I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated insights report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

This week, I welcome Ben Isaacson to The Monopoly Report Podcast to discuss California’s data broker registry - and how the definition of data broker is much broader than many in the ads space might think. When everything is an ad network, everyone is a data broker.

This is what a “compliance gap” looks like to privacy and legal folks…

Editor’s note: I’m writing this as I fly out to San Francisco for RampUp to talk about privacy within the agentic space (among other topics). Stop by and say hello if you’re out there. And if you can’t make it to San Fran, I hope you make it out to Marketecture Live next week, where I’ll be doing a fireside chat with Commissioner Mark Meador of the U.S. Federal Trade Commission. Get ready: I’ve got a few grenades I’m planning to throw into the room.

What agentic is currently missing

With all the energy around agentic right now, a good deal of the conventional wisdom is that agentic is going to fix a lot of the misaligned incentives and other challenges inherent in the ads space… almost as if by magic. I’m hearing those types of claims from lots of senior leaders in this space, often from people who should know better.

Anyway, the thing that gets me excited about the move to agentic is that it poses a real opportunity to fix some of what’s broken about the ads space. Whether we’re able to get there is an open question, as I sometimes question our collective desire to move beyond some of the endemic opacity and grift.

While I can’t fix everything, I wanted to at least share a vision for addressing some of the open privacy issues. For example, it would be extremely helpful if we could ascertain the following more consistently:

1. Was a privacy policy presented that describes the agreed-upon data use cases?

2. Is the contemplated data flow aligned with the actual data flow?

3. Are consumer choice signals such as the GPC being respected?

4. Is the targeting technique used benign when it comes to privacy and intellectual property rights?

5. Does the ad or data flow trigger some flavor of special treatment (e.g., alcohol, politics) or are known children viewing the ad?

We’ve come a long way over the years. But equally, we need to be able to answer these types of questions more consistently, and much more quickly.

How selecting data vendors works today: whitelisting

Let’s look at data relationships today. In many use cases today, the process is very salesperson driven. Not that this is necessarily a bad thing. Some of my favorite people are data salespeople.

But the process involves a fair amount of work on the front end that is designed to create a whitelist of good data vendors. Don’t get me wrong: That type of approach can be helpful. And it’s far better than where the industry stood just a few years ago.

But if one of the goals of agentic is to increase speed and efficiency, the current process of having a salesperson reach out to you, selling you on the fact that their data is great and assuring you of their vetting process — well, that might not be as efficient. It certainly won’t enable you to swap-out data vendors quickly.

But that process also has what I’ll call a compliance gap. There’s no efficient way to meaningfully vet that your data partners are doing the thing(s) that they say they’re doing.

And if you can’t do that… well, then moving at light speed stops being an advantage. In fact, speed can pose a distinct disadvantage.

And this doesn’t just apply to data vendors. It arguably applies up and down the adtech vendor chain.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

Using agentic to know that your data partners are solid

Regardless of whatever agentic framework you’re using, it’s going to be more important than ever to have confidence in the data partners you use, both when evaluating their quality and when vetting them re: privacy compliance.

The agentic ads space will need to be able to make vetting and compliance decisions much more quickly than they are currently being made. As a result, I believe we’ll need a whole boatload of compliance inputs available in real time if we want to have any hope of addressing privacy concerns going forward.

This is just a starting point, but here is my initial list of inputs:

• Self-regulatory status: You may be thinking — wait! Is self-reg still a thing with all these state privacy laws sprouting up, not to mention the GDPR? The short answer is: It can be. And as board chair of the NAI, I have hope that self-reg will be a major input. But in order for that to happen, self-reg needs to step up its game pretty significantly. The self-regulatory codes of 2015 are not going to cut it in the move to agentic.

• Audits and seal programs: Audits and privacy seal programs have historically been viewed suspiciously in the ads space. Sometimes the audit standards used are viewed as toothless (also an endemic criticism of self-reg). Sometimes the only companies willing to undergo the audit are those who have the biggest trust issues. But the biggest issue is that companies don’t want to pay the required costs or undergo the level of scrutiny required. California seems to have solved that problem for us, as these types of audits become hard requirements soon.

• Whitelisting: I’m including this input here because this is the approach that just about everyone currently uses. Also, I don’t think you can fully replace the value of an effective privacy, data governance, and compliance team. So this should remain part of the mix for the foreseeable future. But please understand me: This approach should be your floor, not your ceiling.

• Attestation tools: All credit to Richy Glassberg and his team at SafeGuard Privacy, as his company has taken a leadership position in the ads privacy community. But if the goal here is to design a tool to vet the accuracy of claims being made, providing a restatement of those claims via an attestation platform is only going to take one so far. So, this is another floor that should not be confused as a ceiling.

• Privacy scores: Perhaps the most (at least potentially) efficient tool to vet compliance is to create a privacy rating system. This concept isn’t exactly new. Back in 2009, a former Yahoo! exec named Jim Brock came up with an idea to create a privacy score to rate the various adtech vendors operating at that time. He eventually sold the idea to anti-virus software company AVG. Today, the most closely on point company is Compliant. [Nope - I don’t work with them.] My hope is that at least a few additional direct competitors spring up in that space. Also, if we don’t have transparency in how the privacy scores are compiled and/or if these scores become just another pay to play, they becomes useless pretty quickly.

Are these the right inputs?

If you have thoughts on the above, or if you want to suggest some new ones, please ping me here.

EVENTS

Marketecture Live III

7 Days Until Marketecture Live

The agenda is set, tickets are moving fast, and The Glasshouse is filling up.

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve had the pleasure of serving as outside privacy counsel to hundreds of digital media companies. I write a monthly syndicated business intelligence report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast is out! This week, I welcome AI ethicist and governance pro Shoshana Rosenberg, who describers her framework for addressing the legal and regulatory risks involving AI. Given all the new AI and profiling rules flowing down into the ads space in 2026, Shoshana is exactly the person we should all be listening to right now.

See… it’s all completely on the up and up.

AI Content Marketplaces Are Almost a Great Idea

I recently started taking a closer look at AI content marketplaces as a way to ensure that publishers get paid for their work. And now with Microsoft and Amazon entering the field, the concept seems to be really taking off.

What’s a Content Marketplace?

An AI content marketplace is a platform that connects content creators and publishers with artificial intelligence companies seeking training data or real-time content access. These marketplaces are designed to function as intermediaries, handling the technical, legal, and financial complexities of licensing digital content for AI applications. Ari Paparo went into more detail here and even talked about it on his podcast here.

The current approach of web scraping allows AI companies like OpenAI and Google to access content without compensation, creating economic friction and legal uncertainty around copyright and fair use. AI marketplaces are designed resolve this by providing structured licensing mechanisms.

But here’s the thing: All of this is pretty academic unless there’s a way to compel AI companies to actually pay for content. As of today, most of them ignore robots.txt, and Google uses its market power to force publishers into the Hobson’s choice of giving up traffic or giving up their IP.

Something, Something… Cow’s Milk?

This is a rather obvious statement, but it occurs to me that few are willing to pay for something they can get for free. In that light, resolution of this problem requires one of the following:

1. Collective action: Publisher coalitions refusing Google's bundled terms en masse (lol)

2. Competitive pressure: A viable search alternative that doesn't bundle AI training, forcing Google to change policy (Thanks, Judge Mehta!)

3. Technical solutions: The tools Cloudflare is building are certainly interesting and can no doubt make it more difficult for AI scrapers to collect data. Very helpful for sure. However, those types of tools are only going to take publishers so far. And it seems to me that last thing publishers want is to be in a technical arms race with the richest companies in the world. What’s more, these solutions don’t really address the problem of having the dominant search engine leverage your acceptance of their AI bots as a precondition of your obtaining search traffic.

4. Regulatory intervention: Laws, regulations, or competition enforcement that requires separate permissions for search indexing versus AI training (similar to EU AI Act proposals) would go a long way toward solving this problem.

In my view, the approaches that seem remotely viable today involve some flavor of regulatory intervention to stop or at least slow down the AI companies. I thought it’d be interesting to take a look at some of the options.

As such, we’re back on the Big Tech Regulatory Flywheel, kids!

Editor’s Note: Yeah, I know it’s not nearly as pithy a phrase as “everything is an ad network” or “enshittification”, but the Big Tech Regulatory Flywheel (BTRF) is a pretty damn apt description of where we are these days.

Option 1: U.S. DOJ Antitrust Team

As you may remember, the DOJ’s initial proposed remedies against Google included a requirement that would prohibit Google from merging its search indexing function with its AI indexing function. We all know where that idea went. Maybe the DOJ will attempt to come after Google search again, but it’s difficult to imagine it happening in the near term now that the two people leading the charge over there (Gail Slater and Mark Hamer) are out at the DOJ.

Option 2: UK Competition and Markets Authority

The UK CMA has done a remarkably thorough job of outlining all of the challenges Google is creating in the marketplace. It’s really some great work.

