What GDPR and other privacy regulations were supposed to do, what the industry actually did, and why nobody stopped the dance

By Luca Passani, @Scientia_CTO, August 2026

Note: The audience activation machinery I toured in the last – three – articles rests on three assurances: that the user consented (the consent string riding in every bid request), that nobody knows who the user is  (the hashed email), and that nobody targets the user individually — only as a member of a group (the cohort). This article examines whether the foundation it stands on actually holds up to regulatory scrutiny.
I mentioned that ad tech companies should treat personal data with the same care reserved for hazmat, but never explained why in significant detail. Yet, this is a foundational topic for everyone working in programmatic. It’s time for the deep dive.
Important: Grab a coffee — this is a long article.

In case you didn’t read the previous installments of this series and still don’t know what behavioral targeting is, it’s the practice of tracking what you do online — the articles you read, the products you browse, the searches you run — and using that history to serve you ads that reflect what advertisers think they know about you. The profile that emerges over time can include inferred details about your health, your finances, your political views, and your personal circumstances, none of which you explicitly provided to anyone. The next time an ad for a mortgage refinancing service follows you around the internet for a week after you looked up interest rates once, that’s behavioral targeting at work. It’s useful to advertisers, invisible to most users, and — depending on who you ask — either the engine of the free internet or a surveillance apparatus that would have made Cold War intelligence agencies jealous.

Note: the Frada scenario from the previous articles is behavioral advertising. Sloane gets targeted because of her purchase history. We showed how targeting can be further split into deterministic and probabilistic, i.e. two aspects of behavioral targeting.

Now that you know what behavioral targeting is, should governments do something about it?

We have a lot of ground to cover. I will get back to this later in this long article. To answer it properly, we need to understand why regulation happened, what the industry did with it, and why tracking survived anyway. Each of those is a shorter story than you think.

Let’s backtrack.

Why regulation happened — The Snowden revelations and Cambridge Analytica

GDPR — EU’s General Data Protection Regulation, arguably the mother of all privacy laws —  didn’t appear out of nowhere. The European Union had been working on updating its 1995 Data Protection Directive for years, driven by a growing unease about what the internet had become — a vast, largely unregulated machine for harvesting personal data at industrial scale.

From a US perspective, everything Europeans do is often excruciatingly complicated. The logic “we don’t know if it hurts. Let’s try and see for ourselves” just doesn’t apply to Europe. They are more like “This might hurt. Let’s err on the side of not doing it”.

If you are American, don’t rush to pass a judgment on the inhabitants of the Old World. That mindset is rooted in Europe’s 20th-century history. The Gestapo, the Stasi, the OVRA, Franco’s secret police — all ran on index cards, registries, and census data. The EU’s attitude toward mass data collection is shaped by the knowledge that the infrastructure of surveillance has been used, on European soil, within living memory, to round people up and kill them. Americans generally don’t have that reference point; Europeans do. This is why the EU treats “who has your data” as a question of a fundamentally different kind than “who has your credit score”. For Europeans, data protection is a fundamental human right. For Americans, well, not so much.

In that context, the Snowden revelations of 2013 accelerated everything. Suddenly it was clear to everyone that the data commercial platforms collected about you could be freely accessed by a foreign power. In a worst-case, kind of dystopic future, personal data could be turned against European citizens.

But that wasn’t the end of it. In late 2016 and throughout 2017, the Cambridge Analytica story was slowly coming into focus. Brexit and Trump’s first election depicted the power of personal data very vividly — the synergy of behavioral psychology, social media data harvesting and advertising targeting had created a machine that could change election results. The company had largely operated within the loose rules and technical permissions that existed at the time, yet something mind-boggling had happened.

The Cambridge Analytica scandal was the most vivid possible demonstration of why GDPR existed, arriving at the exact moment the regulation was about to take effect (GDPR was adopted in 2016 and came into force in May 2018). If you were trying to build public support for a sweeping privacy law, you couldn’t have scripted the timing better.

If you are a white-collar professional, chances are that you already associate GDPR with “the European take on user privacy”. For this reason, I have put a short primer into an appendix of its own. The rest of this article stands on its own, but I still recommend that you have a look at it later. It will prepare you to endure privacy law discussions without looking foolish.

