t speak for others here, because that’s not generally something that gets agreed between different people in standards. We each have our own reasons for coming to a project. Those reasons can often be set aside, provided that we agree on outcomes.

Going into this project, I had such grandiose dreams. We’d give end users the reins, so that we can demonstrate that it is possible to give people far more direct control over the systems in the world that affect their privacy.

I still think that’s a worthy goal, so it will continue to be a large factor in other things we build, but I’ve gained a greater appreciation of the role of other actors in the system. It’s not enough to give people that power; it needs to be an effective control.

I’ve gained an appreciation (and no small amount of distaste) for the governance processes that make it possible to create those levers. It shouldn’t come as a surprise that privacy is complicated and the tools that work for online advertising don’t fit as well in other contexts. When developing standards for the internet, we only deal with a tiny part of that complexity. For instance, gaining an appreciation for how governments deal with multiple industries has tempered my expectations there.

Critics in the research field argue that the spec standardizes an observational attribution framework that cannot distinguish correlation from causation—that it measures association, not incrementality—while the spec's own language promises to identify "effective" advertising. Is that a fair critique? And what steps are you and your colleagues taking to overcome those challenges?

I’ve had some constructive back and forth with Rick Bruner who has been the most vocal of the critics here. I think that there was (and probably still is) a bit of a conceptual gap more than there is a fundamental problem. And maybe an issue in how we presented the work.

My experience with Attribution is that it genuinely can drive the creation of more effective advertising. Rick makes the point that you can’t just do attribution and magically get information that makes advertising better. Attribution only gives you information. You need to structure that information in a way that allows you to use it effectively.

Attribution is a tool that you need to integrate into good experimental design. Use it poorly, and you can convince yourself of just about anything, with very little relation to reality. My sense is that ad techs believe the same: that Attribution can help deliver better results for advertisers.

If you had to name the single design decision in this spec you're least certain about — the thing that (at least metaphorically) keeps you up at night — what is it?

There are obviously aspects of the design that I think could be better, but the thing that concerns me most is how it will be received by people. The entire design is structured around giving people the necessary control, but ultimately we know that some people are vehemently opposed to anything that their browser might do that helps advertising in any way.

I am confident that the design delivers on that promise, but for some people that’s never going to be enough and even implementing something like this will be seen as a betrayal. We know that strongly polarizing positions end up getting a lot of traction in the modern media environment.

Critics raise a structural concern that these systems systematically favor lower-funnel channels — search, retargeting, retail media — because they sit closest to the conversion. Does the API bake in a bias that disadvantages brand-building and premium publishers?

I want to acknowledge that there are limitations in our approach that very much could lead to certain biases. A lot will depend on how this new tool ends up being used.

A big one here is that this can only see what happens in a browser. A lot of the efforts with brand awareness happen in places that this simply cannot touch. This is not going to be able to help measure brand awareness campaigns that rely on other mediums.

How this new tool can be used to account for effects outside of those obvious lower-funnel interactions is something that I don’t have a lot of information on right now. The general sense I get is that businesses are going to need to spend some time learning before we’ll have good answers.

I hear that people are concerned that dominant players might seek to use measurement to further entrench their market position. I’m sorry to say that we don’t have easy answers to that one. Of course they will if they can get away with it.

The spec indicates that fraudulent impression registration is an open problem, because impressions sit on the device where no server can vet them. Don Marti and other critics take that further — arguing that it creates an incentive to front-run conversions, to sneak an ad in front of someone already about to buy. Is that risk real, and what stops it?

It’s real, but it might be overblown. The delegation design we have allows a DSP to manage when impressions are saved. That can limit exposure to untrustworthy sites that attempt to snipe conversions.

The one thing that the IPA had over this was the ability to retroactively remove IVT from impressions. Here, we acknowledge that limitation, but that is a constraint on its (successful) use, not something we regard as a fatal flaw.

My understanding is that Mozilla shipped an early version of the spec and enabled it by default, which drew some backlash. What did you learn from how that landed, and would you do the consent question differently today?

Not a lot to say here yet. Firstly, it’s important to point out that nothing was ever turned on in relation to the toggle that we shipped.

It was supposed to help us learn about how the API worked. We learned a lot about something else instead.

It’s funny, almost the same day, Apple announced that they were enabling their Private Click Measurement API in Private Browsing modes. Not a peep in the media on their side.

If you need evidence that Mozilla is special, that might be the best anecdote I have. Because the trust we build with our users is not unconditional; we really have to deliver.

I’ve been using an urban planner Robert Moses analogy lately where the infrastructure being created by standards bodies can be policy choices. Are there design decisions in the spec that you kept some level of optionality so that future engineers can change them?

Funny that you use lessons from building something like urban planning. That seems so much more immutable than the Internet.

But the analogy is sound. The history of the internet is littered with incautious choices that last decades. Cookies are a great example. The choices made in standards can and do affect the architecture of society. At least a little.

As for any specific choices, we’re drawing on a lot of experience about how to build for the web here. So there’s far less of this design that is baked in like that. What ultimately ends up being the unchanging infrastructure and what ends up being mutable will be determined more by how it ends up being used.

In short, I’ve learned that every decision needs to be one that can be unmade. What can’t be unmade is the decisions that the market/community/world-at-large makes for you. The ones you didn’t anticipate.

If this proposal is successful, what does the digital media world look like in a few years? 

I’d like to see a whole lot less tracking, collection of email/phone numbers, clean rooms, and the other bullshit privacy apparatus that the advertising industry created.

In practice, however, I don’t expect this to change anything significantly. Success here means that some businesses decide that this is enough. That they can get enough information from attribution without having to resort to those other things. If it is only a few who change, that’s a win.  

The IAB Tech Lab's AdMap and Project Rearc, and the experimental-design approaches from groups like Central Control, take a very different path — one compatible with Right to Know requests. What difference / advantages does a browser-native standard have over some of the other efforts?

I hope that the points I’ve made about end user control make it clear why it is hard for us to take AdMap seriously. As a whole, Rearc doesn’t represent a vision that is compatible with our vision for Attribution. It is more geared towards preserving control in the hands of advertising businesses and dealing with the consequences of that.

Critics have indicated that the privacy-budget mechanism favors large platforms whereby a single mistaken query can lock a small advertiser out, a constraint only a dominant firm could enforce. Does the design assume a power imbalance between platform and advertiser, and if so, does it entrench one?

I want to acknowledge that this is one of the hard parts. Large platforms have more data to use, so they are able to slice that data in more ways than the little guys. With noise, you can’t slice what you get into thousands of pieces unless you have many thousands of people involved. Or, more likely millions. Small players need to be more careful and make fewer queries. And a mistake will wipe out more of their potential learnings as a result.

On top of that, big players will be better able to develop the discipline necessary to get more out of the system. More people, more resources, all that.

We spent a lot of time thinking about this problem. But we concluded that this was one area where attempting to levy a technical control was unwise. Competition law — as ineffective as it has been in stemming the rise of monopoly power in this market, and others — has a better suite of tools available than we do.

Right now, the best I can say is that there are no structural advantages provided to large players, other than what they obtain naturally. I understand that this might be disappointing, but it’s the pragmatic outcome in this case.

Martin, thanks so much for your time.

___________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

LAST CALL: Marketecture Live Early Bird Pricing Ends 7/14!

Blink and you’ll miss it. That’s true of summer, but it’s especially true for Marketecture Live: Chicago early bird pricing.

This fall, we're bringing Marketecture Live to the heart of the Midwest: Chicago. The Windy City serves as the hub for brand, retail, and media innovation, where the industry's biggest shifts are happening in real time.

If you’ve been wanting to attend Marketecture Live but find NYC to be out of range, meet us in Chicago on Sept. 23. Don’t miss your chance to lock in your seat and the lowest price of the season today.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome privacy legend and former Executive Director of the Electronic Frontier Foundation (EFF) Cindy Cohn. We discuss Cindy’s new book, “Privacy’s Defender,” and cover off on a bunch of relevant issues impacting the ads space.

Evolving the Strategy on the Go…

Back in April 2026, I took a look at OpenAI’s January 2026 ad principles and expressed some skepticism regarding the company’s advertising ambitions. I noted that for OpenAI to get to $2 billion per quarter in ad revenue, it would would need to effectively beat the pace of all the other tech giants – and that the company would ultimately be under tremendous pressure to move away from its stated ad principles sooner rather than later.

What’s more, OpenAI had set itself a target of $100 billion in advertising revenue by 2030 — a figure that comes off as difficult to believe and probably deserves more scrutiny than it is currently receiving.

And then just a few weeks ago, in a Financial Times piece, a senior OpenAI official indicated that “chat is dead” – which, if true, means that a good chunk of OpenAI’s ad revenue would need to come from non-chat surfaces.

Just to recap, we’ve got three huge (potentially contradictory) forces in play:

1. OpenAI desperately needs ad revenue: This is particularly true given that (a) OpenAI appears to be heading into a token price war with Anthropic that will artificially provide revenue headwinds for a period of time, and (b) OpenAI continues to burn cash at an alarming rate.

2. Pivot from chat(?): OpenAI appears to be moving away from chat, which seems to be OpenAI’s most obvious ad surface. Such a move would almost certainly have revenue implications and beg the question: What are the most likely alternatives?

3. Ad principles: While I’ve been under no illusions that OpenAI would remain true to its ad principles over the long term, I did think the company would at least make it into 2027 before revamping and/or openly violating them. And remember: OpenAI is still competing for market share as its users are not locked into the service. That makes it more difficult for OpenAI to act in ways that might be viewed as being against the interests of its customers.

Where Else Might the Ad Dollars Flow?

If OpenAI even partially migrates from a conversational surface to an agentic one, the ad opportunity moves in four directions:

1. Agentic commerce — influencing which vendor or product your personal agent selects

2. Partner super-app ecosystem — where OpenAI acts as a “super app” and offers sponsored placement among Canva, Booking.com, and other partner apps

3. Agent-to-agent signaling — ads tuned to influence other agents, not humans

4. Residual chat — traditional sponsored answers for users who never leave the chat surface (i.e., it’s hard to believe that OpenAI moves completely away from chat).

In my view (also noted by ads legend BOK), the most lucrative option is probably agentic commerce, as that offers influence over a purchase at the precise moment of intent.

Focused on the ads regulatory space for over two decades. Get your free trial sub here.

Do OpenAI’s Ad Principles Survive?

Just as a reminder, OpenAI’s advertising principles included statements such as: ads don't influence answers, answers stay "separate and clearly labeled," conversations stay private, users keep control. Those principles were written for chat. It’s not clear how they map to the other surfaces. For example:

• Agentic commerce breaks the "answer independence" principle by collapsing the ad into the decision. Can they simply provide a labeled box beneath the answer when the selection itself is what's monetized?