But just as it did with the Privacy Sandbox, the UK CMA has once again given Google the power to dictate the process by which Google addresses the CMA’s competitive concerns (which is great for Google but will severely limit any positive impact to be realized by publishers and other marketplace participants).

For example, the CMA measures with respect to Google’s merging its search index function with its AI index function are designed to create rules for what Google may do with the data after it is collected; they are not designed to allow publishers to prevent Google from collecting the data in the first place.

Why does the UK CMA continue to let Sundar Pinchai and Google drive when it comes to remedies?

Option 3: U.S. Congress

As covered by Digiday, the IAB is floating a Congressional bill designed to give publishers more surface area when combatting AI scrapers. Publishers are mostly limited to copyright law when seeking remedies for scraping. I’d imagine that this type of law would bolster some of the recent lawsuits coming from Penske and others.

Don’t get me wrong: I applaud the effort. But a few thoughts:

1. We are currently in what amounts to a worldwide moratorium on doing anything to slow the momentum of AI companies—an effort being spearheaded by the U.S. In light of that, it’s difficult believe that this Congress is going to push forward this type of law. Thinking otherwise would involve some real Chuck Schumer energy, folks.

2. The bill would still necessitate that publishers engage in expensive litigation, which is something that only the top-tier publishers will have the resources to do effectively.

3. I’ll bet you a nickel that if this law were to pass, it wouldn’t be Google that got dinged; it would be some AI-infused contextual adtech firm.

4. I’d be curious to see a Venn diagram of those who (a) oppose a private right of action for privacy laws and (b) favor this publisher right of action. Cue: Tina Turner (“We don’t need more litigation.”)

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

Option 4: Can the EU Commission Save Publishers?

This past December, the EU Commission announced that it opened a formal antitrust investigation to assess whether Google breached EU competition rules by using the content of web publishers, as well as content uploaded on the online video-sharing platform YouTube, for AI purposes. The investigation will take a look at whether Google is distorting competition by imposing unfair terms and conditions on publishers and content creators, or by granting itself privileged access to such content, thereby placing developers of rival AI models at a disadvantage.

The EU Commission process is still in its early stages, so it’s hard to make many predictions. What’s interesting about this effort is that it also includes YouTube, which raises the possibility of the EU Commission examining the competitive fairness of the relationships that other platforms have with their content creators.

What Are the Other Options?

If you have any ideas, I’m all ears. I’ll be speaking at RampUp (SF), MarketectureLive (NYC), and Prebid Ascent (London) over the next few weeks. Be sure to say hello - or ping me if you want to setup a time to hear about my latest insights…

EVENTS

Marketecture Live III

March 10-11 at The Glasshouse, NYC

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

This week’s Monopoly Report podcast features a discussion with Tom Kemp, Executive Director of CalPrivacy. We talk about the launch of the DROP deletion mechanism in California - and I ask questions seeking to understand the effectiveness of California’s stated policy goals. 

California: Next stop on the Big Tech Regulatory Flywheel?

A few months ago, I wrote an article speculating on the remedies that Judge Brinkema may impose in the DOJ antitrust case against Google. As you might know, I’m not super optimistic about the prospects of a divestiture ruling. In fact, I believe there’s a growing sense within competition circles that U.S. antitrust law is less likely to rein in the practices of big tech in the near term.

I’ve described my frustration with antitrust law’s failure to reign in Big Tech as part of what I refer to as the Big Tech Regulatory Flywheel, which goes as follows:

1. If antitrust courts are unwilling / unable to enforce the law, U.S. Congress must step in and break up Big Tech...

2. Congress is inept at creating law to break up Big Tech, so we turn to the judiciary....

3. The U.S. system is captured by industry... so it’s up to the EU to reign in Big Tech…

4. [Take big swig of tequila…]

5. Rinse / repeat.

But maybe there’s another stop on the flywheel—one that can be more effective. Perhaps California will be able to rein in Big Tech via CCPA, the DELETE Act, etc.

But here’s the question: Is the ruleset in California currently designed to contain Big Tech?

What does CalPrivacy view as the problem it wants to solve?

Last week, I interviewed Tom Kemp, the head of CalPrivacy, on the podcast. Tom is an accomplished entrepreneur and investor. Prior to coming on board as executive director of CalPrivacy in March 2025, Tom was very active as CMO and policy advisor of the group advocating for the California Ballot Initiative that ultimately brought us the CPRA.

In 2023, Tom wrote “Containing Big Tech,” a book that is right up there with other fantastic reads such as “Enshittification” by Cory Doctorow and “The Age of Extraction” by Tim Wu in terms of chronicling and analyzing the myriad ways that Big Tech impacts our lives. Tom’s book methodically walks through a number of the issues raised by Big Tech from the perspective of antitrust, misinformation, threats to democracy, data breaches, and of course, privacy. I started reading the book after speaking with Tom last week.

Tom’s book goes into great detail on how Google did this, how Amazon failed to do that, and how Meta and X are harming the other thing. It outlines a set of problems where the solution is so clear that it’s even stated in the title: “Containing Big Tech.” For the record, I found myself in agreement with many of the issues Tom raised in the book.

Tom’s book doesn’t just outline the problems. It offers solutions—many of which mirror the policy solutions offered by California policymakers since 2019 when it comes to privacy.

What Problem(s) Does the CCPA Address?

So with all the talk about the issues caused by Big Tech, I wondered how the CCPA and similar rules were actually containing Big Tech.

A few things jumped out at me:

1. Data Broker Registry: I couldn’t find a single Big Tech company listed on the California Data Broker registry. I didn’t see Palantir on the list either. I’m not passing judgment on whether any of those companies are violating the law. Rather, I’m saying that addressing the practices of those companies (or not) is a policy choice.

2.  Enforcement: I couldn’t find much in the way of CCPA enforcements against Big Tech. Yes, there was a 2023 settlement between Google and the California AG’s office, but it didn’t directly involve CCPA.

3. Sensitive Data: The CCPA ruleset doesn’t treat sensitive personal information (e.g., ethnicity, precise location, sensitive health) much differently that it does pseudonymous personal data.

I am absolutely not attempting to downplay the great work that CalPrivacy is doing. However, I think it’s worth asking whether CalPrivacy is drawing a straight line between the problems it has identified (i.e., Big Tech and misuse of sensitive data) and the policy solutions it is currently offering.

I hope that changes. Tom and his colleagues have created something that has the potential to make the world significantly better.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

How I’d like to see the ads space evolve

Before I talk about what I think CalPrivacy should do, I want to mention what I think my industry should do. For years, I’ve been pushing companies operating in the ads space to do the following:

1. Stay away from identifiable personal data.

2. Avoid sensitive personal data such as health, known children, and precise location.

3. Adopt data minimization as a core principle.

Most companies in the ads space have for a long time honored the first suggestion. Many have generally honored the second. The third? Well, let’s just say that’s still a work in progress—particularly in the AI era.

How I’d like to see CalPrivacy adapt

CalPrivacy has been granted a great deal of authority by the California Legislature to issue additional regulations, and it regularly uses its voice to push for particular policies. I’d like to see it use that power toward the following ends:

1. Clearly identify the problems you’re attempting to solve and tailor solutions: There’s a good deal of innuendo being used. Entire books are being written to document the various problems, and all roads seem to lead to Big Tech and sensitive data. If CalPrivacy truly believes that Big Tech and sensitive data are at the root of most of these problems, then let’s make that clear. But also, let’s make sure that the solutions being offered are aligned to address those core problems. This isn’t unique to California; I see similar situations occurring a lot in the privacy world.

2. Adopt more of a risk-based approach to rule creation: I certainly understand how consumers want to get a better sense of the sensitive data being collected about them, in part so they can control it. There are no shortage of harms being perpetuated using sensitive personal information. Can you say the same thing about mobile ad IDs and other pseudonymous personal information? I’m not so sure. In that light, it doesn’t make much sense to treat all personal data as effectively the same.

3. Make sure that opt-out choice is implemented fairly: Starting in 2027, browsers will be required by California law to support the GPC signal. We need CalPrivacy to require that the signal is presented fairly (i.e., no ATT-style scare screens) and that the browser doesn’t use these GPC signals to preference their internal advertising programs over the ad solutions of their competitors. We’re in a very different era—one where browsers are often owned by Big Tech companies—and the others are increasingly under monetization pressures. I’m hopeful that CalPrivacy can broker an honest discussion about a clear conflict of interest.

To his credit, Tom told me that the browser issue (and a similar one I raised on the pod re: authorized agents) are on the CalPrivacy agenda for discussion. My advice to the rest of the ads space is this: Make sure your voice gets heard during CalPrivacy’s comment periods to help ensure that these competition issues aren’t swept under the rug.

Is there a reason for hope?

Absolutely. I don’t want it to get lost that there’s a lot of things that CalPrivacy is getting right. Enforcement over there to date has been measured and practical. And CalPrivacy’s work in setting up baseline rules around transparency and choice are super valuable. In my view, the solution being offered just needs to be more closely tethered to the identified problems.