Note:  A patient’s diagnosis and an IP address in a log file are both personal data, but they are obviously not the same problem. Yet, here’s the part that often gets lost in my personal experience: GDPR is risk-based, and it says so itself. Special categories get a near-prohibition, security has to match the risk, impact assessments are triggered by high risk, and breach-notification thresholds are graded.

One important clarification before continuing: the cookie banners you encounter on every European website are not primarily a GDPR requirement. They are a requirement of the ePrivacy Directive — a separate EU law, originally from 2002 and amended in 2009, that specifically governs the use of cookies and tracking technologies. GDPR governs the processing of personal data broadly. ePrivacy governs the specific act of accessing or storing information on a user’s device. The two laws work in combination: ePrivacy requires consent for placing a cookie, and GDPR governs what you do with the data that cookie collects.

Privacy Regulations in the U.S.

The US doesn’t really have a “privacy law” in the European sense. It has a patchwork. And that patchwork reflects a fundamentally different starting philosophy. European privacy law starts from the person: data about you is an extension of you, and you retain rights in it regardless of who holds it. 

American privacy law starts from the relationship between the parties and the context: is there a contract, a tort (a civil wrong one can sue over), a specific sectoral harm? The seminal Warren & Brandeis article from 1890 framed privacy as “the right to be let alone”, i.e. a liberty against the state, not a property right in personal information held by private companies. That framing has stuck. Interestingly, even the First Amendment cuts hard against European-style data rules: in the US, information (and that includes information about you) is speech, and restricting its flow triggers serious constitutional scrutiny. This is why a generalized, GDPR-style “right to be forgotten” might be declared unconstitutional in the US; it’s compelled suppression of truthful information by private publishers.

Yet, with the advent of the Internet, and then machine learning, the need to regulate at least some aspects of personal information has become clear. The federal government’s failure to regulate the sector has brought the individual states to act, leading to a sectoral patchwork of privacy regulations. Instead of one omnibus (comprehensive) law, the US regulates privacy industry by industry, each statute born of a specific scandal or lobbying episode. The following table provides an overview.

Table 1: Sectoral patchwork of US privacy regulations.

Nothing covers the general category of “a company has data about you”. An ad tech firm profiling your browsing isn’t a covered entity under any of these. In fact, there’s no privacy enforcement federal agency with this name, though the Federal Trade Commission (FTC) has become the de facto US privacy regulator via Section 5 of the FTC Act, which prohibits “unfair or deceptive” practices. 

The FTC can’t make rules easily, but it can bring enforcement actions when companies violate their own posted privacy policies.

Note: This creates a strange incentive: the less a company promises, the less liability it has. A company with no privacy policy is in a better legal position than one with a detailed one it slightly breaches. This is roughly the opposite of the GDPR incentive structure.

Because of US Congress’s repeated failure to pass an omnibus federal privacy law (ADPPA came closest in 2022 and died), states have filled the vacuum. In addition to the GDPR-likes, some other state laws are worth mentioning.

Table 2: Major US state-level regulations dealing with personal data.

The California Invasion of Privacy Act (CIPA) also deserves a special mention. Enacted in 1967 to prevent wiretapping, this statute is being reinterpreted by class action attorneys to cover analytics pixels, session replay tools, and identity graph lookups. Under CIPA, you don’t need a regulator to bring a case and you don’t need to prove you were actually hurt. Any affected user can sue directly and collect a fixed cash payout per violation. Multiply that across a class of millions of users and the numbers get very large, very fast. As of 2026, CIPA claims are reaching even small and mid-sized adtech players, and recent rulings have opened the door to challenges against hashed email addresses and UID2 tokens.

Note: One way to look at this is that the US is catching up to Europe on consent requirements faster than most of the industry acknowledges, driven by litigation, not legislation. Then again, this observation might age poorly if the California legislature shuts down the novel interpretation of CIPA six months from now (August 2026). 

For tech titans this situation is pretty bad: a growing patchwork of 20-ish state regimes plus GDPR plus sectoral federal laws. For smaller companies it’s even worse — they face the same maze without the legal armies the giants throw at it. Serving a global internet audience is an absolute nightmare for them.

In fairness to Americans, GDPR is not a monolith either. A number of milestone rulings shaped how GDPR is interpreted and enforced in practice, and made complying with GDPR a lot harder for US companies that serve European customers. Here’s a list of the main rulings.