• The super-app ecosystem strains a different principle: one of "long-term value." A “sponsored partner” marker survives "separate and clearly labeled," but the moment placement is sold rather than earned, OpenAI is optimizing the ranking for revenue. That's the conflict Google's Quality Score was built to address over 20 years ago. Any move that puts the legitimacy of rankings in question creates potential regulatory issues and could result in OpenAI losing trust.

• Agent-to-agent signaling doesn't strain OpenAI’s ad principles so much as it potentially renders them inapplicable. Every promise Simo made addresses a human — "the answers ChatGPT gives you," "your conversations," "you control." There's no human in the loop when one agent influences another.

• Residual chat honors the OpenAI ad principles today. If you want to take the position that OpenAI has a cohesive plan, perhaps that’s where OpenAI plants its flag — and clarifies that the ad principles were only designed for the chat surface. The agent surfaces both the option that's best for you and a sponsored alternative and lets you choose. That approach works best inside high-price, brand-driven verticals like travel, but only if you're willing to hand OpenAI your Delta frequent-flyer number. I’m less confident that this approach works for commoditized, low-margin categories.

Building Trust?

OpenAI published a trust framework calibrated to a surface the company has said is all but dead. Recall the Big Tech playbook I've described before: Promise X, walk back X gradually, hope everyone is locked in before they notice. Google took 25 years to travel from "don't be evil" to "do what's best for Google." OpenAI, carrying a reported net loss of $38.5 billion, doesn't have 25 years.

In my view, OpenAI’s ad principles get quietly re-scoped over the remainder of 2026. OpenAI won't announce that ads now influence agent recommendations. It'll simply define agentic commerce as something other than "an answer.” OpenAI appears to be betting that nobody notices this shift.

I think that’s a fairly safe bet.

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

And That’s a Wrap.

The Marketecture team is back stateside, with our sanity and luggage (mostly) intact. After enduring a record-breaking heatwave, we’re embracing the luxury of air conditioning while keeping the content captured at Cannes just as hot.

Because advertising’s grande fête is really just the starting line for where the industry is headed next, we’ll be releasing footage captured on and off the Croisette throughout the summer.

Expect candid, thoughtful conversations designed to inspire and inform how you’re thinking about, planning for, and investing across CTV, AI, Commerce Media, Creators, and more as advertising continues to evolve into its future form.

From the French Riviera to your social feeds, we’re bringing you Cannes coverage that goes well beyond the Croisette – and the headlines.

Marketecture Live Early Bird Pricing Ends 7/14!

Blink and you’ll miss it. That’s true of summer but it’s especially true for Marketecture Live: Chicago early bird pricing.

This fall, we’re taking Marketecture Live to the heart of ad land: Chicago. The windy city serves as an industry epicenter for some of the biggest shifts happening across brands, agencies, media, and tech. 

If you’ve been wanting to attend Marketecture Live but find NYC to be out of range, meet us in Chicago on September 23. Don’t miss your chance to lock in your seat and the lowest price of the season today.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, we replay the fireside chat that took place recently between Tony Ficarrotta of the NAI and Tom Kemp of CalPrivacy.

Play the video. We’re closer to this scenario than most want to admit.

Greetings from (Not Antitrust) Court

I’ve been in court the past couple of weeks. Nope, I’m not involved (at least not directly) in any of the CIPA litigation that’s slowly eating its way through the ads space. And I’m not here reporting on the Google antitrust case. There hasn’t been much to report in months when it comes to Google’s adtech antitrust case.

Where have you gone, Mrs. Brinkema?

WTH, Are You in Court?

I’ve just finished up grand jury service in NYC. No, not a “regular” jury that determines whether someone is guilty beyond a reasonable doubt, or whether some dive bar in the West Village is liable because one of its patrons tripped on the bar’s uneven stairs.

A grand jury’s role is to determine whether there is legally sufficient evidence and reasonable cause to formally charge someone with a crime and send their case to trial. In that way, the grand jury is designed to act as a community check on government power. (You may have read about a number of grand juries serving that exact role recently.)

My last jury service was right before 9-11. But there’s one thing that really jumped out at me between my last jury service in 2001 and my service as a grand juror in 2026.

I’ll give you two guesses as to what that is…

You Are Being Watched

I may come off as a bit naive in writing this, but I’m shocked (shocked!) by the pervasiveness of cameras in NYC. I guess I was aware on some level, but nothing drives home the degree of surveillance taking place than spending two weeks watching video after video of my fellow New Yorkers grumpily going about their days.

All you folks in the suburbs complaining about that Amazon / Ring camera Super Bowl ad? Please. Hold our beer. Cuz if you’re in the City, and you are:

• using mass transit,

• in a retail establishment or bodega,

• hanging out in a bar,

• standing outside on the street,

• near a school,

• in the lobby or hallways of most buildings, or

• happen to wander in the general vicinity of a police officer…

Well, chances are, there’s a video record of you somewhere that can be retrieved with relative ease.

Don’t want you to think this was written by Claude AI, but…

Let that sink in.

Facial Recognition Tech Is Also Better

That’s only part of the story. Facial recognition technology is starting to take over.

I recently conducted a poll on LinkedIn that asked well over 100 of you whether you use Clear or Global Entry. Keep in mind: My LinkedIn community is heavily weighted toward privacy professionals. Nonetheless, over 90% of you indicated that you use Clear, Global Entry, or both. I’m not judging; I use them as well.

As you may know, it wasn’t too long ago that Clear began rolling out its facial recognition software at airport security checkpoints to enable a "friction-free" verification. When they write “friction-free,” they mean that it is now significantly easier for their software to identify people in seconds.

What happens when you combine all these cameras with the ability to identify your face in a crowd? Well, before you know it, we’re in that surveillance state that advocates have been warning us against since the mid-’90s.

In that light, what’s the last thing the internet needs right now?

Yep, you guessed it…

If you want a free trial to the most widely read legal takes in digital media, click here!

Protecting Children = Age Verification(?)

Just this week, the United Kingdom announced a social media ban for children under 16. In a nutshell, UK policymakers saw that Australia’s relatively milquetoast social media ban has been largely ineffective to date. And in their wisdom, the UK opted to double down, apparently concluding that the real issue was that the age verification measures used by the Aussies weren’t quite stringent enough.

I’m not here to dismiss the concerns about protecting children, but I am here to tell you this: Ensuring that nobody gets to use the internet anonymously is not the solution if:

• We’re hoping to limit data breaches leading to identity theft,

• We aim to raise kids to be educated, internet-savvy adults,

• We want to foster free expression,

• We don’t want the internet to be mostly used as a tool of repression.

I rail against Big Tech as much as anyone in digital media. Overall, I don’t think those companies are doing nearly enough to protect children (or adults, for that matter).

Nonetheless, I am amazed by the number of people whose opinions I respect who think that the UK, Australia, or any of the age verification solutions being pushed is onto a good idea.

The ACLU Pizza Video

In July 2004, the ACLU released one of the best pieces of advocacy I’ve ever seen. The ACLU “Scary Pizza” video is a dramatization depicting a pizza parlor employee leveraging a private-public surveillance database to refuse a customer's order based on the customer’s purchasing history, credit card limits, and health records.

Check out the ACLU pizza video here. I’ll wait…

Over the years, I’ve used the ACLU video as my litmus test to see how close our society has moved to a surveillance state. If you ask me, we’re already closer to that world than many of us would care to admit.

If we’re looking to get closer to a world where the government controls what we see and judges us by who we associate with, age verification is a good place to start.

The one thing I can say with confidence? Age verification almost certainly won’t protect children.

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Marketecture Live Early Bird Pricing Has Landed!

This fall, Marketecture Live is headed to the heart of ad land: Chicago. The Windy City serves as the industry epicenter for some of the biggest shifts happening across brands, agencies, media, and tech. If you’ve been wanting to attend Marketecture Live but couldn’t make the trip to NYC, meet us in Chicago on Sept. 23.

Attendance is free for qualified brands and agencies, and early bird pricing ends soon for everyone else. Lock in your seat and the lowest price of the season today.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I sit down with journalist and entrepreneur John Battelle. From programmatic advertising to platform control, John and I explore who will ultimately control the next era of digital ads space—and part of the reason is infrastructure. 

Robert Moses: He Who Builds the Roads Makes the Rules

Editor’s Note: This article builds on some points I made in front of the ads privacy community in Washington, DC, a few weeks ago at the NAI Summit. I believe that the ads business community would be well served by embracing some of these lessons. If you’re too lazy to read what’s below, a video of the presentation can be found here.

Robert Moses (1888–1981) was a highly influential and controversial urban planner who designed the New York metropolitan landscape in his own image. Known as the "master builder," he reshaped the region with massive infrastructure projects—including highways, bridges, and parks—while often displacing low-income and minority communities to realize his grand vision.

He never held elected office. Yet for roughly 40 years, from the late 1920s through the late 1960s, Robert Moses ran New York. He simultaneously held something like 12 appointed positions: Parks Commissioner, Chairman of the Triborough Bridge and Tunnel Authority, head of the State Power Commission.

So what did he build? Jones Beach. The Triborough bridge. The Verrazzano bridge. The Cross Bronx Expressway. Lincoln Center. The 1964 World's Fair.

Moses built roughly 658 playgrounds, 416 miles of parkway, and 13 bridges. If you have driven, walked, or swum anywhere in metropolitan New York, you have almost certainly moved through Robert Moses's imagination.

Moses understood something most of his contemporaries did not. He understood that infrastructure is policy. The shape of a road is a law. The height of a bridge is a regulation. And he used that insight to carry out his own vision for New York.

According to the legends, the most infamous example of using infrastructure as policy was the plan to build the Southern State Parkway out to Jones Beach. Moses designed the overpasses on that parkway to sit roughly nine feet off the ground. Cars could pass underneath. Public buses could not. And in the New York of that era, guess who rode public buses to the beach? Working-class families… and people of color.

Robert Moses didn't have to write a segregation statute. He poured one in concrete. On some level, the bridge itself was the rule.

Why the History Lesson?

I’m sharing this piece of history because it is easy to forget that the internet is still being built. And whether we acknowledge it or not, somebody is choosing the height of the bridges—and making a determination regarding who gets to pass through.

Let this serve as a reminder of how important it is to be in the room as building decisions are being made.

Get smart about privacy and regulatory issues. Click here for a free trial.

Privacy Laws Are Regulating the Internet of a Bygone Era

I believe it is fair and potentially helpful to have a clear look at the way the internet is being regulated today. And ask the question: What is it that those rules are designed to address?

In my view, much of our current privacy ruleset was designed to create friction for data brokers and ad techs. That approach had a logic to it at one point in time. But it also produced a side effect: It under-regulated first-party processing. In 2010, a big first party was The New York Times. In 2026, a big first party is a company that operates an OS, a browser, a search engine, an app store, and an LLM—and processes your data across all of them.

The bridges that were poured back then might have been the right height for that era. They are not the right height for the traffic of 2026.

I’ve certainly made these points before. But what’s noteworthy is that others—even lawmakers—are making similar arguments. There’s no point in creating privacy laws if they are so watered down that they don’t address the most significant privacy harms.