If Tom Kemp and his colleagues at CalPrivacy can do that, California might be the latest (and perhaps final) stop on the big tech regulatory flywheel.

EVENTS

Marketecture Live III

Where the Industry Gets Honest About What’s Next

Join us March 10–11 at The Glasshouse in NYC for a limited-seat event built for leaders looking for what’s next in advertising.

• Brand and marketing leaders looking to stay ahead of consumer shifts and growth channels in 2026 can apply for a complimentary pass.

• Agency executives and strategy and media teams exploring what’s next in planning and creative effectiveness can apply for a complimentary pass.

• Publishers & groups of (3) or more navigating AI disruption and retail media realities receive special rates.

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast! This week, I welcome antitrust litigator Brendan Benedict. We discuss the civil antitrust lawsuits being filed against Google by publishers and adtech companies.

Michael Stipe and the rest of R.E.M. are probably gonna sue

Our Story Begins Nearly 15 Years Ago

It was the summer of 2012. I was enjoying my August days working out at the East Deck in Montauk when I heard the news that Google had agreed to pay a whopping $22.5 million to the Federal Trade Commission (FTC) to settle charges that it bypassed privacy settings in Apple's Safari browser.

I don’t want to focus on what Google did or didn’t do here. Rather, let’s focus on the fine. At the time, the size of fine was considered huge, perhaps bordering on insane. No doubt, the folks at the FTC were high-fiving each other that day. Surely, this fine would send a message to the business community that privacy was not for sale, and the FTC was not to be trifled with.

No disrespect intended to the FTC, but when I read through the settlement, a few questions came to mind:

Why would Google be so willing to hand over that kind of money? After all, the folks at Google swore up and down that it was all a horrible mistake by a well-meaning (albeit rogue) employee.

The answer to that question comes in three parts:

1. The settlement didn’t require Google to admit wrongdoing.

2. The settlement didn’t place meaningful limits on Google’s future practices.

3. While a big number to you and me, the fine was a rounding error for Google.

In other words, the fine allowed the FTC to claim victory, but it probably did little to improve privacy practices in the marketplace. More importantly, that moment can be viewed as the beginning of a larger trend, one in which fine inflation increased significantly over the next few years.

Rather than leading to “better” practices, fine inflation has led big tech to engage in a math exercise. It’s a math exercise that I refer to as the “Regulatory ROI.”

What Is a Regulatory ROI?

If you’ve been in the ads space for a while, you (and/or your executive team) probably played a version of the Regulatory ROI game at some point. Getting into compliance costs money, and money is both finite and can be “better” invested in things that drive revenue. So companies will sometimes under-invest in compliance in hopes of getting out of the ads casino via an exit before a regulator comes calling. I’ve gone on record that this approach is becoming significantly more thorny for startups in the ads space.

But if you’re really big, and flush with cash, the math behind the Regulatory ROI is an entirely different animal.

When Lawmakers and Regulators Doubled Down on Fines

It wasn’t just the FTC issuing big fines. Just a few years later, the European Union created a groundbreaking fine structure via the GDPR: the higher of €20 million or 4% of global annual turnover for serious breaches. And there have been a number of noteworthy fines. Forgive me if I missed some, but they include:

• Meta - €1.2 billion (2023)

• Amazon - €746 million (2021)

• TikTok - €530 million (2025):

• Meta (Instagram) - €405 million (2022)

• Uber: €290 million (2024)

• H&M: €35 million (2020)

And later, via the Digital Markets Act, the EU doubled down again, imposing fines of up to 20% of global turnover!

Not to be outdone, Texas recently imposed fines against Google ($1.375 billion) and Meta ($1.4 billion). But you’ll note that in both of those cases, the companies didn’t have to admit to wrongdoing, and the non-monetary penalties were milquetoast at best.

The most trusted name in privacy and regulatory in the digital media space for over 20 years. Click the ad to request a trial subscription.

What About Apple ATT?

I think my favorite example of Regulatory ROI was the Apple ATT saga. Competition authorities across Europe have coordinated enforcements and concluded that ATT creates artificial barriers for third-party developers while benefiting Apple's advertising business. As the below chart demonstrates, the cumulative fines ($278 million) remain modest compared to Apple's ad global revenue growth since ATT launched ($16 billion), suggesting that financial penalties alone won't compel meaningful change. In fact, with a Regulatory ROI that high, one could argue that Apple would be foolish not to have created and perpetuated ATT.

The Curious Case of Google Shopping

In 2017, the European Commission fined Google €2.42 billion for abusing its market dominance by favoring its own comparison shopping service. Google appealed the decision, but the fine was upheld by the EU Court of Justice in September 2024.

Who wants to bet that the revenues for Google Shopping just during the seven-year period of the appeal process was a multiple of the €2.42 billion fine? That’s a great Regulatory ROI.

Here’s My Question

Certainly, high fine structures grab headlines. But 10-15 years in, are the fines really impacting practices?

I have my doubts.

Perhaps you’re thinking that the math changes if the EU fines some gatekeeper 20% of worldwide turnover. But honestly, what do you think the odds are of the EU Commission actually collecting on that type of fine from a U.S. tech giant given all the geopolitical implications?

The Issue Isn’t Money. It’s Power.

Here’s how I’m thinking about large fines:

• If the fine structure isn’t punitive,

• If getting caught just means that your most prudent course of action is to extend the offending behavior to the point where the fine is a fraction of the revenue earned, and

• If regulators can’t even use the fines as leverage to change practices in a meaningful way…

How in the world can one argue that these fines are effective?

EVENTS

Marketecture Live III

New speakers just added
Ready or Not: AI Is Changing Advertising

How Agencies Are Adapting to the AI Meteorite 
Bob Lord, Horizon Media & Obele (Brown-West) Hinsley, Colle McVoy

Consumer Protection in the AI Era 
Mark Meador, Federal Trade Commission & Alan Chapell, The Monopoly Report

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and write a monthly syndicated report called The Chapell Regulatory Insider. I’m also a regulatory analyst for The Monopoly Report.

The latest Monopoly Report podcast!

 This week, I welcome Dr. Travis Hall, Director for State Engagement at the Center for Democracy & Technology (CDT), a nonpartisan organization focused on civil rights and liberties in the digital age. We go deep on U.S. state privacy laws.

Does that cute TV really transmit my data all over the world?

Texas and the Pros and Cons of Aggressive Enforcement

On Dec. 15, 2025, while many of us were still wrapping presents, the Texas AG’s office announced that it has “filed suit against five major television companies for spying on Texans by secretly recording what consumers watch in their own homes” via ACR technology. All told, the Texas AG filed complaints against Sony, Samsung,  LG, Hisense, and TCL.

As I’ve noted previously, regulators are starting to look more closely at the data collection practices of the CTV space, including their provision of privacy choices. The Texas AG actions come on the heels of California AG Rob Bonta announcing a $530,000 settlement with Sling TV, the Florida AG complaint against Roku for allegedly violating Florida’s privacy law, and an EU privacy report and investigation into the CTV space.

I get the sense that Texas wants to be known for having robust (and perhaps even aggressive) privacy enforcement. Over the past two years, Texas has: (a) announced settlements with Meta and Google, (b) gone after car manufacturers for passing data to insurance companies, and (c) launched investigations into Character.AI and 14 other companies (including Reddit, Instagram, and Discord) regarding their privacy and safety practices for minors.

Ad

The December Texas filings against the Smart TV manufactures :

1. Frames smart TV data collection as an out of control problem

2. Identifies a number of issues with the way smart TV manufacturers obtain consumer permission for data collection

3. Notes that the privacy choice mechanisms often lack symmetry, so that it’s easier for consumers to “accept” data collection than it is to “opt-out” from it

4. Claims that some of these smart TV companies are sending U.S. personal data to China.

I’m not here to praise or bury any of these smart TV companies. But I think it’s fair to state that many of them could do a better job of offering transparency and privacy choices, and embracing data minimization.

Tradeoffs

The real problem runs deeper. Nobody—businesses, regulators, or consumers—seems to want an honest dialog about tradeoffs between data collection, advertising, and subsidization. We need that conversation; we have needed it for decades. So I won’t beat that drum here.

Anyway, this is so much more than just another privacy case.

I’m sure I’ll get beaten up as being too industry friendly with what I’m about to write below. So to be clear, I hope this isn’t considered me letting industry off the hook.

Marketecture Live III

Speaker reveal!

Marketecture Live: Consumers in Control event, here’s the speaker list.

Marketecture Live is designed for the doers building what comes next and the thinkers shaping how it all works. We’ve announced our first slate of featured speakers, with more to be announced in the coming weeks.

Secure your tickets now!

Most trusted name in privacy & regulatory in the digital media space for over twenty years. Click the ad to request a trial subscription.

Multiple Narratives in Play

This case involves at least eight distinct components, each deserving examination:

1. Why has smart TV data collection suddenly become so urgent that it needs to be stopped immediately? It’s not like these practices are new, or even newly discovered. What’s changed?