Table 3: Major rulings that shaped how GDPR is interpreted and enforced in practice, making the lives of US players somewhat complicated.

Note: Max Schrems’s story warrants an additional note. As an Austrian law student on exchange in California in 2011, he was appalled to discover that Facebook’s own privacy lawyer didn’t know beans about EU privacy regulations and their severity (or he probably did, but knew that European fines were chump change for his client). Max filed a subject access request (it was already possible at the time) and got back a CD-ROM from Facebook with over 1,200 pages, including material he thought he had deleted. Next thing we know, he turned into a privacy activist who challenged the legality of data transfers between the EU and the US successfully (Schrems I and Schrems II invalidated transatlantic data exchange rules in force at the time). US companies did — and in many cases still do — treat EU privacy regulations as an inconvenience rather than a fundamental constraint. Schrems’s shock at the complacency in 2011 was emblematic.

If a US company is processing any user data on behalf of an EU entity — even something as simple as an analytics pixel embedded in a website —, this makes the US entity a data processor under GDPR, i.e. they are handling the personal data of European citizens.

Any US company that processes personal data on behalf of a European entity is operating under a legal framework that has already been invalidated twice by Europe’s highest court. Safe Harbour, the original EU-US data transfer agreement, was struck down in 2015. Privacy Shield, its replacement, was struck down in 2020. The current framework — the Data Privacy Framework (DPF), adopted in 2023 — survived its first legal challenge in September 2025, but the appeal is already before the Court of Justice of the EU, the same court that invalidated the two prior frameworks. The core problem has never changed: US surveillance law gives American intelligence agencies access to data held by US companies, and European courts have repeatedly found that this access is incompatible with EU privacy rights. Max Schrems himself has suggested he may not even need to bring a formal challenge — that the Trump administration’s dismantling of the independent oversight bodies that underpin the current framework may be enough for the European Commission to suspend the deal on its own. Experts who worked on the current framework have said the US has gone as far as it believes it can go to meet EU standards, making another round of negotiations unlikely if the DPF falls. Which means any US ad tech company telling a European publisher “your data is safe with us” is making a promise whose legal foundation has a documented habit of disappearing.

Figure: The legal basis for transatlantic data transfers being struck down, replaced, and challenged again over the years.

In short, at this moment, any US company’s ambition to act as the data processor for a European entity is walking on legally thin ice.

Note: In spite of all this, the cycle continues. And the industry keeps running regardless.

Skeletons in the closet 

At this point, you might have the impression that whoever designed GDPR was driven by specific social and political causes. And this is partly true, but it’s not the whole story. A more cynical view would also look at the geopolitical-economic layer that brought GDPR to its current interpretation.

Hyperscalers (and lack thereof)

Hyperscalers are massive companies that build and run digital infrastructure at such an extreme scale that it reshapes the whole economy.  I’m sure you are already familiar with their names. Amazon/AWS, Microsoft/Azure and Google/GCP are cloud hyperscalers and, together, they control about 65% of the global cloud. Meta, Google and Amazon are social media (and hence ad tech) hyperscalers. NVIDIA, a hyperscaler in AI hardware, is worth ~2x the Italian GDP by itself. If I was to look at Asia, TikTok, Alibaba and Tencent also fully deserve the hyperscaler title.

Note: here’s a quick test: If a company can crash 5% or more of the internet by turning off its servers, it’s a hyperscaler.

Some historical analogues would be Standard Oil, US Steel and AT&T.

If we count Europe’s hyperscalers, we will soon discover that United Europe is an economic powerhouse that, over the past 30 years, has egregiously failed to create globally relevant Internet companies. The reality — the unflattering motivation behind GDPR — was never purely about protecting individual privacy. It was also about power. Europe watched the rise of Google, Facebook, Amazon, and Microsoft and recognized that it had allowed the most valuable resource of the 21st century — data — to be harvested from European citizens and monetized by American companies, generating enormous economic value that flowed entirely outside the EU. 