Standards Bodies and Trades at Risk of Capture

I'm not here to call out any organization in particular. But I'll say this. When a standards body decides what a "privacy-enhancing technology" is, it is making a Robert Moses decision. That standards body is, in effect, setting the height of the bridge. And when the engineers in the room overwhelmingly draw paychecks from a small group of companies, the bridges being built tend to come in at a height those platforms can comfortably clear.

As I’ve noted elsewhere, too many "privacy-enhancing technologies" are vaguely defined and don’t map well to legal requirements or consumer expectations. And the cost of all this is paid in transparency. The ad tech industry's original sin is a transparency deficit. PETs that move processing into black boxes do not cure that deficit. If anything, they deepen it.

Agentic Advertising Is the Next Road Being Paved

When an AI agent books your flight, fills your shopping cart, or chooses which insurance quote to surface, that agent is making a media decision. And as agentic systems and processes are being created to enable the creation of a campaign on the open web, there are decisions being made. Somebody is going to define the protocols by which agents discover ad opportunities, evaluate them, and transact. Somebody is going to decide whether agents see the open web's inventory.

As we are reinventing a whole bunch of commercial relationships through agentic, we are, on some level, rebuilding the Southern State Parkway. And we’re making a decision as to whether the buses driven by many within independent ad tech are able to get to Jones Beach.

The Paradox of Ad Tech

So there's an interesting paradox in play here. How do we craft policy that does not exclude third-party ad tech from the future internet, but also does not incentivize or even enable ad tech to operate as pirates?

That is the needle we're trying to thread here. We need rules that are not designed to quietly disqualify the independent ecosystem. But we also need to create incentives for individual actors to do what's right.

I am not here to plead for exemption for ad techs. I'm here to challenge the folks in the ads space to be the most credible, most thoughtful, most auditable participants in the ecosystem so that we continue to have the credibility to push others to do the same.

Tony Katsur’s gym membership analogy is well taken. But also, every standard, every protocol, every PET specification that gets written without the third-party ad tech community in the room is a bridge built nine feet off the ground. We can complain about the buses that don't fit. Or we can show up to the planning meeting.

Ad Tech Isn’t Only About Roads. It’s About Relationships

Relationships are important. Knowing who your friends are is critical. Your friends aren’t just those who invite you to the best parties in Cannes. Your real friends are those who are willing to invest in an open, inclusive ecosystem.

_______________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Marketecture Live Early Bird Pricing Has Landed!

This fall, Marketecture Live is headed to the beating heart of ad land: Chicago. The windy city serves as the industry epicenter for some of the biggest shifts happening across brands, agencies, media, and tech. If you’ve been wanting to attend Marketecture Live but couldn’t make the trip to NYC, meet us in Chicago on September 23. Lock in your seat and the lowest price of the season today.

Sign up for Hot Takes at Cannes 2026!

Think you’ve got a spicy take on where Agentic, CTV, and Commerce are headed next? This is your mic.

IAB Tech Lab + Marketecture Media are teaming up to bring the industry’s boldest marketing predictions to the Croisette in 2 minutes or less on Wednesday, June 24, from 10 a.m. - 1 p.m.

We’re looking for brand, agency, and marketing leaders ready to share sharp, unfiltered opinions and predictions with the industry.

Fill out the form linked below to get started.

Register now 

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Jean-Paul Schmetz, Chief of Search and Ads at the Brave browser. We discuss privacy, ad blocking, and publisher fortunes (or lack thereof).

There are at least a few engineers who need to see this message.

Wait, Another Damn Sandbox Article?

I know, I know. Nobody wants to talk about the Privacy Sandbox anymore.

Google walked away from cookie deprecation in April 2025, and most of the industry has moved on to talking about agentic AI. And this week in particular, everyone is preparing for Cannes and pre-gaming for the ceremony where LiveRamp’s data magically turns into first-party data now that it’s part of an agency holdco.

I recognize that this might be, as the boomers say, harshing your mellow.

In my view, some new research from Garrett Johnson and his colleagues at the BU Questrom School of Business deserves attention — not because the Sandbox itself matters anymore, but because it offers the cleanest published overview to date of how privacy-enhancing technologies (PETs) are designed, marketed, and ultimately measured.

What’s a Privacy-Enhancing Technology?

Privacy-enhancing technologies (PETs) are a category of tools, cryptographic methods, and architectural frameworks designed to safeguard personal data throughout its lifecycle. They allow organizations and individuals to collect, share, and analyze sensitive information without exposing the raw data, minimizing privacy risks while preserving data utility.

In the ads space, PETs can be helpful so long as they are designed with clear goals. I’ve covered PETs in connection with browsers, clean rooms, attribution, and measurement. This begs the question: What else do you have to say about PETs?

This newly peer-reviewed research from Questrom provides a great example of the limits of PETs.

Background on the Questrom Research

The researchers partnered with Raptive to analyze 200 million ad impressions served to Chrome users in August 2024. They leveraged the CMA-Google open field experiment, which randomly assigned Chrome users into three buckets:

1. Status Quo (third-party cookies enabled)

2. Privacy Sandbox (Sandbox APIs active, cookies disabled)

3. Cookieless (Sandbox and cookies disabled)

Here are the headlines. I’m over simplifying a bit, and I’d encourage you to read the study for yourself to get the full details.

• Third-party cookie removal hurt pub revenues: Removing third-party cookies reduced publisher revenue by 29.1%.

• Sandbox revenue recovery: no bueno: Privacy Sandbox recovered only 4.2% of the revenue lost from cookie deprecation.

• Privacy Sandbox also increased ad latency materially: The 75th percentile latency under Sandbox was 5.64 seconds, more than double the 2.24 seconds in Status Quo. Impressions sold via the Protected Audience API showed 75th percentile latency of 7.89 seconds. Sandbox latency caused 2.9% of impression opportunities to go unsold, partially offsetting whatever modest revenue gains per-impression the APIs delivered.

All due respect to Google, but these results are very different from what the Privacy Sandbox team had promised (or at least strongly implied) while the Sandbox was being built. I’m not trying to beat anyone over the head, but I hope that we can all learn a few things from this adventure.

PETs must, must, must be tied to specific outcomes

Simply offering a high-level platitude such as “building a better web” isn’t a viable north star. Anyone creating PETs needs to design them for specific goals. For example:

• Does the PET map to a valid legal basis under EU data protection law?

• Does the the PET satisfy the sale/share requirements under CCPA?

• Does the PET address specific consumer concerns about tracking?

• Is the PET auditable by independent third-party researchers?

In too many cases, PETs within the ads space are not tied to any of the above.

Transparency is (or should be) the most important component of any PET used in the ads space. And to Google’s credit, it was willing to provide the data here (with the help of the UK CMA). But imagine if we didn’t have this underlying data. Then, we’d be forced to trust the narrative coming from the Privacy Sandbox team.

And that’s why I believe that privacy without transparency isn’t a viable solution.

___________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

We’ve created spaces designed to transform your message into assets that leave an impact long after the Croisette clears out. Reach out to secure your spot.

Activate with Marketecture Media at Cannes Lions

Marketecture Media is back at Cannes, and this year, we’re doing even more!

From our signature hosted dinners to our Hot Yachts series, 1:1 interviews, and our always-on content studio, we create the content and gatherings where the advertising industry comes together.

Want to work with us? Click the button below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

On the latest Monopoly Report podcast, I welcome Don Marti to discuss the Attribution Cartel, a group of large companies and browsers working within the W3C that Don believes are attempting to use privacy standards to dictate who gets access to the critical data that helps advertisers determine whether their campaigns are working.

How Depeche Mode was totally right about the impact of U.S. privacy law

Why Are We Focused on Agentic?

What’s the purpose of our industry’s move to agentic advertising? If I put 10 of you into a room, I might get 10 different answers. Some are using this as an opportunity to fix all (or at least some) of what’s wrong with the ads space. Many view agentic as a way to upend the power dynamic as it currently exists within independent adtech.

If you read the trades, the goal of these frameworks is to establish a shared, open-source technical standard that allows AI agents—built by different companies—to autonomously negotiate, plan, and buy media across the digital advertising ecosystem.

While I don’t disagree with the above, I think it might understate the practical goal: allowing the independent ads space (adtechs, publishers) to compete with the walled gardens for ad dollars. On some level, we’re creating all of this to make it just as easy for advertisers to spend dollars on independent digital media as it is to spend on Meta and Google. To that end, we’re looking to shift the process from manual tasks to autonomous, proactive, and continuous optimization.

That said, any gains in efficiency from agentic are undercut by the following two forces:

1. Big Tech and browsers continuing to own attribution

2. The current physics underpinning privacy law, particularly in the U.S.

Don Marti and I touch on the first force in this week’s Monopoly Report pod. Today, I’m focusing on the second.

Privacy Law Strikes Again?

I recognize that you’re probably thinking to yourself: “Great. So the privacy guy says that privacy law will limit our move to agentic.”

I recognize how the above might come off, but bear with me a minute. Privacy law as it pertains to the ads space focuses almost entirely on creating friction around interoperability and (perversely) creating incentives around ownership of the entire data flow (where there is almost no friction). So, if the goal for agentic is to be just as easy to buy as the walled gardens, this poses a challenge to those of us in the independent ads space.

Twenty-five companies are much smarter than you are about how the ads space is shifting. Want to catch up? Visit ChapellReport.substack.com.

When Privacy Laws Incentivize Consolidation

I recently came across a research paper from MIT Sloan that touches on what might be viewed as an inconvenient truth about privacy laws. Specifically, privacy rules designed to protect consumers can simultaneously accelerate the consolidation of the very industry those rules target. This paper, authored by Rozhina Ghanavi, Sepideh Hosseini, and Catherine Tucker, examines how the California Consumer Privacy Act (CCPA) reshaped merger and acquisition activity across the digital advertising ecosystem between 2018 and 2022.

I’ve touched on a very similar issue before on these pages. I’m certainly not looking to pick a fight, as I’ll be seeing Tom Kemp and his colleagues from CalPrivacy at next week’s NAI Summit in Washington, D.C. But the ruleset created under the CCPA provides as good example of this as anything.

The CCPA was designed to achieve the following goals:

1. Create friction for data brokers (which also negatively impacts interoperability within the digital ads world);

2. Enable data subjects to see, delete, and opt-out from certain uses of data; and

3. Force data flows involving personal information to be more transparent and auditable.

While these are certainly legitimate and perhaps even laudable goals, it’s worth noting that these same rules create a perverse set of incentives for companies to own as much of the adtech stack as possible.

Examples of How This Manifests Under Privacy Law

Let’s say that I own an app that collects precise location data and want to use it to target ads. I’ll need to work with an SSP that will in turn partner with one or more DSPs. But my transfer of this data to the SSP – and the subsequent transfer to a DSP – are likely to be considered a sale of sensitive data under CCPA and most state privacy laws.