2. Is it a good idea for a state AG (or really any governmental entity) to be able to use its emergency powers to justify effectively shutting businesses down by filing TROs?

3. AG Paxton is certainly not the first politician to use a privacy crusade as a political launching pad, but do we really need a further blurring of the line between official acts and political acts?

4. Aggressive state enforcement certainly isn’t a bad thing, but states generally need to be careful about being too heavy-handed. At some point, if states are viewed as stepping over the line, it creates pressure for federal preemption. A functioning Congress might view overly aggressive enforcement as reason to end the state privacy law experiment.

5. At least two of the smart TV manufactures allegedly send data to China. If we’re concerned about social platforms sending U.S. personal data to China and other places in Asia, we should also be concerned about smart TV companies sending data to China and other parts of Asia. While I don’t think the ads space has internalized this yet, there are laws in place to ensure that this doesn’t happen. Interestingly, neither of them are even referenced in the Texas complaints. Also, if our goal is to move away from having our televisions manufactured outside the U.S., the road to get there is at best an uphill climb. (If you haven’t yet, I’d encourage you to read Apple in China. I had the author on the TMR podcast last year.)

6. With all this enforcement activity at the state level, I can only wonder if it’s becoming more difficult to argue that a private right of action is really necessary for robust enforcement. (Ducks as the privacy advocates lunge at me.)

7. Speaking of class actions, it only seems a matter of time before the CTV space feels the presence of class-action litigants. Wherever there’s lots of allegations that you’re offering a less than perfect choice mechanism, the CIPA litigants are certain to come calling.

8. Finally, it’s worth noting that Texas is one of the states that engages private law firms to assist them in their enforcement efforts. The enforcement budgets at the state level are typically a bit limited, so bringing in private law firms and giving them a cut of the fines imposed certainly solves the resource issues. It also potentially creates conflicts of interest, and a peculiar set of incentives when it comes to enforcement targets.

Ad

What Comes Next?

These eight threads will play out over the next several months. More state AGs will file similar complaints. Class-action attorneys will follow the roadmap Texas provided. To what degree will consumers be helped by all this?

The real question isn't whether smart TV device data collection practices need reform. They do. The question is whether this enforcement approach, with its mix of emergency powers, private firm incentives, and political motivations, represents the best path forward.

That answer depends on which of these eight narratives you find most compelling.

_________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been outside privacy and regulatory counsel for hundreds of digital media and tech companies, and I’m author of The Chapell Report regulatory outlook. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a pundit writing for The Monopoly Report.

Our latest Monopoly Report podcast is an interview with FTC Commissioner Mark Meador! Please give it a listen.

What it sometimes feels like being the privacy guy at an ad tech conference

Not trying to sound like other privacy pros, but…

One of the oldest moves in the privacy world is to sternly warn everyone to get into compliance immediately — OR ELSE!

It’s like you’re holding up a sign demanding repentance, lest the world end tomorrow. Except instead of the world ending, the boogie man is the GDPR, CCPA, an FTC crackdown, or class-action litigation. If you’ve been in the ads space a while, you are probably all too familiar with the drumbeat coming from the privacy hawks.

But here’s the thing: Up until recently, there hasn’t consistently been a huge downside to ignoring such warnings.

Over the years, with each new privacy boogie man that emerged, a percentage of the ads space has ignored the the warning. And most were able to get away with it for a period of time. I know founders who have gotten by without really focusing on privacy to the tune of multiple exits.

So I understand if you take the following with a grain of salt, but here goes:

There are too many ad techs building really interesting tech who need to find religion on privacy.

There. I said it. Is anyone listening?

Making my point more clearly…

I’ve been involved in a few exits recently. I’ve also been involved in a number of attempted and abandoned exits where, for whatever reason, the company looking to sell had skimped on privacy. And in each case, the company was negatively impacted:

• One company had to lower its asking price significantly because it had built on a poor privacy foundation.

• Another had to spend a huge wad of cash on lawyers trying to get through the due diligence process.

• And the others? Well, let’s just say things didn’t work out for them.

More below…..

Marketecture Live III

Marketecture Live: Consumers in Control Speaker Announcement

Marketecture Live is designed for the doers building what comes next and the thinkers shaping how it all works. We’ve announced our first slate of featured speakers, with more to be announced in the coming weeks.

Early Bird pricing ends January 6, 2026: secure your tickets now before rates go up.

What’s different now? Why should we listen to this tired old argument?

Something’s happened over the past five years. While many in the ads space were mostly focused on survival and trying to gear up for the post-cookie reality, a bunch of new laws and rules have emerged.

Rules that have surpassed those of our privacy self-regulatory groups.

Rules that apply to just about anyone operating in ads space — even the “privacy safe.”

AI changes everything (except the privacy rules)

I’ve spent a bit of time over the past month checking out a bunch of the new breed of AI-infused companies being proudly listed on various charts and ‘scapes. And the number of what I sometimes refer to as “broken tail light” offenses I’ve seen within that segment in particular is remarkable:

• Privacy policies mindlessly copy/pasted from other companies

• Privacy policy scope inconsistent with how your products are framed

• Profiling and automated decision-making services offered without an opt-out

• Non-existent or poorly configured site CMP, yet all kinds of retargeting taking place

• No DSAR process in place, no appeals process

When I write “broken tail light” issues, I mean the type of things that a regulator can easily spot and metaphorically pull your company over for a closer look. In other words, each of the above things would take the good folks at Cal-Privacy less than five minutes to see evidence of a compliance issue.

Click the ad and provide an email to get a free issue of The Chapell Report.

What should you do?

Here are a few things to consider. Please note that this is NOT legal advice. It’s not even a complete list of potential issues. (It’s a free newsletter. What do you expect!!?)

The below are just a few considerations and suggestions from someone involved in this industry for a long time who wants to see it grow and succeed.

1. If you’re an adtech, you’re probably a data broker: At least in California. If you receive pseudonymous personal data (HEMs, MAIDs, IP addresses, etc.) indirectly and pass that type of information downstream, you’re probably a data broker. And being a data broker involves a bunch of additional responsibilities under California’s new DELETE Act as of Jan. 1, 2026.

2. AI is the new behavioral targeting: If you’re using AI as part of your service, you need to creating AI and privacy impact assessments (regardless of the latest proclamation on AI coming from the White House). Regulators are focusing on AI the same way they hyper focused on behavioral ads over the past 20 years.

3. Inferences drawn from AI are personal data: If you’ve built one those new AI-infused audience companies (there are a bunch of interesting ones out there), you might be tempted to think that the rules don’t apply. Resist that temptation. Chances are, you’re profiling, and any inferences you’re drawing are personal data.

4. Fix your CMP: I find myself being pulled into more and more CIPA-related litigation and shakedowns from class-action plaintiffs. A huge percentage of those cases have their roots in someone failing to properly configure their website’s consent management platform (CMP). There are lots of people who can help configure yours, such as Jodie Daniels and Scott Messer. Tell ‘em I sent you.

5. Document your data flows: This probably should be at the top of the list. Historically, it’s not been an area where ad techs generally excel. And without that documentation, you can’t craft a PIA to assess risks. (If you don't know what a PIA is, all the more reason to run toward someone who can help).

6. Consider sensitive data: Understand if you’re collecting sensitive data (and in most instances, figure out how to work without it.) Sensitive data generally requires a consent and imposes additional requirements around secondary use in most instances. Best to avoid. (Secondary use of data should probably be its own bullet.)

7. Craft or update data processing agreements: Europe and California each have a number of very specific requirements around what’s supposed to be in these documents. I’m amazed at the number of companies passing off outdated DPAs that were clearly copy-paste jobs.

8. Get your DSARs in order: States are doubling down on data subject access, deletion, opt-out, and correction rules. California has built out its DROP mechanism for data brokers, and other states will follow in 2026. (I’ll have Tom Kemp from CalPrivacy on the TMR podcast to discuss the DROP in January.)

Then there’s stuff like data minimization requirements, new rules pertaining to minors, secondary use of data, California’s new DROP mechanism, etc. (I’ve already gone into detail regarding issues with opt-out choice mechanisms, particularly in the CTV space.)

There’s a bunch of additional privacy rules in place these days, folks. If you ask me, I don’t think you’ll be able to skate by on privacy anymore.

Regardless of how cool your new platform or toolset may be…

__________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been working as outside privacy and regulatory counsel at the intersection of privacy, competition, advertising, and music for decades, and I’m now a regulatory analyst writing for The Monopoly Report and The Chapell Report regulatory outlook.

The Monopoly Report podcast is out! Listen in as Dr. Gabriela Zanfir-Fortuna discusses the EU’s attempt to upend data protection rules via the Digital Omnibus proposal.

Rationalization flywheel for reining in Big Tech: (1) Antitrust court, (2) Congress to create new laws, (3) EU Commission will do it, (4) Tequila shot. (5) Repeat.