Note: Some EU policymakers were openly explicit about this — Andreas Schwab, one of the architects of the Digital Markets Act, stated early on his desire to counter the dominance of US firms. The GDPR, the DMA (Digital Markets Act), the DSA (Digital Services Act) and the AI Act are not a disconnected series of consumer protection measures. They are, taken together, a deliberate industrial and geopolitical strategy. The US dominates global data traffic via its digital platforms and, thanks to the CLOUD Act, has extensive access rights to data from US tech companies even when they operate outside the US. GDPR was Europe’s answer to that asymmetry — an attempt to reassert sovereignty over data flows that had been quietly leaving the continent for two decades.

This is not a conspiracy theory or an outside interpretation. The European Commission’s own January 2026 Call for Evidence on digital ecosystems stated plainly that the EU faces “a significant problem of dependence on non-EU countries in the digital sphere” that creates vulnerabilities in critical sectors — language that would have been unthinkable in an official Commission document a decade ago. The privacy framing is real and sincere. But it has always coexisted with something that looks a great deal like industrial policy.

A few notes about the DMA, DSA and AI act

The DMA and DSA, both adopted in 2022, are worth distinguishing from GDPR. Where GDPR protects individuals’ personal data and applies to any organization that processes it, the DMA and DSA target a specific problem: the structural dominance of a handful of platforms. The DMA designates walled garden companies as “gatekeepers” — Google, Meta, Amazon, Apple, Microsoft, ByteDance (TikTok) — and specifically restricts how they can combine user data across their services, self-preference their own products, or use data obtained in one service to target users in another. 

For behavioral advertising, the practical consequence is significant: the DMA is why Meta was forced to introduce its “consent or pay” model in Europe. The DSA goes further in a different direction — it adds transparency requirements for algorithmic recommendation systems and bans certain targeting categories entirely across all platforms, not just gatekeepers: religion, sexual orientation and, notably, political opinion. The ban on targeting based on political opinion was a direct regulatory response to the Cambridge Analytica scandal I mentioned at the beginning of the article. 

The AI Act, the most recent addition to this regulatory stack, extends oversight to automated decision-making systems including those used for ad targeting and profiling. Taken together these four instruments — GDPR, DMA, DSA, AI Act — form a regulatory architecture that no other jurisdiction has attempted at this scale.

Note: Of course, the US perspective on all this is somewhat less flattering: Europe’s response to each successive wave of technological disruption has been consistent: regulate what you cannot build.

The Americans’ skeleton in the closet

If GDPR is partly industrial policy for a bloc without hyperscalers, the absence of a US GDPR is the mirror image: the US has the hyperscalers, and an omnibus privacy law would hobble them. This isn’t cynical speculation. Rather, it’s visible in the lobbying record against attempts to pass ADPPA, i.e. GDPR-style privacy regulation at the federal level. Silicon Valley prefers the current patchwork because it’s navigable by firms with large legal departments and because sectoral law leaves the ad tech and data broker industries almost entirely unregulated. The consumer-data industry in the US (Acxiom, LiveRamp, Experian’s marketing arm, etc.) essentially could not exist in its current form under GDPR.

What the industry built

So, should governments do something about behavioral targeting?

The honest answer is: they already did, and the results are instructive. GDPR is the most ambitious attempt to regulate behavioral targeting at scale. It has been in force for seven years. In those seven years, the cookie banner has become the universal symbol of the law’s practical effect: a piece of UX theater that most users click through in under three seconds without reading. It is a performance that resolves nothing, staged for an audience that decides nothing. Its primary function is to generate a consent signal that travels through the bid stream as a legal fig leaf. We already met the cookie banner (AKA Consent Management Platform, or CMP) back in the supply-side article as a working part of the publisher’s machinery. The regulation that was supposed to give users meaningful control over their data produced, in practice, a compliance industry worth billions of euros and a user experience that is almost universally despised (you click on those dialog boxes dozens of times every day, or more if you are in Europe).

This is not because GDPR was poorly written. It’s because the incentives of the parties responsible for implementing it were never aligned with its stated goals. Publishers need revenue. CMPs are paid by publishers. Consent rates are how CMPs are evaluated. 

The result is a market for consent UI that optimizes relentlessly for acceptance rather than genuine informed choice. The dark patterns we already saw in this article — pre-ticked boxes, buried reject options, asymmetric button sizes, endless layered menus — are not accidents. They are the rational output of a system where the entity collecting consent profits from its volume.