Wearing my privacy hat, my response might be to partner with a data clean room. However, the way that CCPA is currently written, it’s not really clear whether the transfer of this data to the clean room counts as a sale. So as crazy as this might sound, the most viable compliance approach is to acquire or get acquired. If I own both the SSP and the DSP, then the transfer of this data doesn’t count as a sale. In fact, the data flow is barely regulated at all under state privacy laws.

If you’re like me, and have general concerns about the use of precise location within the ads space, the above example certainly doesn’t assuage those concerns.

The irony is that the CPRA ballot initiatives were sold to California voters as a promise to contain Big Tech, while the actual ruleset created by that ballot initiative arguably serves to further perpetuate Big Tech.

What Is the Solution?

I’m not sure there is an actual solution. And to be clear: I’m not saying that agentic can’t help reduce a good deal of the business friction that currently impacts the programmatic ads space. But will agentic reduce the regulatory friction? I’m not sure.

Here are some potential solutions, but none are either easy or simple:

• Lobby Congress (LOL): One can certainly lobby the federal government to pre-empt the state laws geared to address a 2010 problem in favor of a federal law geared to address the current privacy problem. But there’s an obvious problem to this approach. Big Tech has thousands of lobbyists on the payroll to varying degrees. By way of comparison, third-party adtechs have the NAI. Also, the initial draft of the SECURE Act that just came out of the House Commerce Committee has a similar approach as CCPA in that it basically exempts first-party data.

• Providing feedback to the CalPrivacy folks: To their credit, Tom Kemp and his colleagues are out there talking to the ad industry and are certainly asking for public comment as they create new rules. But this type of change would require a complete rethinking of the CCPA; I’m not even sure if the CPPA currently has the legal authority to make these types of changes.

• Get other states to recognize and address this problem: We could try to work within select state governments. But they have a similar challenge as California.

• Change the approach of agentic around data use: Is there a way to restructure the way that data gets leveraged via agentic? The challenge we’re up against is that the definitions of sale or share within U.S. state privacy laws are extremely broad. I don’t believe that the use of vector embeddings pulls adtech data flows outside of the definition of personal information or the ruleset of state law.

• Go big: Make every company in the programmatic ads space a subsidiary of Chapell Labs so that the data flows aren’t counted as a sale/share. I’ll of course extract a small cut for my troubles. Sound crazy? Maybe. But that’s pretty much what Google tried to do with the Sandbox. And if we’re being honest, this idea wouldn’t even make the top 10 list of crazy public policy or regulatory ideas in 2026.

If only my last name began with a “T”…

_____________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Activate with Marketecture Media at Cannes Lions

Marketecture Media is back at Cannes, and this year, we’re doing even more!

From our signature hosted dinners to our Hot Yachts series, 1:1 interviews, and our always-on content studio, we create the content and gatherings where the advertising industry comes together.

Want to work with us? Click the button below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, we’ve published Alan’s fireside chat with FTC Commissioner Mark Meador at Marketecture Live. This is a must-listen interview if you’re looking to better understand how the FTC is looking at privacy and competition in the ads space.

There ain’t no casino like the ads casino.

$100 Billion in Advertising Revenue by 2030

By now, you’ve probably read the report from Axios that “OpenAI expects to generate $2.5 billion in ad revenue this year and $100 billion by 2030.” Per that report, OpenAI has told investors to expect the following in ad revenues:

• $2.5 billion in 2026

• $11 billion in 2027

• $25 billion in 2028

• $53 billion by 2029

OpenAI would have us believe that it can go from about zero to nearly $2 billion in ad revenue per quarter in somewhere around 18-20 months. That would certainly be an impressive feat — one that means OpenAI has beaten the growth trajectory of a bunch of companies. Here’s a comparison chart.

Anything is possible, but…

The smart folks at eMarketer indicated that OpenAI’s ad goal “doesn’t feel impossible” given that it “only” requires that OpenAI capture “7.7% of the projected $1.3 trillion in global digital ad spend.”

To be clear: My skepticism isn’t based on the share of the ad market that OpenAI might ultimately possess. Rather, I’m focused on the trajectory required. It might be possible, but it would require zero mistakes from OpenAI. You might compare this to the accomplishment of pitching a perfect game in the World Series — except here, the pitcher is still learning how to throw a curveball.

Not to name drop, but even the great AdTechGod might have trouble making it happen on this schedule.

What does OpenAI need to succeed in the ads space?

A few things come to mind:

1. OpenAI will need an extremely laissez faire U.S. Administration so as to ensure that regulation doesn’t get in OpenAI’s way should it need to be more aggressive, such as running ads against sensitive personal info. (BTW, the tone might be very different after the U.S. mid-term elections.)

2. It will need to execute on ads quickly and in a nearly mistake-free way.

3. It will need to make sure that its core offering remains competitive so that it maintains (and ideally grows) its user base.

4. It will need to deftly balance the tension between user expectations and advertiser expectations at a time when neither users nor advertisers are exactly locked into OpenAI.

And it’ll do this without compromising its principles?

You might have seen this post from Fidji Simo of OpenAI that included the following statements in connection with the launch of the OpenAI advertising solution:

• “Ads do not influence the answers ChatGPT gives you.”

• “We keep your conversations with ChatGPT private from advertisers, and we never sell your data to advertisers.”

I’m under no illusion that the above constitutes an actual promise from OpenAI. And I’m fairly confident that if/when we look back on Fidji Simo’s statements a decade from now, we’ll see that OpenAI transitioned away from the above principles.

But OpenAI has a bit of a trajectory issue here as well. Enshittification takes time — and generally only works after users and businesses are locked into a particular service.

By way of comparison, Google took over a quarter century to evolve its north star from being mostly user focused (i.e., “don’t be evil”) to being mostly Google focused (i.e., always do what’s best for Google). And Google mostly evolved long after users, advertising, and publishers were locked in.

OpenAI needs to move fast — and it needs to accomplish all of this prior any of its core constituencies being locked in. That’s the core problem for OpenAI.

Get smart about regulatory strategy - CLICK HERE for a trial subscription!

Are these goals all just a distraction?

Just a few weeks ago, it seemed like many were characterizing OpenAI as a company in financial peril. Here was the snapshot as of mid-February 2026:

• Rumors of a maneuver toward an eventual request for a U.S. government bailout

• Mounting evidence that OpenAI no longer has a technical lead over its rivals like Google (as signaled by Sam Altman’s code red in 2025)

• Rumors that OpenAI’s deal with Nvidia stalled (as did its subscriber growth)

• Investments from both Microsoft and Nvidia under scrutiny as the companies appear over-reliant on each other

• Deutsche Bank estimate of $143 billion in cumulative negative cash flow before the company turns profitable

• OpenAI's paying subscribers represent just 5-6% of its user base, which is forcing the company to explore additional revenue sources

• George Nobel’s observation that the company might be “FALLING APART IN REAL TIME”

I’m not sure that the financial picture is much rosier now that we’re into Q2 of 2026. Perhaps this is all just an attempt to change the conversation.

How does this all play out?

OpenAI is bleeding money. Smart folks on the investment side are already pointing to signs that the company is on the verge of imploding. In my view, OpenAI has roughly 18 months to create a viable ads business — or at least make enough progress so that investors keep putting money in.

But OpenAI has a “cold start” problem. It takes time to scale an ads business starting from scratch. It’ll make mistakes. It won’t always hire the right people. And it’ll be under pressure from advertisers to be far less user centric in its approach to ads. And it’ll need to remain competitive with Anthropic and others so it doesn’t further lose market share.

I’m not saying it’s impossible. But holy hell, that’s a big ask.

____________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out on LinkedIn or in the comments below.

Miami, get ready. We’re bringing the heat.

For the third straight year, Marketecture Media is heading back to POSSIBLE, and we’re showing up bigger, louder, and more dialed in than ever.

We’re coming to capture the moments that matter by filming powerful conversations and creating the kind of content that keeps the industry talking long after the Miami sun sets. 

This year we’re recording high-impact interviews on site, hosting curated gatherings with the right people in the room, and yes, the AdTechGod event is back!

If you want to plug into the energy and partner with us at POSSIBLE, drop your info in the form in the comments.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report. A warm thank you to everyone who came out to London last week to see my morning keynote at Prebid Ascent. 

The latest Monopoly Report podcast is out! This week, I welcome Mark Naples of WIT Strategy. We discuss how ad tech self-regulation really works—and what it misses. Check out the podcast here.

Browsers aren’t quite this obvious about it, but this example is closer to home than some want to admit.

GPC is anti-competitive and also the future of the ads space.

That’s admittedly a strong statement. Before I even attempt to back it up, you might be wondering: What in the world is the Global Privacy Control (GPC)?

The GPC is an opt-out choice tool that enables a user to indicate that they don’t want to be tracked, targeted, or profiled. Several state privacy laws require that those of us operating in the ads space respect these signals as valid opt-out requests. In some states, including California, GPC signals also stop the sale and share of data as well as any automated decision-making tech. So that when we see the GPC signal in an adtech data flow, we need to treat the applicable user as having opted out of all of these aforementioned activities.

Yep. GPC is a powerful tool, but one that hasn’t gotten enough attention to date. Why? Well, mostly because we just don’t see too many GPC signals out there in the wild as of today.

GPC is hard to find due to lack of support from browsers.

For better or worse, the major browsers don’t currently support the GPC signal. So as of today, the only way you might see these GPC signals is if you happen to encounter a user who has downloaded a special Chrome plugin or uses a browser that does support GPC, such as DuckDuckGo, Brave, or Firefox.

Today, you’d be hard pressed to find someone using Chrome or Safari or Edge with the GPC signal enacted.

But all that is changing starting in January 2027, thanks to the California Opt-Me Out Act. And once browsers are required to provide GPC functionality to users, it’s not exactly a stretch to see California or some other state push mobile or CTV O/S providers to offer the same type of opt-out functionality.

In other words, GPC is the future of privacy in the ads space.

Is GPC friend or foe to the ads space?

If I’m being honest, the above question is a bit beside the point. We need to honor these signals as per any number of U.S. state privacy laws (not that I’m providing legal advice here).

Personally, I think the GPC signal helps address some of the biggest problems in the ads privacy space. For example:

• Cookie-based opt-outs are broken: Cookies don’t persist, they are clunky, and I’m kind of amazed that nobody in the ads space has been hit with an unfair or deceptive regulatory claim in connection with their use.

• Hashed email opt-outs have their own tradeoffs and challenges: For one thing, being in possession of hashed email addresses (and phone numbers) creates operational challenges in connection with consumer DSAR requests.

• Privacy controls in mobile and CTV worlds aren’t much better: I’ve been pretty vocal that the privacy controls in mobile are pretty crappy these days due in part to the fallout from Apple ATT. And the CTV space has its own endemic issues with privacy choices. As noted above, California law will require browsers to support GPC starting in January 2027. There is at least a chance that the mobile and CTV O/S could face similar requirements. And having those in place would help the ads space address one of the more glaring structural privacy issues.