Someone went to EDVA, but all I got was a Prebid T-shirt

Let me start by applauding the fantastic coverage of the Google antitrust trials by Arielle Garcia and Ari Paparo. If you want the details on closing arguments in the Google adtech trial, you should check out their work. I’m not going to try to restate it all here.

I acknowledge that we’re all reading tea leaves at this point. Judge Brinkema's questions during closing arguments suggested more than a wee bit of skepticism about the commercial viability of divestiture of AdX given the certainty of a lengthy appeal by Google. As a result, many believe that the most likely outcome is for the judge to rule in favor of a slate of behavioral remedies.

That outcome might also represent a nail in the coffin of the antitrust’s era of good feelings – and an admission that existing antitrust law is not fit to address the complex, vertically integrated technology platforms operated by Big Tech.

I’ve thought a good deal about the questions Judge Brinkema raised. And I have to admit: I can see the logic behind what the good judge characterized as the "commercial reality" of divestiture.

In fact, I’d take it a step further and suggest that there are at least six commercial realities.

The 6 Commercial Realities

Judge Brinkema’s ruling is likely to be guided by the following:

1. Rapid marketplace change: Judge Brinkema interrupted the DOJ's opening argument repeatedly to express concern about timing, noting that the industry is changing rapidly. And that no one can predict what the market will look like in three to five years.

   Alan’s Take: Yep. And if anything, the pace of change has picked up dramatically. It’s one of the things that ultimately doomed the recent FTC case against Meta.

2. Google has little choice but to appeal the liability decision: Given all of the private antitrust litigation resting at the foot of Judge Brinkema’s liability decision, the only rational choice for Google is to appeal.

   Alan’s Take: If the government cases continue to net favorable liability rulings and unfavorable remedies, we’ll see even more private antitrust litigation. But how many of you are confident that you’ll still be in this industry when the Supreme Court finally rules on the Google adtech liabilities in 2034? (I can’t wait to read Justice Aileen Cannon’s analysis).

3. Structural remedies will take years; behavioral remedies take months: Behavioral remedies could potentially take effect during the appeals process, providing relief after 12-15 months. An order from Brinkema involving divestiture would likely be stayed pending appeal. Given the appeals process will likely take years and if the liability findings are reversed… what benefit would the market gain from a remedy that never took effect?

   Alan’s Take: I think the timing narrative is a bit off here. Behavioral remedies will take exactly five years and 11 ½ months to kick in… only to be abandoned at the six-year mark once the monitoring process is complete. Seriously, there’s going to be lots of back and forth on any number of issues, and that’s going to take much longer than 15 months.

4. Google should be given the chance to make this right: The judge has repeatedly noted that courts are supposed to give the monopolist the benefit of the doubt and that behavioral remedies deserve a chance to prove effective before resorting to structural intervention.

   Alan’s Take: Personally, I find it odd that the evidentiary shenanigans engaged in by Google don’t seem to have much weight here, as evidence spoilation goes to the heart of whether or not Google could and should be trusted by the court. There are enough examples of Google to have played games in this and other forums. It’s hard to rationalize why they’re being given benefit of the doubt here. Such is life in the antitrust world.

5. Government has no clear divestiture plan: The lack of an identified upfront buyer and concrete divestiture plan creates practical obstacles to structural relief. Moreover, the chances are that any potential buyer will be large enough that the sale would raise its own level of regulatory scrutiny, which will cause further delays. Judge Brinkema needs to issue an order that is specific and enforceable. Ordering Google to divest AdX without clarity about transaction structure, buyer qualification criteria, or regulatory approval processes leaves too many questions unanswered. And open questions cost time.

   Alan’s Take: Lots of folks speculated about a number of potential buyers of AdX. The fact that the DOJ apparently wasn’t able to point Judge Brinkema to one of them speaks volumes.

6. Unintended consequences of divestiture: Google’s super lawyer Karen Dunn offered a number of points about the unintended consequences of divestiture, such as: (a) divestiture would include video and mobile ads not part of the monopoly findings, (b) that 92% of publishers receive Google Ad Manager for free with no guarantee about what happens to them post-divestiture, and (c) that there's no assurance a buyer would maintain current service levels to publishers.

   Alan’s Take: Agreed that these are issues to be addressed. But let’s not pretend that we have any assurances from Google re: (b) or (c). And (a) sounds more like a Google problem than a reason not to move forward with divestiture.

If you want more insights, please subscribe to my monthly reports. I’m happy to share a sample report with qualified buyers. Click the ad to ping me about The Chapell Report.

Too Big to Breakup?

All of the above points beg a really important question: If divestiture is not appropriate in this case for the reasons stated above, then when exactly is it appropriate?

It is almost impossible to envision a scenario today where the commercial realities enumerated above don’t apply to a case brought against a Big Tech platform. At some point, we’re effectively removing divesture from the list of available remedies to antitrust problems for Big Tech.

The DOJ's Matthew Huppert touched upon this outcome in his closing argument. For antitrust laws to continue protecting markets, courts cannot accept that complexity confers immunity.

What’s worse: The commercial realities analysis doesn’t really capture the futility of behavioral remedies. Buying into the premise requires one to believe that publishers are better off with half a loaf today as opposed to nothing (or next to nothing) years down the line. And if you frame it in those terms, then Judge Brinkema’s logic makes sense.

The trouble is: I’m not sure there’s even half a loaf to be had here.

The Regulatory Flywheel

And if antitrust law won’t rein in big tech, who or what will?

• The U.S. Congress?

• The EU Commission?

• An act of god?

Round and round the flywheel goes. As spoken by the great philosophers of hair metal:

 I knew right from the beginning,

That you would end up winning.

Marketecture Live III

Marketecture Live is going BIG with our new partners: Adweek and TVREV.

Marketecture Live III: Consumers in Control takes place on March 10-11, 2026, at the Glasshouse in NYC.

• 2 Full Days

• 3 Tracks

• 1,000+ Attendees

• Celebrity Speakers

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

This newsletter is being written on an iPhone in an airport lounge so cut me some slack if there are typos. 

I was back in Northern Virginia today listening to the closing arguments in Google’s ad tech antitrust remedies trial. As I wrote after the conclusion of the 11-day evidentiary hearings, I went into today thinking it was a coin flip on whether Judge Brinkema would order an AdX spin-out or settle for behavioral remedies. After today I think Google’s going to get their way and there won’t be a spin out.

Before I go through the arguments made by each side I want to quote Brinkema at some length from her comments to the plaintiff’s counsel. She interrupted him early in his allotted hour time slot and said (may not be exact quote):

“Evidence shows time is of the essence. No one can predict three to five years from now.”

“What I’m really looking for from both sides is how quickly these remedies can come into effect.”

“With the looming damages and the New York court’s adoption of these findings, Google is in an impossible situation and will certainly appeal.”

“During appeal, which remedies would apply? Divestiture most likely would not be enforceable during appeal.“

This is the same line of thinking that I’ve had and have confirmed with lots of legal-adjacent folks. Essentially there is so much money now at stake in the civil cases (with treble damages FTW) and those cases are basing their findings on this ruling, that Google won’t settle this case no matter how beneficial it might be. They’ll fight this to the Supreme Court if necessary and that means years in which AdX and GAM stagnate. Meanwhile, the Judge is cognizant of the decline in open web ads and the threat of AI, and so, as she said, time is of the essence.

Behavioral remedies are more likely to be implemented even while an appeal continues. And, very importantly, the two sides are not very far apart on those remedies and Google’s revived proposal moved closer to the DOJ’s asks on some critical issues.

So if I had to predict right now we’re getting behavioral remedies that will be a compromise mix between the proposals of the two sides with no structural remedies.

The Plaintiff’s Closing

Plaintiff’s counsel started with the memorable statement “we know the narrative of Google as benevolent dictator is wrong.” He then proceeded to make the argument that divestiture was the only clean, safe, and permanent solution to the monopoly problem.

The most effective line of argument poked holes in behavioral proposals from Google. When Google says they won’t “intentionally” give themselves a latency advantage versus competitive exchanges, he asked, will the court be forced to judge every technical change against an intentionality standard? Similar points were made about AdWords bidding preferences that might take into account quality, privacy, and speed. Which of these criteria are legit and which are anti-competitive?

Google’s Closing

Karen Dunn gave a forceful and sharp closing argument for Google.

Addressing the judge’s concerns she went off script to kick off and stated “all of our proposals can be implemented within a year, except for programmatic guaranteed and private deals in prebid which will take 18 months.”

(Careful readers may note that the inclusion of these deal types into prebid was a notable omission from Google’s earlier proposals, one that would prevent meaningful migration away from AdX. Google revised their proposed settlement to address this criticism in their latest filings).

Mrs. Dunn spent a lot of time emphasizing that the remedies proposed by both sides overlapped and that Google was offering remedies that addressed many of the specific complaints from publishers and exchange witnesses. In contrast, she argued, a divestiture was extreme and risky.