Underlying all of this is a concept that sits at the heart of every regulatory dispute in this space: profiling. 

Note: Under GDPR, profiling means any automated processing of personal data used to evaluate, analyze, or predict aspects of a person’s behavior. Behavioral targeting is profiling by definition, but the term identifies a wider set. Profiling includes automated processing of personal data to evaluate, analyze or predict aspects of a person: behavior, preferences, interests, health, economic situation, reliability, location, movements. Credit scoring is profiling. Insurance risk rating is profiling. Fraud detection is profiling. A hospital predicting readmission risk is profiling. None of those are advertising. 

The moment identification stops being an analytics tool and starts being an input into a model that predicts what you might buy, where you might travel, or what political message might move you — that’s profiling. And profiling for advertising purposes is precisely the processing that courts have found cannot be justified under legitimate interests, cannot be buried in a third-level consent menu, and cannot be delegated to a publisher contract. It is the specific activity that the entire consent infrastructure exists to authorize. And as we’ve seen, it does so imperfectly at best. 

The regulation’s architects were not naive. IAB Europe’s Transparency and Consent Framework (TCF) is an attempt to systematize consent across the programmatic supply chain — a shared language for communicating user choices downstream to every SSP and DSP in the chain. 

The Belgian DPA’s finding that the TCF was non-compliant with GDPR in important respects was the regulation eating its own implementation. And if the TCF was to fall, the darkly ironic consequence is that Google’s parallel consent infrastructure would become the only viable alternative. This is the (arguably predictable) outcome of a system where the largest player has the resources to build compliant infrastructure and smaller players do not.

So should governments regulate behavioral targeting? And if so, has GDPR done it effectively? We’ll see about that. The gap between the law’s stated purpose and its practical effect is the space that the industry calls “compliance” and regulators call “enforcement failure”. Closing that gap would require either much heavier enforcement — the kind that actually threatens business models, not the kind that results in fines Google pays out of a week’s revenue — or a fundamentally different regulatory approach that starts from the incentive structure rather than the “consent interface”.

More on Consent Management Platforms (CMP) and TCF: the infrastructure of the performance

As you know, a CMP is the technology that sits between a user arriving on a publisher’s page and the advertising ecosystem waiting to bid on that user’s impression. When you land on a news site and a banner appears asking whether you accept cookies, that banner was served by a CMP. When you click accept (or reject), the CMP records your choice, encodes it into a standardized string called a TC (Transparency and Consent) string — defined by IAB Europe’s Transparency and Consent Framework — and makes that string available to every piece of ad tech running on the page. SSPs, DSPs, identity providers, measurement vendors — all of them read the TC string to determine what they are and are not permitted to do with your data.

A TC string is encoded and opaque, and could look something like:

CQliWsAQliWsAEsABBENCiFoAPLA AELAAAYgGMwAwAOALzAYyBecAEBeYAAA .IGMwAwAOALzAYyAA

It travels in the euconsent-v2 cookie, comes out of the CMP’s JS API as tcString, and reaches the bid stream in user.ext.consent alongside regs.ext.gdpr=1 — user.consent and regs.gdpr in OpenRTB 2.6.

The Global Vendor List (GVL) is a list of approved vendors that CMPs obtain from IAB Europe. It lists all registered and approved Vendors as well as the categories of data collected in conjunction with the purposes. CMPs rely on the GVL to determine what legal disclosures must be made to the user.

Decoded bit by bit, the following will give you an idea of what information a TC string carries in cleartext.

(*) The purpose numbers are the part worth spelling out: 1 store and/or access information on a device, 2 use limited data to select advertising, 3 create profiles for personalized advertising, 4 use profiles to select personalized advertising, 7 measure advertising performance, 9 understand audiences through statistics, 10 develop and improve services.
So in plain English: a German publisher’s English-language banner, screen one, on 9 June 2026, recorded that this user agreed to have a profile built about them and used to pick ads, agreed to be geolocated precisely, and agreed to three named vendors. Purposes 3 and 4 are behavioral targeting itself. That pair is the consent the whole apparatus exists to produce.

Table 4:  TC string demystified.

In principle, this is an elegant piece of infrastructure. A single consent event at the moment of page load propagates the user’s choices throughout the entire supply chain. No SSP needs to ask for consent independently. The publisher’s CMP handles it once, and everyone downstream trusts the result.