But if you sense a big “however” coming, you are correct.

Over 25 of your competitors are currently subscribing to The Chapell Regulatory Insider.

Why is GPC potentially anti-competitive?

Everyone’s gotta eat, including people who work at the browsers. There’s nothing wrong with that. But nobody in this space should get to quash someone else’s business in order to prop up their own. It’s probably worth noting that Mozilla has a long history of keeping privacy signals off by default. But we can’t count on other browsers to follow Mozilla’s lead.

My fear is that GPC will be used by browsers in the same way as do-not-track (DNT) was intended to be used — to favor one type of business over another under the guise of privacy. There’s a real risk that browsers could use GPC as a privacy cudgel and/or turn GPC on by default in order to stand-up the browsers’ own ad businesses.

If you think the above scenario is speculative or unlikely, I’d respectfully suggest that you haven’t paid attention to the ads space over the past several years.

In any event, check out the state of play in the browser world right now:

• Advertising is a critical monetization path for most browsers.

• Most major browsers are owned by Big Tech companies that have their own interests, and many of them are working collectively in groups such as the W3C in an attempt to exert even more control over the ads space.

• Many browser companies view their browser as less a user agent and more a piece of software they (and only they) get to monetize.

• Some browsers routinely engage in IP warfare (if not theft) by blocking or erasing publisher-controlled ads and replacing them with their own ads.

If you sat in on my fireside chat with FTC Commissioner Meador at Marketecture Live, you might recall that the Commissioner also flagged a concern when privacy becomes a pretext to lock up the browser market or access to critical data.

Other states have recognized the potential impact.

And it’s not just the FTC that recognizes the potential anti-competitive impact. Other states have already crafted anti-preferencing measures in their privacy laws. Two examples:

• Colorado: The Colorado AG’s office has crafted a set of regulations in connection to what it considers a valid opt-out request. Those regulations state that “Universal Opt-Out Mechanism may not be the default setting for a tool that comes pre-installed with a device, such as a browser or operating system.”

• Connecticut: Connecticut’s privacy law also doesn’t allow GPC or other online preference signals to be turned on by default. But it goes even further and states that these signals can’t unfairly disadvantage another controller. (PS: Let’s go Huskies!)

To be clear, GPC signals aren’t anti-competitive in Connecticut or Colorado, as the regulators there have put guardrails into place. What say you, California?

Privacy advocates love GPC.

Some privacy advocates have historically taken the position that anything that reduces “tracking” is a net positive, regardless of any downstream consequences. I believe that position to be short-sighted in that it creates incentives for the creation a cartel of large companies that collect data at the expense of smaller companies. I attempted to make this point in a recent TMR podcast discussion I had with Alan Butler of the advocacy group EPIC in connection with Apple ATT.

While I can understand this type of sentiment coming from privacy advocates, I don’t think that mindset is at all productive in connection with operating a regulatory agency - particularly an agency that came into existence promising to contain Big Tech.

I’m hopeful that CalPrivacy will view anti-preferencing and default setting measures as a part of its mandate to reign in Big Tech. But I also think we need more voices in this choir if we’re going to ensure that this message is truly heard.

Here’s my ask.

CalPrivacy is seeking public comment as it looks to create “new regulations that reduce friction in the exercise of privacy rights, or comment on how consumers use opt-out preference signals and how businesses process opt-out preference signals [like GPC]”.

Have your voice heard. Provide comments to CalPrivacy.

Or live with the consequences of doing nothing.

____________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Miami, get ready. We’re bringing the heat.

For the third straight year, Marketecture Media is heading back to POSSIBLE, and we’re showing up bigger, louder, and more dialed in than ever.

We’re coming to capture the moments that matter by filming powerful conversations and creating the kind of content that keeps the industry talking long after the Miami sun sets. 

This year we’re recording high-impact interviews on site, hosting curated gatherings with the right people in the room, and yes, the AdTechGod event is back!

If you want to plug into the energy and partner with us at POSSIBLE, drop your info in the form in the comments.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies, and I write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome Tony Katsur of IAB Techlab. Tony and I talk about the current state of the agentic ads space as well as AI content marketplaces.

When making a DSAR request feels like an afternoon renewing your driver’s license at the DMV

Editor’s Note: I was all set to do a quick recap of my fireside chat last week at Marketecture Live with FTC Commissioner Mark Meador. And then Allison Schiff from AdExchanger beat me to it with her fantastic take on the session. I can’t top what Allison wrote, so I’ll just share that I’m delighted to have Allison as my guest on the Monopoly Report podcast next week.

I accidentally signed up with a DSAR authorized agent

In early February, I started seeing deletion requests from an “authorized agent” called the Data Broker Buster, a new tool offered by a cybersecurity firm called CIS Labs. As you may know, an authorized agent is a company that makes data deletion and opt-out requests (DSARs) on behalf of data subjects.

I noticed that requests coming from Data Broker Buster routinely cited both the CCPA and the GDPR as obligating the data broker to honor their deletion and opt-out requests. But I also noticed that none of the requests they facilitated were coming from data subjects who were located in either Europe or California. So, I wanted to have a closer look at Data Broker Buster.

To that end, I began the process to sign-up for the Data Broker Buster via the pseudonym “Billy Martin” – a tribute to the late manager of the NY Yankees.

I was more curious to see how much CIS Labs would charge for its service. So, I provided my personal information (well, Billy’s personal info) as a test and hit “complete,” thinking that I’d next be taken to a payment screen.

Bless their heart, it turns out that Data Broker Buster is a free service. So my hitting the “complete” button didn’t take me to a payment screen. Rather, hitting complete started the process where “Billy Martin” sent out deletion and opt-out requests (DSARs) to 700+ data brokers.

And over the next couple of weeks, I started receiving responses.

My take on many of these responses? To quote one of my favorite cartoon characters from the ‘80s: “Ack! Thppt!” The responses were all over the map, and many of them were really, really bad. It’s almost as if certain data brokers managed to recreate the experience of renewing my driver’s license at the DMV. (Hence, the picture.)

How to get fined by CalPrivacy in one easy step

I typically try to keep things high level and strategic over here at The Monopoly Report newsletter. But these types of issues strike me as both prevalent and problematic enough that it was worth mentioning on these pages.

Having a crappy process for honoring DSAR requests is not only a way to get your company in hot water with regulators, but it also undermines the credibility of industry leaders when we interact with those policymakers. For example, I can’t earnestly complain to Tom Kemp at CalPrivacy that authorized agents are not playing fair with adtech companies when so many adtechs don’t seem to have their DSAR houses in order.

And regulators might be the least of their problems:

• How many of these data brokers have executed contracts promising to honor DSARs in good faith?

• How many of them have attested to such compliance as part of an agency RFP process?

Folks: That’s a lot of liability being assumed in connection to something that very clearly isn’t a collective priority.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

What are some of the issues?

I want to note that the adtech community represents almost one-third of the California registered data brokers (depending on how many of the location graph companies count as adtechs). That’s not the majority of the data brokers, but it’s also not nothing. Anyway, see below for a partial list:

• DSAR responses that don’t use actual English sentences.

• Responses that impose arbitrary or incorrect restrictions on who gets to make DSAR requests or the timelines for making them.

• Responses indicating that a data subject’s request didn't honor section 125.5(a)(4) of the data broker’s privacy policy, without the courtesy of providing a link to the privacy policy or explaining the violation.

• Requesting information that shouldn’t be necessary to process the DSAR or information that was previously provided.

I recognize that most adtech companies don’t process identifiable personal data. There are certainly challenges to honoring DSARs. BlueKai tried to do it 15 year ago. It wasn’t perfect, but it’s a shame that nobody’s come up with a better iteration in all those years.

Making Enforcement Easy

I often refer to “broken taillight” offenses – the type of things that regulators can spot from a mile away and prompt them to “pull your company over” for a closer look. Going through this exercise took me less than an hour, and I lost count at 50 data brokers that would merit a closer look just based on the data brokers’ responses.

Sooner or later, the CalPrivacy folks or other state privacy regulators (or maybe the FTC) will start looking at these responses with a critical eye. And in my view, they won’t have much trouble finding violations.

It’s not that difficult to fix

In my travels, I’ve learned that there are certain things that are broken because the problem is too difficult. There are some things that are broken due to neglect.

The fix here is straightforward: Have someone outside your legal and privacy team submit a request through your own DSAR process. Then read the response you receive. If it confuses you, it will confuse a regulator. And then fix it!

All this requires is someone giving a damn.

_________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Miami, get ready. We’re bringing the heat.

For the third straight year, Marketecture Media is heading back to POSSIBLE, and we’re showing up bigger, louder, and more dialed in than ever.

We’re coming to capture the moments that matter by filming powerful conversations and creating the kind of content that keeps the industry talking long after the Miami sun sets. 

This year we’re recording high-impact interviews on site, hosting curated gatherings with the right people in the room, and yes, the AdTechGod event is back!

If you want to plug into the energy and partner with us at POSSIBLE, drop your info in the form in the comments.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated insights report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

This week, I welcome Ben Isaacson to The Monopoly Report Podcast to discuss California’s data broker registry - and how the definition of data broker is much broader than many in the ads space might think. When everything is an ad network, everyone is a data broker.

This is what a “compliance gap” looks like to privacy and legal folks…

Editor’s note: I’m writing this as I fly out to San Francisco for RampUp to talk about privacy within the agentic space (among other topics). Stop by and say hello if you’re out there. And if you can’t make it to San Fran, I hope you make it out to Marketecture Live next week, where I’ll be doing a fireside chat with Commissioner Mark Meador of the U.S. Federal Trade Commission. Get ready: I’ve got a few grenades I’m planning to throw into the room.

What agentic is currently missing

With all the energy around agentic right now, a good deal of the conventional wisdom is that agentic is going to fix a lot of the misaligned incentives and other challenges inherent in the ads space… almost as if by magic. I’m hearing those types of claims from lots of senior leaders in this space, often from people who should know better.

Anyway, the thing that gets me excited about the move to agentic is that it poses a real opportunity to fix some of what’s broken about the ads space. Whether we’re able to get there is an open question, as I sometimes question our collective desire to move beyond some of the endemic opacity and grift.

While I can’t fix everything, I wanted to at least share a vision for addressing some of the open privacy issues. For example, it would be extremely helpful if we could ascertain the following more consistently:

1. Was a privacy policy presented that describes the agreed-upon data use cases?

2. Is the contemplated data flow aligned with the actual data flow?

3. Are consumer choice signals such as the GPC being respected?

4. Is the targeting technique used benign when it comes to privacy and intellectual property rights?

5. Does the ad or data flow trigger some flavor of special treatment (e.g., alcohol, politics) or are known children viewing the ad?

We’ve come a long way over the years. But equally, we need to be able to answer these types of questions more consistently, and much more quickly.

How selecting data vendors works today: whitelisting

Let’s look at data relationships today. In many use cases today, the process is very salesperson driven. Not that this is necessarily a bad thing. Some of my favorite people are data salespeople.