Other arguments against divestiture:

• would include video and mobile ads which were not part of the monopoly findings

• no guarantee a buyer would keep the platforms at current levels of support

• 92% of publishers get GAM for free, no guarantee about what happens to them

Finally there’s the economic argument, which I’ve made as well. If Google doesn’t own AdX anymore then the efficiency that comes from vertical integration declines, advertiser ROAS goes down (on display), and AdWords dollars naturally shift to YouTube and other channels. A slide showing the percent of spend from AdWords shifting from display to YouTube was shown.

Other stuff we learned

A couple of nuggets caught my attention. In no particular order:

The two sides are already well underway in the process of picking a monitor who will assure whatever is ordered is properly administered. This monitor will then be able to hire a couple of technical advisors, so polish those resumes kids.

Google has accepted a six year monitoring period (original proposal was three).

In lieu of the open source auction proposal Google is pushing the idea of some kind of auditable log output (like a stack trace) from the ad server to allow publishers to validate why ads were served the way they were.

The DOJ has a sense of humor. They showed a slide to illustrate Google’s AI Overviews and its effect on publishers. The search term demonstrated was “how to monopolize a market .” LOL.

Google referred to friend-of-the-pod Steph Layser as “The Google Slayer.” Someone please run this through Nano Banana.

What’s next?

Expect a ruling from Brinkema in January or February. The publisher case in New York will get started around then as well. The Texas case is waiting on this Virginia ruling before moving forward, so figure we will hear more in the Spring. The EU case is supposedly not waiting for Virginia (because of, you know, sovereignty and stuff), but actually is, so I expect to hear about more delays in their ruling until early next year.

Everyone enjoy the holidays — except for Brinkema’s clerks.

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a regulatory analyst writing for The Monopoly Report.

The latest Monopoly Report podcast!

 This week, I welcome Vermont State Representative Monique Priestley. Monique and I talk about her multi-year crusade to bring a comprehensive privacy law to the State of Vermont.

The Eye of Sauron reaches Europe

Europe’s Privacy About-Face

As you may know, the EU has been contemplating a rethink of the GDPR and ePrivacy Directive. Max Schrems recently shared a leaked set of draft amendments crafted by the EU Commission — dubbed the "Digital Omnibus."

The Digital Omnibus draft contains changes aimed at simplifying compliance with EU data protection law. In many ways, the draft has lowered the compliance bar significantly. Unsurprisingly, privacy advocates and many others are completely up in arms over the proposed changes.

I’ll admit to a teeny bit of schadenfreude when it comes to certain European colleagues who may have to come to grips with the notion that the U.S. could end up setting a higher privacy bar than Europe pretty soon.

I want to caution that this is merely a leaked draft, and I can’t speak to its accuracy. Also, some of the ideas in here come off as a bit half-baked. I’d imagine that subsequent drafts will clean up some (and perhaps even all) of the ambiguities.

So, reader beware!

Marketecture Live is going BIG with our new partners: ADWEEK and TVREV.

Marketecture Live III: Consumers in Control takes place on March 10-11, 2026, at the Glasshouse in NYC.

• 2 Full Days

• 3 Tracks

• 1,000+ Attendees

Early Bird tickets now available

What changes are under consideration?

Regular readers of TMR know that I’ve been fairly critical of what I’ve characterized as Europe’s over-reliance on consent. And we’ve covered this on the podcast with Peter Craddock, Tobias Judin, and Robert Bateman. Anyway, here are a few of the Digital Omnibus changes to the GDPR that are likely to be important to those of us working in the ads space:

• Narrowing the definition of “personal data”: Under current GDPR rules, data is personal if anyone could reasonably identify someone from that data set. The proposed amendment adopts a more subjective test: Information only becomes personal data for controllers who can "reasonably likely" identify individuals using their specific capabilities.

  Alan’s Take: This “change” seems roughly in line with the recent CJEU ruling in the SRB case. But it does raise the question: Are pseudonymous advertising IDs still personal data under this proposal? And if not, does that pull a good deal of adtech data flows outside of the ruleset under EU data protection laws? (Note: The change to the definition of personal data is mitigated by some odd changes to the ePrivacy Directive.)

• ePrivacy / cookie rule changes: Under current law, the mere placement of a cookie or similar tracking technology on a browser or device requires a consent in most ad-related use cases under the ePrivacy Directive. The proposed Article 88a GDPR would erase the cookie provisions of ePrivacy and move the rules governing personal data processing on devices from ePrivacy's strict consent framework into GDPR's more flexible legal basis system.

  Alan’s Take: This approach would allow the placement of cookies under legitimate interest and could potentially render the IAB EU TCF to be partly, if not completely, obsolete. One of the weird outcomes of this is that non-personal data remains covered under ePrivacy, and therefore remains covered under the ePrivacy consent regime. It’s not really clear how this would work out in practice for the adtech and digital media world. But if advertising IDs were to fall outside the definition of personal data, then they’d still be covered under the ePrivacy’s consent requirements.

• Do Not Track is back!: The draft contemplates use of browser and mobile o/s-imposed consent preference signals. This is an idea that has repeatedly been discussed and then shouted down in Europe over the past 15 years, but which seems to have been resurrected perhaps due to the apparent “success” of Global Privacy Control signals in the U.S.

  Alan’s Take: Browser and mobile o/s controls are fine provided that there are provisions in place to ensure that the browsers aren’t able to use those controls to preference their own ad products.

  An odd loophole: There is an interesting exception / loophole the enables a "media organization" to effectively ignore the signal. As a result, data subjects would not have the right to refuse their online activity being processed for behavioral advertising purposes. It’s an intriguing idea and is perhaps designed to address one of the biggest issues with all these EU consent requirements: that they disproportionately impact the publisher community. But there are so many open questions that it’s almost impossible to ascertain the value of the idea.

  For example:

  (1) How is a “media organization” defined?

  (2) Is the exemption solely for media organizations, or is it applicable to companies supporting the media organizations?

  (3) Is the exemption designed solely to allow publishers to serve contextual ads (i.e., so as not to allow data subjects to opt-out from advertising)?

  (4) Can the opt-out signal be enacted without the user expressing a specific choice? Is it on by default?

There are other interesting and impactful provisions in the Digital Omnibus draft. For example, there are new rules for DSARs and sensitive data and AI. Subscribers to the full Chapell Report receive analysis of all that and more every month.

Stop flying blind when it comes to the regulatory environment in digital media. Click the ad to ping me about my syndicated research and analysis - The Chapell Report.

Why none of this matters…

But the big question is: Will EU Data Protection regulators “play ball” when it comes to these changes? Of course they won’t. So long as enforcement continues to be the domain of each EU data protection regulator, there will be headwinds to such changes. And let’s face it: None of EU member state regulators will be happy about these changes.

My guess is that most of them find creative ways to advocate for the concept of privacy as a fundamental human right regardless of what the text of the GDPR says. That’s not meant as a criticism of EU data protection regulators; they view themselves as protectors of the realm.

Look no further than Denmark’s recent response to the CJEU’s ruling on the definition of personal data. Say what you want about stubbornness or keeping true to the dogma of privacy or whatever. The regulators in Europe will almost certainly use their enforcement powers to complicate these new rules if they feel that such rules degrade EU privacy standards.

And that is a recipe for conflict, lack of consistency, and very little clarity.

Wanna take a guess regarding who benefits from the uncertainty?

_________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a regulatory analyst writing for The Monopoly Report.

The latest Monopoly Report podcast!

 This week, I welcome Cory Doctorow, a Canadian-British author, science fiction writer, activist, and journalist known for his work on technology, privacy, and digital rights. Cory joins the pod to talk about his latest book, Enshittification: Why Everything Suddenly Got Worse and What to Do About It. Cory shares his views on the three stages of enshittification, its root causes, and the underlying social movement that is critical to addressing (and perhaps even reversing) its impact. We also talk about some of the endemic challenges facing the digital ads space.

Know when to walk away - know when to run.

CTV is heading for a reckoning

If you work in the CTV space, please do me a favor. Go ahead and opt-out of your company’s ad targeting, profiling, sale/sharing, etc.

I’ll wait right here while you do.

OK. Done? How easy was it? Did your opt-out take effect? Would you know if your opt-out mechanism didn’t work?

Depending on your answers, it just might be time for you to have a chat with your legal folks. A bunch of different regulators are looking at your opt-out, and my guess is that that they aren’t nearly as sympathetic to the challenges of the CTV space as you are.

Leave me alone. Everything is just fine!

At the beginning of 2025, everything was warm and rosy for the CTV space. This era of good feelings was partly driven by the significant growth. And when Google announced a policy shift with respect to the use of probabilistic IDs within Google’s ecosystem, it signaled that Google wasn’t going to be sheriff of the CTV space.

So you might ask: Where’s the problem?

CTV = Wild West

In the ads space, we love our Wild West environments. Many ad tech OGs continue to fondly recount the days in ad tech before all these damn roadblocks were in place, back when REAL innovation was happening. Back before GDPR, and all those state laws… and before Google and Apple starting imposing rules.