In practice, the system has three structural problems.

First, the consent interface is not neutral. CMPs are evaluated and chosen by publishers partly on the basis of consent rates — the percentage of users who click accept. This creates a direct commercial incentive to design interfaces that maximize acceptance rather than informed choice. The IAB’s own research has shown that the way choices are presented has a dramatic effect on outcomes, which is precisely why regulators have focused on dark patterns. A consent rate of 85% on a banner that buries the reject option in a third-level menu is not evidence of user preference. It is evidence of interface design.

Figure: CMP’s dark patterns in action (see the supply-side article for details). 

Second, the TC string is self-reported and non-binding. A publisher or CMP that generates a TC string claiming full user consent has no independent verification mechanism checking that claim. The string travels through the bid stream and is trusted by every downstream system. To be fair, “unpoliced” would be too strong: IAB Europe runs a compliance program — CMPs must pass validation before receiving an ID, live implementations are monitored, unresolved breaches can end in suspension from the framework, and a compliance report is published. But this is contractual self-regulation, not law, and none of it verifies the thing that matters most: whether the string’s content faithfully reflects what the human actually chose. The enforcement checks the plumbing; the claim itself remains an assertion.

Third, the consent signal degrades as it moves through the stack. A TC string generated by a CMP on a publisher’s page may reflect a consent choice made weeks or months ago. Users who consented once and then changed their mind, cleared their cookies, or simply forgot they had a choice are still represented in the bid stream by their original string. The consent is technically present. The human behind it may have long since moved on.

None of this is solved, and there’s no sign it will be. What the market has produced instead is consolidation: a handful of platforms compete on positioning, not on fixing the consent problem.

Table 5: Main Consent Management Platform (CMP) vendors in 2026.

A quick note on how things are for real out there

If a user rejects cookies on every site they visit for weeks but clicks “Accept” once in a distracted moment, that single lapse generates a valid consent string that travels through the entire programmatic stack — and may still be doing so months later. But there is more. Anyone who has spent time reading publishers’ privacy policies — including those of major ones — will find policies that claim no data is shared with third parties while simultaneously running a full programmatic stack with dozens of SSPs, DSPs, and data vendors. You will find CCPA disclosure tables marking every data category as ‘not collected’ on sites that demonstrably collect all of it. You will find GDPR boilerplate bolted onto decade-old policies written before real-time bidding existed. This is not the behavior of companies trying to comply and falling short. It is the rational output of a system where the probability of enforcement is low, the cost of genuine compliance is high, and the competitive disadvantage of being more transparent than your peers is real. Even Google, which imposes technical consent requirements on publishers using its ad stack, has no mechanism — and no incentive — to ensure that what those publishers tell their users in a privacy policy matches what actually happens on their pages. The gap between what publishers tell their users and what actually happens on their pages is not an edge case. It’s the norm. Once consent is obtained one way or another, the identity graph kicks in.

Once the CMP has recorded a consent string, the identity machinery we spent an entire article on performs the actual work of tracking users. This is the work of companies such as The Trade Desk (UID2), LiveRamp (RampID), ID5 and their kin. Where third-party cookies are still available, these systems use them alongside other signals. Where cookies are blocked or unavailable, they fall back to persistent identifiers built on hashed email addresses and other deterministic and probabilistic signals.

The industry has built databases that link various identifiers to create a single, unified view of a consumer across different devices and “touchpoints”. These databases are, of course, the Identity Graphs (or ID graphs) we have already met.

Note: One way to look at it is that the identity graph is not so much a replacement for the cookie as a hedge against its unreliability.

We already mentioned that cookies — the quintessential deterministic signal that made behavioral targeting possible at scale — are blocked in some browsers and unreliable in others. The third-party cookie’s decline was driven not by regulators but by browsers. Apple’s Safari and Mozilla’s Firefox blocked third-party cookies years ago. 

Note: the ad tech crowd refers to this development as signal loss.

Google announced it would follow, then walked back its deprecation plans in 2025: Chrome — still the dominant browser — keeps cookies for the foreseeable future. So the cookie is not dead, but the machinery is blind in entire browsers regardless of what Chrome does.