But the process involves a fair amount of work on the front end that is designed to create a whitelist of good data vendors. Don’t get me wrong: That type of approach can be helpful. And it’s far better than where the industry stood just a few years ago.

But if one of the goals of agentic is to increase speed and efficiency, the current process of having a salesperson reach out to you, selling you on the fact that their data is great and assuring you of their vetting process — well, that might not be as efficient. It certainly won’t enable you to swap-out data vendors quickly.

But that process also has what I’ll call a compliance gap. There’s no efficient way to meaningfully vet that your data partners are doing the thing(s) that they say they’re doing.

And if you can’t do that… well, then moving at light speed stops being an advantage. In fact, speed can pose a distinct disadvantage.

And this doesn’t just apply to data vendors. It arguably applies up and down the adtech vendor chain.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

Using agentic to know that your data partners are solid

Regardless of whatever agentic framework you’re using, it’s going to be more important than ever to have confidence in the data partners you use, both when evaluating their quality and when vetting them re: privacy compliance.

The agentic ads space will need to be able to make vetting and compliance decisions much more quickly than they are currently being made. As a result, I believe we’ll need a whole boatload of compliance inputs available in real time if we want to have any hope of addressing privacy concerns going forward.

This is just a starting point, but here is my initial list of inputs:

• Self-regulatory status: You may be thinking — wait! Is self-reg still a thing with all these state privacy laws sprouting up, not to mention the GDPR? The short answer is: It can be. And as board chair of the NAI, I have hope that self-reg will be a major input. But in order for that to happen, self-reg needs to step up its game pretty significantly. The self-regulatory codes of 2015 are not going to cut it in the move to agentic.

• Audits and seal programs: Audits and privacy seal programs have historically been viewed suspiciously in the ads space. Sometimes the audit standards used are viewed as toothless (also an endemic criticism of self-reg). Sometimes the only companies willing to undergo the audit are those who have the biggest trust issues. But the biggest issue is that companies don’t want to pay the required costs or undergo the level of scrutiny required. California seems to have solved that problem for us, as these types of audits become hard requirements soon.

• Whitelisting: I’m including this input here because this is the approach that just about everyone currently uses. Also, I don’t think you can fully replace the value of an effective privacy, data governance, and compliance team. So this should remain part of the mix for the foreseeable future. But please understand me: This approach should be your floor, not your ceiling.

• Attestation tools: All credit to Richy Glassberg and his team at SafeGuard Privacy, as his company has taken a leadership position in the ads privacy community. But if the goal here is to design a tool to vet the accuracy of claims being made, providing a restatement of those claims via an attestation platform is only going to take one so far. So, this is another floor that should not be confused as a ceiling.

• Privacy scores: Perhaps the most (at least potentially) efficient tool to vet compliance is to create a privacy rating system. This concept isn’t exactly new. Back in 2009, a former Yahoo! exec named Jim Brock came up with an idea to create a privacy score to rate the various adtech vendors operating at that time. He eventually sold the idea to anti-virus software company AVG. Today, the most closely on point company is Compliant. [Nope - I don’t work with them.] My hope is that at least a few additional direct competitors spring up in that space. Also, if we don’t have transparency in how the privacy scores are compiled and/or if these scores become just another pay to play, they becomes useless pretty quickly.

Are these the right inputs?

If you have thoughts on the above, or if you want to suggest some new ones, please ping me here.

EVENTS

Marketecture Live III

7 Days Until Marketecture Live

The agenda is set, tickets are moving fast, and The Glasshouse is filling up.

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve had the pleasure of serving as outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated business intelligence report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast is out! This week, I welcome AI ethicist and governance pro Shoshana Rosenberg, who describers her framework for addressing the legal and regulatory risks involving AI. Given all the new AI and profiling rules flowing down into the ads space in 2026, Shoshana is exactly the person we should all be listening to right now.

See… it’s all completely on the up and up.

AI Content Marketplaces Are Almost a Great Idea

I recently started taking a closer look at AI content marketplaces as a way to ensure that publishers get paid for their work. And now with Microsoft and Amazon entering the field, the concept seems to be really taking off.

What’s a Content Marketplace?

An AI content marketplace is a platform that connects content creators and publishers with artificial intelligence companies seeking training data or real-time content access. These marketplaces are designed to function as intermediaries, handling the technical, legal, and financial complexities of licensing digital content for AI applications. Ari Paparo went into more detail here and even talked about it on his podcast here.

The current approach of web scraping allows AI companies like OpenAI and Google to access content without compensation, creating economic friction and legal uncertainty around copyright and fair use. AI marketplaces are designed resolve this by providing structured licensing mechanisms.

But here’s the thing: All of this is pretty academic unless there’s a way to compel AI companies to actually pay for content. As of today, most of them ignore robots.txt, and Google uses its market power to force publishers into the Hobson’s choice of giving up traffic or giving up their IP.

Something, Something… Cow’s Milk?

This is a rather obvious statement, but it occurs to me that few are willing to pay for something they can get for free. In that light, resolution of this problem requires one of the following:

1. Collective action: Publisher coalitions refusing Google's bundled terms en masse (lol)

2. Competitive pressure: A viable search alternative that doesn't bundle AI training, forcing Google to change policy (Thanks, Judge Mehta!)

3. Technical solutions: The tools Cloudflare is building are certainly interesting and can no doubt make it more difficult for AI scrapers to collect data. Very helpful for sure. However, those types of tools are only going to take publishers so far. And it seems to me that last thing publishers want is to be in a technical arms race with the richest companies in the world. What’s more, these solutions don’t really address the problem of having the dominant search engine leverage your acceptance of their AI bots as a precondition of your obtaining search traffic.

4. Regulatory intervention: Laws, regulations, or competition enforcement that requires separate permissions for search indexing versus AI training (similar to EU AI Act proposals) would go a long way toward solving this problem.

In my view, the approaches that seem remotely viable today involve some flavor of regulatory intervention to stop or at least slow down the AI companies. I thought it’d be interesting to take a look at some of the options.

As such, we’re back on the Big Tech Regulatory Flywheel, kids!

Editor’s Note: Yeah, I know it’s not nearly as pithy a phrase as “everything is an ad network” or “enshittification”, but the Big Tech Regulatory Flywheel (BTRF) is a pretty damn apt description of where we are these days.

Option 1: U.S. DOJ Antitrust Team

As you may remember, the DOJ’s initial proposed remedies against Google included a requirement that would prohibit Google from merging its search indexing function with its AI indexing function. We all know where that idea went. Maybe the DOJ will attempt to come after Google search again, but it’s difficult to imagine it happening in the near term now that the two people leading the charge over there (Gail Slater and Mark Hamer) are out at the DOJ.

Option 2: UK Competition and Markets Authority

The UK CMA has done a remarkably thorough job of outlining all of the challenges Google is creating in the marketplace. It’s really some great work.

But just as it did with the Privacy Sandbox, the UK CMA has once again given Google the power to dictate the process by which Google addresses the CMA’s competitive concerns (which is great for Google but will severely limit any positive impact to be realized by publishers and other marketplace participants).

For example, the CMA measures with respect to Google’s merging its search index function with its AI index function are designed to create rules for what Google may do with the data after it is collected; they are not designed to allow publishers to prevent Google from collecting the data in the first place.

Why does the UK CMA continue to let Sundar Pinchai and Google drive when it comes to remedies?

Option 3: U.S. Congress

As covered by Digiday, the IAB is floating a Congressional bill designed to give publishers more surface area when combatting AI scrapers. Publishers are mostly limited to copyright law when seeking remedies for scraping. I’d imagine that this type of law would bolster some of the recent lawsuits coming from Penske and others.

Don’t get me wrong: I applaud the effort. But a few thoughts:

1. We are currently in what amounts to a worldwide moratorium on doing anything to slow the momentum of AI companies—an effort being spearheaded by the U.S. In light of that, it’s difficult believe that this Congress is going to push forward this type of law. Thinking otherwise would involve some real Chuck Schumer energy, folks.

2. The bill would still necessitate that publishers engage in expensive litigation, which is something that only the top-tier publishers will have the resources to do effectively.

3. I’ll bet you a nickel that if this law were to pass, it wouldn’t be Google that got dinged; it would be some AI-infused contextual adtech firm.

4. I’d be curious to see a Venn diagram of those who (a) oppose a private right of action for privacy laws and (b) favor this publisher right of action. Cue: Tina Turner (“We don’t need more litigation.”)

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

Option 4: Can the EU Commission Save Publishers?

This past December, the EU Commission announced that it opened a formal antitrust investigation to assess whether Google breached EU competition rules by using the content of web publishers, as well as content uploaded on the online video-sharing platform YouTube, for AI purposes. The investigation will take a look at whether Google is distorting competition by imposing unfair terms and conditions on publishers and content creators, or by granting itself privileged access to such content, thereby placing developers of rival AI models at a disadvantage.

The EU Commission process is still in its early stages, so it’s hard to make many predictions. What’s interesting about this effort is that it also includes YouTube, which raises the possibility of the EU Commission examining the competitive fairness of the relationships that other platforms have with their content creators.

What Are the Other Options?

If you have any ideas, I’m all ears. I’ll be speaking at RampUp (SF), MarketectureLive (NYC), and Prebid Ascent (London) over the next few weeks. Be sure to say hello - or ping me if you want to setup a time to hear about my latest insights…

EVENTS

Marketecture Live III

March 10-11 at The Glasshouse, NYC

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

This week’s Monopoly Report podcast features a discussion with Tom Kemp, Executive Director of CalPrivacy. We talk about the launch of the DROP deletion mechanism in California - and I ask questions seeking to understand the effectiveness of California’s stated policy goals. 

California: Next stop on the Big Tech Regulatory Flywheel?

A few months ago, I wrote an article speculating on the remedies that Judge Brinkema may impose in the DOJ antitrust case against Google. As you might know, I’m not super optimistic about the prospects of a divestiture ruling. In fact, I believe there’s a growing sense within competition circles that U.S. antitrust law is less likely to rein in the practices of big tech in the near term.

I’ve described my frustration with antitrust law’s failure to reign in Big Tech as part of what I refer to as the Big Tech Regulatory Flywheel, which goes as follows:

1. If antitrust courts are unwilling / unable to enforce the law, U.S. Congress must step in and break up Big Tech...

2. Congress is inept at creating law to break up Big Tech, so we turn to the judiciary....

3. The U.S. system is captured by industry... so it’s up to the EU to reign in Big Tech…

4. [Take big swig of tequila…]

5. Rinse / repeat.

But maybe there’s another stop on the flywheel—one that can be more effective. Perhaps California will be able to rein in Big Tech via CCPA, the DELETE Act, etc.

But here’s the question: Is the ruleset in California currently designed to contain Big Tech?

What does CalPrivacy view as the problem it wants to solve?