Once those rules were imposed, CTV became kind of the oasis of the ad space. Like Montauk, circa 1990: an unspoiled beach.

But with all this growth, it was only a matter of time before regulators started to pay more attention to CTV. And it didn’t happen overnight.

Chapter 1: California’s Smart TV Enforcement Sweep

Almost two years ago (January 2024), California Attorney General Rob Bonta announced an investigative sweep of the smart TV space and sent letters to streaming app and device companies, alleging that they fail to comply with the CCPA opt-out requirements. The biggest concern was that companies don’t make opting out easy for consumers in a CTV environment.

That was the first shot across the bow.

Chapter 2: Europe Looks at CTV… and Shudders

In September 2025, the data protection authorities of The Netherlands, Hungary, Italy, and Liechtenstein published a report after a joint exploratory investigation into the smart TV space. The research focused on three “smart” televisions from different manufacturers, with a particular focus on data streams that are often not visible to consumers.

The investigation revealed pervasive data collection and ecosystem opacity that challenges fundamental privacy principles. A few things jumped out at me:

• Smart TVs collect a LOT of data (duh)

• Smart TVs often collect that data when the smart TV is off (uh oh).

• Regulators can’t figure out who to hold accountable, as you all seem to point the finger at each other (gotta love ad tech).

• Apps are being downloaded and pre-installed in ways that don’t make sense (sounds like what someone was saying about AppLovin).

Most of the allegations echo previous EU critiques of the desktop and mobile app ad tech markets. So on some level, there’s nothing new here. But that’s not really the point.

This is the second shot across the bow, as the report signals that regulatory focus is coming to the CTV space.

OK. You might be thinking: Sure, but European regulators don’t exactly move at the speed of light. And the EU folks have been complaining about the digital ads marketplace since at least 2002. So the fact that they have issues with the CTV space is a concern, but it might be closer to a 2030 concern than a 2026 concern.

Fair enough.

Click HERE to get a free 30 min strategy sesssion

Want a free 30 minute strategy or compliance session on privacy / regulatory in digital media? Click HERE to get smarter about how your business is impacted by privacy with Chapell & Associates.

Chapter 3: California ALSO focused on CTV

On Sept. 23, 2025, the California Privacy Protection Agency (CPPA) announced that a new set of rules and regulations were approved and would begin to take effect in January 2026. These new CCPA regulations cover off on a whole bunch of things, such as security audits, dark patterns, automated decision-making, and opt-out rules. (Hire a privacy pro to find out more.)

The part of this that’s really noteworthy is below:

Under these new CCPA regulations, if your company sells or shares personal information that it collects through a connected device (e.g., a smart television) you are required to provide opt-out notice in a manner that ensures that the consumer will encounter the notice before or at the time the device begins collecting the personal information that it sells or shares.

The biggest point I’m making is that California is formally declaring that CTV is on their radar in 2026.

So you can’t exactly say you weren’t warned. It’s coming.

Chapter 4: California brings it all full circle

On October 30, California Attorney General Rob Bonta announced a $530,000 settlement with Sling TV that just might be the event that gets the attention of the larger CTV space. The settlement addresses what prosecutors characterized as a systematic failure to provide meaningful opt-out mechanisms for data selling and sharing or for Sling’s use of third-party data for cross-context behavioral advertising.

I’m not here to praise or bury SlingTV. But I am here to say two things:

1. I suspect that Sling is not an outlier.

2. Regulators are clearly starting to notice.

What you choose to do with this information is up to you.

____________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a regulatory analyst writing for The Monopoly Report. Find me at Marketecture Live as Rob Leathern and I explain why FIRST-PARTY DATA IS BS!

The latest Monopoly Report podcast!

 This week, I welcome Connecticut State Senator James Maroney to the pod. The Senator and I talk about how and why he got involved in advocating for a privacy law in Connecticut, how those efforts were impacted by lobbying efforts, and how different states are collaborating to create the current U.S. state privacy and AI patchwork.

Are the AI robots helping you overthrow the incumbents — or are they here to eat your lunch? YES.

What’s the future of ad tech without the Sandbox?

In what most are describing as a complete non-event, Google announced last week that it’s all but shuttering the Privacy Sandbox initiative — on the same day that the UK Competition and Markets Authority closed the Sandbox case file. The responses from the ads space to this news have ranged from sentimental (i.e., happy for what we learned and friends made along the way) to snarky (i.e., Lucy pulling the football again). But the most noteworthy response to all this Google-imposed fun has been some flavor of “meh… we’ve got other things to worry about.”

It seems almost poetic that the AdCP agentic advertising effort was announced the very week the Sandbox sang its swan song. I’ll have more to say on AdCP down the road, but I can only hope that AdCP is evaluated via a more rational, fact-based lens than the Sandbox was by many around here.

Winners and Losers

I’m not going to write an entire piece on winners and losers, but I’ll say this: The only winner as far as I can see was Google. It’s great to be so rich and powerful that you can literally afford to burn money in order to force your competitors to use up so much of their time and resources. And to boot, they’ve managed to normalize the browser as an ad platform.

And the losers?

1. Privacy - Too many companies in the ads space are exactly where they were in 2019 when it comes to privacy. Sure, there are a number of engineers (though mostly at big companies) who have made incremental discoveries. But overall, the Sandbox effort didn’t move the ball forward on privacy. If you see it differently, please write an article to tell me how I’m wrong, and I’ll convince the Marketecture folks to publish the best one.

2. The companies that invested heavily in the Sandbox - I’m not trying to rub anyone’s nose in this. But if one wants to avoid repeating mistakes, one needs to acknowledge that mistakes were made. Some of this was mitigated by the fact that Google was literally paying many of those who participated in the Sandbox. But anyone that was hoping to get a leg up by mastering the Sandbox hadn’t been paying attention to Google’s approach to SEO over the past decade.

3. A few so-called thought leaders - I’m not going name names here, but there were more than a handful of industry thought leaders cajoling everyone to lean into and support Google’s plans unquestionably. Some of them went as far as to criticize journalists who wrote articles that were a bit skeptical of the value of the Sandbox tools. (Again, you know who you are. Do better.)

Stop flying blind when it comes to the regulatory environment in digital media. Click the ad to ping me about my syndicated research and analysis, The Chapell Report.

What does the future hold?

There are a number of interesting ideas that started to matriculate over the past few years. Some were born out of the confusion around Apple’s ATT and the Sandbox as more than a few companies placed bets on how the market would develop. For example:

• ID-Less - There was a period of time when it appeared that the UID was going away entirely. Given that this no longer appears to be the case, what’s next for these companies? There is certainly some value in having an ID-less solution in your tool kit. Does ID-less work as a standalone product? With the possible exception of AI contextual, I’m not sure.

• Privacy-Enhancing Technologies (PETs) - True, the Sandbox tools didn’t work at scale. But is there something to be said for cohort advertising or other PETs? I’m not sure here either. There’s a plausible argument that PETs don’t meaningfully address the privacy issues that consumers really care about (h/t Don Marti). And then there’s the problem that PETs tend to exacerbate the very trust issues that are endemic to the ads space.

• Clean Room Tech - Clean rooms suffer from some of the same issues as most other PETs when applied to the ads space. To the extent that they are viewed as a core component of ad tech moving forward, it’s worth noting the following: (1) they also don’t necessarily address user privacy concerns, (2) they muddy data flows, which can be good for privacy but makes it harder to engender trust, and (3) it’s not even clear which clean rooms address core legal requirements. For example, is the transfer of data into a clean room a sale of data under the CCPA?

• Enhanced / AI Contextual - I suspect that some might be sleeping on the power of these types of tools. They will be essential in any build toward agentic ads. While this tech can work in the absence of a UID, I suspect that the best implementations will continue to use one.

Does Privacy Matter?

About a year ago, I did a back-of-the-envelope evaluation of different tracking and targeting techniques being used. I measured each on two axes: privacy and business utility.

It seems like the chart below needs a refresh for a few reasons:

1. To better clarify what we mean by privacy, and

2. To focus more on the value of transparency and trust.

As many of us march into the agentic age, it’s more important than ever to have clarity on the above — or the ads space will be at risk of repeating the sins of the past.

______________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising, and music for decades, and I’m now a regulatory analyst writing for The Monopoly Report.

The latest Monopoly Report podcast!

 This week, we feature part 2 of my discussion with former FTC Chair Jon Leibowitz (part 1 is here). Jon defends Judge Mehta’s recent remedies decision in the Google search antitrust case and provides the origin story behind Google’s long-standing policy on device fingerprinting.

What good is a scarecrow if and when the birds have figured out that scarecrows can’t really stop them?

Learn how top brands achieve 41% higher brand lift and 55% stronger sales impact on average with Adelaide AU. Download the 2025 Outcomes Guide for 52 case studies and proven strategies to boost advertising performance using attention metrics.

When all else fails, put out a scarecrow

Last week, Ari Paparo predicted that Google won the ad tech remedies trial by bringing in Elizabeth Douglas, the CEO of wikiHow as a witness. I’ll admit: Bringing in the perspective of a smaller publisher was an effective counterbalance to the one offered by the News Corps of the world.

And while I still think Judge Brinkema is likely to require a divesture of AdX, I’m about as confident in that prediction as Charlie Brown heading into Thanksgiving.

Whether Google’s strategy here was effective in convincing Judge Brinkema that long-tail publishers’ existences come to an end without Google’s tender caress is debatable. I find it ironic that whatever hassle an AdX divestment may cause for wikiHow will likely pale in comparison to the devastation being caused by AI Overviews.

But that also demonstrates one of the more frustrating limits to antitrust law: Whatever issues raised by the loss of traffic are largely irrelevant in the ad tech trial. If anything, those issues were already adjudicated by Judge Mehta in the search remedies trial.

So when I get asked about the impact of Google’s recent antitrust trials, my answer is to look beyond what’s taking place in the courtrooms.

What’s one less remedy amongst friends?

Here’s the dirty little secret — and one of the reasons that publishers (hell, most content creators) are so sullen these days. While even a child can probably see that what’s happening to content creators is flat-out wrong on many levels, the law isn’t providing much in the way of solutions.

• Copyright? Meh, we need to win the AI war against China.

• Antitrust? Kanter and Kahn left the building, and the rules remain stacked in favor of the biggest players.

• Non-U.S. competition law? The President is being mean. And anyway, Europeans are stuck with U.S. tech.

• Congress to pass new laws? Wait — are those guys still around?

• Section 230 or Privacy Law? LOL.

There’s just not much to be excited about if you’re a content creator. The closest thing to an optimistic observation I’ve heard recently was that extinction events normally take much longer than the conventional wisdom tends to believe.

Cloudflare steps into the void

The internet was built on a handshake deal between publishers and search engines. I won’t go through all of that background and history here, but I suggest you read Search Engine Land’s take. What’s important here is that incentives have changed — and that big tech is exploiting the opacity of a system that might as well have been designed by Native Americans in 1650.

If you’re reading this, you’re probably aware of Cloudflare, a CDN that powers internet requests for millions of websites and serves 78 million HTTP requests per second on average. Cloudflare manages approximately 20% of internet traffic, so that the company’s policies will automatically apply to millions of domains. This gives the company a fair amount of leverage to help publishers reshape how AI models access and use web content.

Ricky Sutton and I recently chatted with William Allen, Cloudflare’s Chief Product Officer, to discuss what Cloudflare is attempting — specifically, its Content Signals Policy and pay-per-crawl program. You can find that discussion here.

Content Signals and pay per crawl

The Content Signals Policy is designed to transform the traditional robots.txt file from a polite request into what the company describes as closer to a contractual obligation. When a website owner specifies that AI crawlers should not access their content, Cloudflare enables the pub to potentially treat those violations as a breach of contract rather than mere technical inconvenience.

Think of it as a scarecrow — or a “get off my lawn” sign.

The pay-per-crawl system takes this concept further by introducing direct monetization. Publishers will be able to set specific fees for AI companies that want to access their content for training purposes. The idea is to create a marketplace where data has explicit value rather than being treated as a free resource ripe for harvesting.

AI Labyrinth

Cloudflare has also deployed what it calls "AI Labyrinth" — a honeypot system that feeds unauthorized crawlers convincing but fabricated content. Instead of blocking suspicious bots outright, the system wastes their computational resources on AI-generated pages that appear legitimate but contain no actual value. This approach mirrors classic cybersecurity tactics, turning the tables on scrapers by making unauthorized access costly and inefficient.

But the question remains: Will these technical measures prove to be an effective scarecrow that deters unauthorized scraping from AI bots? Or will they ultimately carry all the weight of a do-not-track signal?

The power imbalance between pubs and AI companies

For publishers, these tools offer something they've desperately needed: agency. The current system essentially forces content creators to choose between allowing unrestricted AI access or risking reduced search visibility. Many publishers have watched their content fuel AI models that compete directly with their traffic and revenue streams, all while bearing the computational costs of serving bot requests.

The DOJ proposed addressing this issue as part of its antitrust remedies against Google, potentially requiring the company to separate its search indexing from AI training activities. Such a separation could have given Cloudflare's tools much more practical utility, allowing publishers to block AI training while maintaining search visibility.

Without that separation, Cloudflare’s tools seem to fall into the “well, it’s a start” category.

Understand the regulatory environment underpinning the strategy of big tech. Click the ad to ping me about my syndicated research and analysis, The Chapell Report.

How will all of this work (or will it)?

The most optimistic outcome for pubs is the continued shift toward more explicit content licensing arrangements, with AI companies building direct relationships with major publishers while smaller sites rely on platform-level protections like those provided by Cloudflare. And maybe… just maybe, a market develops for smaller pubs.

The thing that intrigues me about these tools is that they make it more difficult for AI platforms to pretend that publishers are OK with having their content scraped without compensation. They might even provide a formal legal mechanism for publishers seeking to assert those rights via litigation.

And that might be the true legacy of the Google antitrust cases — events that helped pubs realize that the law ain’t coming to save them.

In that way, the trials and Cloudflare’s tools serve as a rallying call toward collective action.

Learn how top brands achieve 41% higher brand lift and 55% stronger sales impact on average with Adelaide AU. Download the 2025 Outcomes Guide for 52 case studies and proven strategies to boost advertising performance using attention metrics.

_________________________________________________________________________

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

This is the coverage of the remedies trial in US v. Google. I’ll be in Virginia writing every day on the courtroom activities.

Day 5: Nothing happened but there are charts

Today we heard from two interesting witnesses about the technical feasibility of the DOJ proposed remedies. I guess I’m not being fair by characterizing today’s newsletter as “nothing happened,” but compared to the fireworks yesterday, it is a bit of a dull update. To spice things up a little, I’m going to highlight some charts that I referenced previously but just came online (shout out to Arielle at Checkmyads for all the indexing).

Chart 1: AdWords and DV360 Spend All their Budget on AdX

This chart from the expert report of Professor Robin Lee shows that 89% of AdWords display spend ends up on AdX and 63% of DV360’s does as well. Keep in mind that the DV360 number is just for display, so if you add in the YouTube spend (which we learned is now 3-4x the display spend) you realize that DV360 is essentially a powerful tool for buying Google inventory, and not much else.

Chart 2: AdWords and DV360 Combined Represent 67% of all Display Ads

A second chart prepared by Professor Lee shows that not only do the Google tools send all their demand to AdX, but also they make up 2/3 of the entire market! Important caveat this is open web display, so PMPs and other deal types are possibly (?) excluded.

Chart 3: Overall Google Spend Migrating to YouTube

Google’s expert witness Lerner (who has not yet testified) produced this chart, showing that ex-search, AdWords is increasingly spending all its budget on YouTube. I believe this is the first time this data has been shown. “Indirect Open Web Display” is $600-700 million per month which puts AdX gross revenue from AdWords at $7ish billion per year ($650×12×90% to AdX).

Also noteworthy how in-app had very little growth during a period when AppLovin reached a $200 billion market cap. That’s a miss!

Does anyone know what “Other Google O&O” is mostly? Maps is my guess, which would put it at a cool billion/month.

Chart 4: DV360 Spend by Type

This is the chart I tweeted about earlier this week, showing DV360’s spend by type. “Open” display is flat at ~$4 billion run rate while “Open Prog. Direct” is growing and should cross that number soon, so let’s call display $8 billion total. YouTube is a monster, at over $10 billion. Add it all up and eyeball it to about $20 billion. Note: this is more than in my twitter thread because I didn’t have the chart handy and was going by my notes.

Witness #11: Michael Racic, President of Prebid.org

Now that the charts are out of the way, let’s get to the witnesses. Racic is the head of Prebid and he spent his testimony talking about how Prebid operates and governs itself, and why it is a good future owner of the proposed open sourced DFP “final auction logic,” whatever that is.

There really wasn’t much controversy here and I think the judge would be predisposed to accept that Prebid will be a good home for this, in the event that remedy comes to fruition.

Witness #12: Goranka Bjedov, Expert in Software

This expert witness had long stints at both Google and Facebook and managed many complex software migrations and other projects. She gave opinions about how long some of the proposed remedies would take (time from start of those initiatives, not elapsed time):

• Develop APIs for migrating data: 18 months

• Open sourcing the final auction logic: 24 months

• AdX migration: 18 months

• DFP migration: 24 months

Overall she was very credible and gave meaningful examples of projects she had worked on, such as the Instagram migration to Facebook’s cloud. I had to leave a bit early so I didn’t see the cross-examination, but I assume they are going to try to make her look like she’s never seen a computer in her life.

Who won week one?

The DOJ case is almost wrapped up and will likely finish Monday. Even though several of their witnesses were contradictory, I think they got their key points across. Namely, that Google’s remedies are insufficient, and that their proposed remedies are feasible. I don’t think they convinced the judge that their remedies are necessary, however.