Last week, I interviewed Tom Kemp, the head of CalPrivacy, on the podcast. Tom is an accomplished entrepreneur and investor. Prior to coming on board as executive director of CalPrivacy in March 2025, Tom was very active as CMO and policy advisor of the group advocating for the California Ballot Initiative that ultimately brought us the CPRA.

In 2023, Tom wrote “Containing Big Tech,” a book that is right up there with other fantastic reads such as “Enshittification” by Cory Doctorow and “The Age of Extraction” by Tim Wu in terms of chronicling and analyzing the myriad ways that Big Tech impacts our lives. Tom’s book methodically walks through a number of the issues raised by Big Tech from the perspective of antitrust, misinformation, threats to democracy, data breaches, and of course, privacy. I started reading the book after speaking with Tom last week.

Tom’s book goes into great detail on how Google did this, how Amazon failed to do that, and how Meta and X are harming the other thing. It outlines a set of problems where the solution is so clear that it’s even stated in the title: “Containing Big Tech.” For the record, I found myself in agreement with many of the issues Tom raised in the book.

Tom’s book doesn’t just outline the problems. It offers solutions—many of which mirror the policy solutions offered by California policymakers since 2019 when it comes to privacy.

What Problem(s) Does the CCPA Address?

So with all the talk about the issues caused by Big Tech, I wondered how the CCPA and similar rules were actually containing Big Tech.

A few things jumped out at me:

1. Data Broker Registry: I couldn’t find a single Big Tech company listed on the California Data Broker registry. I didn’t see Palantir on the list either. I’m not passing judgment on whether any of those companies are violating the law. Rather, I’m saying that addressing the practices of those companies (or not) is a policy choice.

2.  Enforcement: I couldn’t find much in the way of CCPA enforcements against Big Tech. Yes, there was a 2023 settlement between Google and the California AG’s office, but it didn’t directly involve CCPA.

3. Sensitive Data: The CCPA ruleset doesn’t treat sensitive personal information (e.g., ethnicity, precise location, sensitive health) much differently that it does pseudonymous personal data.

I am absolutely not attempting to downplay the great work that CalPrivacy is doing. However, I think it’s worth asking whether CalPrivacy is drawing a straight line between the problems it has identified (i.e., Big Tech and misuse of sensitive data) and the policy solutions it is currently offering.

I hope that changes. Tom and his colleagues have created something that has the potential to make the world significantly better.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

How I’d like to see the ads space evolve

Before I talk about what I think CalPrivacy should do, I want to mention what I think my industry should do. For years, I’ve been pushing companies operating in the ads space to do the following:

1. Stay away from identifiable personal data.

2. Avoid sensitive personal data such as health, known children, and precise location.

3. Adopt data minimization as a core principle.

Most companies in the ads space have for a long time honored the first suggestion. Many have generally honored the second. The third? Well, let’s just say that’s still a work in progress—particularly in the AI era.

How I’d like to see CalPrivacy adapt

CalPrivacy has been granted a great deal of authority by the California Legislature to issue additional regulations, and it regularly uses its voice to push for particular policies. I’d like to see it use that power toward the following ends:

1. Clearly identify the problems you’re attempting to solve and tailor solutions: There’s a good deal of innuendo being used. Entire books are being written to document the various problems, and all roads seem to lead to Big Tech and sensitive data. If CalPrivacy truly believes that Big Tech and sensitive data are at the root of most of these problems, then let’s make that clear. But also, let’s make sure that the solutions being offered are aligned to address those core problems. This isn’t unique to California; I see similar situations occurring a lot in the privacy world.

2. Adopt more of a risk-based approach to rule creation: I certainly understand how consumers want to get a better sense of the sensitive data being collected about them, in part so they can control it. There are no shortage of harms being perpetuated using sensitive personal information. Can you say the same thing about mobile ad IDs and other pseudonymous personal information? I’m not so sure. In that light, it doesn’t make much sense to treat all personal data as effectively the same.

3. Make sure that opt-out choice is implemented fairly: Starting in 2027, browsers will be required by California law to support the GPC signal. We need CalPrivacy to require that the signal is presented fairly (i.e., no ATT-style scare screens) and that the browser doesn’t use these GPC signals to preference their internal advertising programs over the ad solutions of their competitors. We’re in a very different era—one where browsers are often owned by Big Tech companies—and the others are increasingly under monetization pressures. I’m hopeful that CalPrivacy can broker an honest discussion about a clear conflict of interest.

To his credit, Tom told me that the browser issue (and a similar one I raised on the pod re: authorized agents) are on the CalPrivacy agenda for discussion. My advice to the rest of the ads space is this: Make sure your voice gets heard during CalPrivacy’s comment periods to help ensure that these competition issues aren’t swept under the rug.

Is there a reason for hope?

Absolutely. I don’t want it to get lost that there’s a lot of things that CalPrivacy is getting right. Enforcement over there to date has been measured and practical. And CalPrivacy’s work in setting up baseline rules around transparency and choice are super valuable. In my view, the solution being offered just needs to be more closely tethered to the identified problems.

If Tom Kemp and his colleagues at CalPrivacy can do that, California might be the latest (and perhaps final) stop on the big tech regulatory flywheel.

EVENTS

Marketecture Live III

Where the Industry Gets Honest About What’s Next

Join us March 10–11 at The Glasshouse in NYC for a limited-seat event built for leaders looking for what’s next in advertising.

• Brand and marketing leaders looking to stay ahead of consumer shifts and growth channels in 2026 can apply for a complimentary pass.

• Agency executives and strategy and media teams exploring what’s next in planning and creative effectiveness can apply for a complimentary pass.

• Publishers & groups of (3) or more navigating AI disruption and retail media realities receive special rates.

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome antitrust litigator Brendan Benedict. We discuss the civil antitrust lawsuits being filed against Google by publishers and adtech companies.

Michael Stipe and the rest of R.E.M. are probably gonna sue

Our Story Begins Nearly 15 Years Ago

It was the summer of 2012. I was enjoying my August days working out at the East Deck in Montauk when I heard the news that Google had agreed to pay a whopping $22.5 million to the Federal Trade Commission (FTC) to settle charges that it bypassed privacy settings in Apple's Safari browser.

I don’t want to focus on what Google did or didn’t do here. Rather, let’s focus on the fine. At the time, the size of fine was considered huge, perhaps bordering on insane. No doubt, the folks at the FTC were high-fiving each other that day. Surely, this fine would send a message to the business community that privacy was not for sale, and the FTC was not to be trifled with.

No disrespect intended to the FTC, but when I read through the settlement, a few questions came to mind:

Why would Google be so willing to hand over that kind of money? After all, the folks at Google swore up and down that it was all a horrible mistake by a well-meaning (albeit rogue) employee.

The answer to that question comes in three parts:

1. The settlement didn’t require Google to admit wrongdoing.

2. The settlement didn’t place meaningful limits on Google’s future practices.

3. While a big number to you and me, the fine was a rounding error for Google.

In other words, the fine allowed the FTC to claim victory, but it probably did little to improve privacy practices in the marketplace. More importantly, that moment can be viewed as the beginning of a larger trend, one in which fine inflation increased significantly over the next few years.

Rather than leading to “better” practices, fine inflation has led big tech to engage in a math exercise. It’s a math exercise that I refer to as the “Regulatory ROI.”

What Is a Regulatory ROI?

If you’ve been in the ads space for a while, you (and/or your executive team) probably played a version of the Regulatory ROI game at some point. Getting into compliance costs money, and money is both finite and can be “better” invested in things that drive revenue. So companies will sometimes under-invest in compliance in hopes of getting out of the ads casino via an exit before a regulator comes calling. I’ve gone on record that this approach is becoming significantly more thorny for startups in the ads space.

But if you’re really big, and flush with cash, the math behind the Regulatory ROI is an entirely different animal.

When Lawmakers and Regulators Doubled Down on Fines

It wasn’t just the FTC issuing big fines. Just a few years later, the European Union created a groundbreaking fine structure via the GDPR: the higher of €20 million or 4% of global annual turnover for serious breaches. And there have been a number of noteworthy fines. Forgive me if I missed some, but they include:

• Meta - €1.2 billion (2023)

• Amazon - €746 million (2021)

• TikTok - €530 million (2025):

• Meta (Instagram) - €405 million (2022)

• Uber: €290 million (2024)

• H&M: €35 million (2020)

And later, via the Digital Markets Act, the EU doubled down again, imposing fines of up to 20% of global turnover!

Not to be outdone, Texas recently imposed fines against Google ($1.375 billion) and Meta ($1.4 billion). But you’ll note that in both of those cases, the companies didn’t have to admit to wrongdoing, and the non-monetary penalties were milquetoast at best.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

What About Apple ATT?

I think my favorite example of Regulatory ROI was the Apple ATT saga. Competition authorities across Europe have coordinated enforcements and concluded that ATT creates artificial barriers for third-party developers while benefiting Apple's advertising business. As the below chart demonstrates, the cumulative fines ($278 million) remain modest compared to Apple's ad global revenue growth since ATT launched ($16 billion), suggesting that financial penalties alone won't compel meaningful change. In fact, with a Regulatory ROI that high, one could argue that Apple would be foolish not to have created and perpetuated ATT.

The Curious Case of Google Shopping

In 2017, the European Commission fined Google €2.42 billion for abusing its market dominance by favoring its own comparison shopping service. Google appealed the decision, but the fine was upheld by the EU Court of Justice in September 2024.

Who wants to bet that the revenues for Google Shopping just during the seven-year period of the appeal process was a multiple of the €2.42 billion fine? That’s a great Regulatory ROI.

Here’s My Question

Certainly, high fine structures grab headlines. But 10-15 years in, are the fines really impacting practices?

I have my doubts.

Perhaps you’re thinking that the math changes if the EU fines some gatekeeper 20% of worldwide turnover. But honestly, what do you think the odds are of the EU Commission actually collecting on that type of fine from a U.S. tech giant given all the geopolitical implications?

The Issue Isn’t Money. It’s Power.

Here’s how I’m thinking about large fines:

• If the fine structure isn’t punitive,

• If getting caught just means that your most prudent course of action is to extend the offending behavior to the point where the fine is a fraction of the revenue earned, and

• If regulators can’t even use the fines as leverage to change practices in a meaningful way…

How in the world can one argue that these fines are effective?

EVENTS

Marketecture Live III

New speakers just added
Ready or Not: AI Is Changing Advertising

How Agencies Are Adapting to the AI Meteorite 
Bob Lord, Horizon Media & Obele (Brown-West) Hinsley, Colle McVoy

Consumer Protection in the AI Era 
Mark Meador, Federal Trade Commission & Alan Chapell, The Monopoly Report

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast!

 This week, I welcome Dr. Travis Hall, Director for State Engagement at the Center for Democracy & Technology (CDT), a nonpartisan organization focused on civil rights and liberties in the digital age. We go deep on U.S. state privacy laws.

Does that cute TV really transmit my data all over the world?

Texas and the Pros and Cons of Aggressive Enforcement

On Dec. 15, 2025, while many of us were still wrapping presents, the Texas AG’s office announced that it has “filed suit against five major television companies for spying on Texans by secretly recording what consumers watch in their own homes” via ACR technology. All told, the Texas AG filed complaints against Sony, Samsung,  LG, Hisense, and TCL.

As I’ve noted previously, regulators are starting to look more closely at the data collection practices of the CTV space, including their provision of privacy choices. The Texas AG actions come on the heels of California AG Rob Bonta announcing a $530,000 settlement with Sling TV, the Florida AG complaint against Roku for allegedly violating Florida’s privacy law, and an EU privacy report and investigation into the CTV space.

I get the sense that Texas wants to be known for having robust (and perhaps even aggressive) privacy enforcement. Over the past two years, Texas has: (a) announced settlements with Meta and Google, (b) gone after car manufacturers for passing data to insurance companies, and (c) launched investigations into Character.AI and 14 other companies (including Reddit, Instagram, and Discord) regarding their privacy and safety practices for minors.

Ad

The December Texas filings against the Smart TV manufactures :

1. Frames smart TV data collection as an out of control problem

2. Identifies a number of issues with the way smart TV manufacturers obtain consumer permission for data collection

3. Notes that the privacy choice mechanisms often lack symmetry, so that it’s easier for consumers to “accept” data collection than it is to “opt-out” from it

4. Claims that some of these smart TV companies are sending U.S. personal data to China.

I’m not here to praise or bury any of these smart TV companies. But I think it’s fair to state that many of them could do a better job of offering transparency and privacy choices, and embracing data minimization.

Tradeoffs

The real problem runs deeper. Nobody—businesses, regulators, or consumers—seems to want an honest dialog about tradeoffs between data collection, advertising, and subsidization. We need that conversation; we have needed it for decades. So I won’t beat that drum here.

Anyway, this is so much more than just another privacy case.

I’m sure I’ll get beaten up as being too industry friendly with what I’m about to write below. So to be clear, I hope this isn’t considered me letting industry off the hook.

Marketecture Live III

Speaker reveal!

Marketecture Live: Consumers in Control event, here’s the speaker list.

Marketecture Live is designed for the doers building what comes next and the thinkers shaping how it all works. We’ve announced our first slate of featured speakers, with more to be announced in the coming weeks.

Secure your tickets now!

Most trusted name in privacy & regulatory in the digital media space for over twenty years. Click the ad to request a trial subscription.

Multiple Narratives in Play

This case involves at least eight distinct components, each deserving examination:

1. Why has smart TV data collection suddenly become so urgent that it needs to be stopped immediately? It’s not like these practices are new, or even newly discovered. What’s changed?

2. Is it a good idea for a state AG (or really any governmental entity) to be able to use its emergency powers to justify effectively shutting businesses down by filing TROs?

3. AG Paxton is certainly not the first politician to use a privacy crusade as a political launching pad, but do we really need a further blurring of the line between official acts and political acts?

4. Aggressive state enforcement certainly isn’t a bad thing, but states generally need to be careful about being too heavy-handed. At some point, if states are viewed as stepping over the line, it creates pressure for federal preemption. A functioning Congress might view overly aggressive enforcement as reason to end the state privacy law experiment.

5. At least two of the smart TV manufactures allegedly send data to China. If we’re concerned about social platforms sending U.S. personal data to China and other places in Asia, we should also be concerned about smart TV companies sending data to China and other parts of Asia. While I don’t think the ads space has internalized this yet, there are laws in place to ensure that this doesn’t happen. Interestingly, neither of them are even referenced in the Texas complaints. Also, if our goal is to move away from having our televisions manufactured outside the U.S., the road to get there is at best an uphill climb. (If you haven’t yet, I’d encourage you to read Apple in China. I had the author on the TMR podcast last year.)

6. With all this enforcement activity at the state level, I can only wonder if it’s becoming more difficult to argue that a private right of action is really necessary for robust enforcement. (Ducks as the privacy advocates lunge at me.)

7. Speaking of class actions, it only seems a matter of time before the CTV space feels the presence of class-action litigants. Wherever there’s lots of allegations that you’re offering a less than perfect choice mechanism, the CIPA litigants are certain to come calling.

8. Finally, it’s worth noting that Texas is one of the states that engages private law firms to assist them in their enforcement efforts. The enforcement budgets at the state level are typically a bit limited, so bringing in private law firms and giving them a cut of the fines imposed certainly solves the resource issues. It also potentially creates conflicts of interest, and a peculiar set of incentives when it comes to enforcement targets.

Ad

What Comes Next?

These eight threads will play out over the next several months. More state AGs will file similar complaints. Class-action attorneys will follow the roadmap Texas provided. To what degree will consumers be helped by all this?

The real question isn't whether smart TV device data collection practices need reform. They do. The question is whether this enforcement approach, with its mix of emergency powers, private firm incentives, and political motivations, represents the best path forward.

That answer depends on which of these eight narratives you find most compelling.

_________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been outside privacy and regulatory counsel for hundreds of digital media and tech companies, and I’m author of The Chapell Report regulatory outlook. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a pundit writing for The Monopoly Report.

Our latest Monopoly Report podcast is an interview with FTC Commissioner Mark Meador! Please give it a listen.

What it sometimes feels like being the privacy guy at an ad tech conference

Not trying to sound like other privacy pros, but…

One of the oldest moves in the privacy world is to sternly warn everyone to get into compliance immediately — OR ELSE!

It’s like you’re holding up a sign demanding repentance, lest the world end tomorrow. Except instead of the world ending, the boogie man is the GDPR, CCPA, an FTC crackdown, or class-action litigation. If you’ve been in the ads space a while, you are probably all too familiar with the drumbeat coming from the privacy hawks.

But here’s the thing: Up until recently, there hasn’t consistently been a huge downside to ignoring such warnings.

Over the years, with each new privacy boogie man that emerged, a percentage of the ads space has ignored the the warning. And most were able to get away with it for a period of time. I know founders who have gotten by without really focusing on privacy to the tune of multiple exits.

So I understand if you take the following with a grain of salt, but here goes:

There are too many ad techs building really interesting tech who need to find religion on privacy.

There. I said it. Is anyone listening?

Making my point more clearly…

I’ve been involved in a few exits recently. I’ve also been involved in a number of attempted and abandoned exits where, for whatever reason, the company looking to sell had skimped on privacy. And in each case, the company was negatively impacted:

• One company had to lower its asking price significantly because it had built on a poor privacy foundation.

• Another had to spend a huge wad of cash on lawyers trying to get through the due diligence process.

• And the others? Well, let’s just say things didn’t work out for them.

More below…..

Marketecture Live III

Marketecture Live: Consumers in Control Speaker Announcement

Marketecture Live is designed for the doers building what comes next and the thinkers shaping how it all works. We’ve announced our first slate of featured speakers, with more to be announced in the coming weeks.

Early Bird pricing ends January 6, 2026: secure your tickets now before rates go up.

What’s different now? Why should we listen to this tired old argument?

Something’s happened over the past five years. While many in the ads space were mostly focused on survival and trying to gear up for the post-cookie reality, a bunch of new laws and rules have emerged.

Rules that have surpassed those of our privacy self-regulatory groups.

Rules that apply to just about anyone operating in ads space — even the “privacy safe.”

AI changes everything (except the privacy rules)

I’ve spent a bit of time over the past month checking out a bunch of the new breed of AI-infused companies being proudly listed on various charts and ‘scapes. And the number of what I sometimes refer to as “broken tail light” offenses I’ve seen within that segment in particular is remarkable:

• Privacy policies mindlessly copy/pasted from other companies

• Privacy policy scope inconsistent with how your products are framed

• Profiling and automated decision-making services offered without an opt-out

• Non-existent or poorly configured site CMP, yet all kinds of retargeting taking place

• No DSAR process in place, no appeals process

When I write “broken tail light” issues, I mean the type of things that a regulator can easily spot and metaphorically pull your company over for a closer look. In other words, each of the above things would take the good folks at Cal-Privacy less than five minutes to see evidence of a compliance issue.

Click the ad and provide an email to get a free issue of The Chapell Report.

What should you do?

Here are a few things to consider. Please note that this is NOT legal advice. It’s not even a complete list of potential issues. (It’s a free newsletter. What do you expect!!?)

The below are just a few considerations and suggestions from someone involved in this industry for a long time who wants to see it grow and succeed.

1. If you’re an adtech, you’re probably a data broker: At least in California. If you receive pseudonymous personal data (HEMs, MAIDs, IP addresses, etc.) indirectly and pass that type of information downstream, you’re probably a data broker. And being a data broker involves a bunch of additional responsibilities under California’s new DELETE Act as of Jan. 1, 2026.

2. AI is the new behavioral targeting: If you’re using AI as part of your service, you need to creating AI and privacy impact assessments (regardless of the latest proclamation on AI coming from the White House). Regulators are focusing on AI the same way they hyper focused on behavioral ads over the past 20 years.

3. Inferences drawn from AI are personal data: If you’ve built one those new AI-infused audience companies (there are a bunch of interesting ones out there), you might be tempted to think that the rules don’t apply. Resist that temptation. Chances are, you’re profiling, and any inferences you’re drawing are personal data.

4. Fix your CMP: I find myself being pulled into more and more CIPA-related litigation and shakedowns from class-action plaintiffs. A huge percentage of those cases have their roots in someone failing to properly configure their website’s consent management platform (CMP). There are lots of people who can help configure yours, such as Jodie Daniels and Scott Messer. Tell ‘em I sent you.

5. Document your data flows: This probably should be at the top of the list. Historically, it’s not been an area where ad techs generally excel. And without that documentation, you can’t craft a PIA to assess risks. (If you don't know what a PIA is, all the more reason to run toward someone who can help).

6. Consider sensitive data: Understand if you’re collecting sensitive data (and in most instances, figure out how to work without it.) Sensitive data generally requires a consent and imposes additional requirements around secondary use in most instances. Best to avoid. (Secondary use of data should probably be its own bullet.)

7. Craft or update data processing agreements: Europe and California each have a number of very specific requirements around what’s supposed to be in these documents. I’m amazed at the number of companies passing off outdated DPAs that were clearly copy-paste jobs.

8. Get your DSARs in order: States are doubling down on data subject access, deletion, opt-out, and correction rules. California has built out its DROP mechanism for data brokers, and other states will follow in 2026. (I’ll have Tom Kemp from CalPrivacy on the TMR podcast to discuss the DROP in January.)

Then there’s stuff like data minimization requirements, new rules pertaining to minors, secondary use of data, California’s new DROP mechanism, etc. (I’ve already gone into detail regarding issues with opt-out choice mechanisms, particularly in the CTV space.)

There’s a bunch of additional privacy rules in place these days, folks. If you ask me, I don’t think you’ll be able to skate by on privacy anymore.

Regardless of how cool your new platform or toolset may be…

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.