Pseudonymization and PETs (Privacy Enhancing Technologies) 

While identity graph providers could easily store direct identifiers like the names and physical addresses of users, they typically discard that information. This is called pseudonymization and, in their expectations, this aligns them with privacy regulations.  However, from a regulatory perspective (especially under GDPR), simply removing a name doesn’t automatically make the data “compliant” or non-personal. 

In an identity graph, the goal is to link different signals to the same person. This inherent purpose — linkability — is exactly what regulators look for when determining if data is still “personal”.

• The AdTech Argument: “We don’t know this is Luca Passani; we just know it’s ID_88329_X. Therefore, his privacy is protected”.
  
• The Regulatory Reality: If you can distinguish ID_88329_X from every other person in the graph and target them with a specific ad, you have “singled them out”. Under GDPR, if a person can be singled out, the data is still personal, even if you don’t have their name in the database.

To navigate this, graph providers use several technical layers to distance themselves from direct identifiers.  

These techniques are called PETs or Privacy Enhancing Technologies. PETs’ scope goes beyond advertising and covering them here is outside the scope of this document. The following list will give you an approximate idea of the main PET parts that apply to programmatic.

Table 6: (partial) list of main PETs (Privacy Enhancing Technologies).

Note: whether PETs count as real privacy protection depends on who you ask. They are cleaner than cookies, but they do not stop tracking — they make it harder to trace. That distinction is exactly where EU regulators and the ad tech industry disagree. 

Identity graphs and the EU: a polite fiction with legal consequences

The EU situation for identity graph vendors is where the rubber meets the road — and where the gap between marketing language and regulatory reality becomes hardest to ignore.

UID2, the identity solution developed by The Trade Desk and widely adopted across the US programmatic ecosystem, could not be deployed in Europe. The GDPR’s requirements around consent, data minimization, and purpose limitation are strict enough that The Trade Desk and LiveRamp had to build an entirely separate product — the European Unified ID (EUID) — specifically for the EU and UK markets. EUID was designed to account for specific market requirements in Europe, including GDPR regulations and consent framework limitations. The fact that a major US company had to fork its flagship identity product for the European market is telling. It’s not a localization exercise. It’s an acknowledgment that the underlying architecture of UID2 doesn’t survive GDPR scrutiny without significant modification.

LiveRamp’s RampID tells a similar story from a different angle. A 2024 technical report by Cracked Labs concluded that the RampID system may be considered a thin compliance layer over LiveRamp’s offline identity databases, which contain names, postal addresses, email addresses and phone numbers — and that LiveRamp’s data practices may disproportionately affect the rights and freedoms of hundreds of millions of people in the UK, France, and other countries, raising questions about the lawfulness of its practices under GDPR. LiveRamp contests this characterization, but the report landed in a regulatory environment that was already looking hard at identity infrastructure. In practice, for EU users, LiveRamp’s Authenticated Traffic Solution (ATS) requires explicit TCF consent before generating a RampID envelope. When consent is rejected or the CMP fails to load in time, ATS treats this as no consent and removes all envelopes from storage. Which sounds reassuring until you remember that the TCF itself — whose legal troubles we saw earlier — was found non-compliant with GDPR in important respects by the Belgian DPA in 2022, and its legal status remains contested. 

The practical consequences of all this are visible in the market. Identity graph solutions that depend on email-based deterministic matching operate at significantly reduced scale in Europe compared to the US, because authenticated traffic — users who log in and provide an email — is a smaller share of European inventory, and the consent requirements make that share even smaller. The result is that a meaningful portion of European programmatic inventory goes into every auction with no reliable user identity signal at all. Not because the technology doesn’t exist, but because the legal ground it would need to stand on keeps shifting.

This is the gap that neither regulation nor identity infrastructure has cleanly solved. A meaningful share of every auction — unauthenticated users, anonymous browsers, CTV inventory where login events barely exist — arrives with no reliable signal about who or what is on the other end.

So, is privacy protected?

The answer to this question is No. At least, not in the way ordinary users imagine. The tension at the heart of this entire discussion has never been resolved — and it won’t be resolved by regulation alone, because the regulation is written by people who, ultimately, need the digital advertising economy to keep functioning. Hundreds of billions of dollars a year and hundreds of thousands of jobs globally are on the line.

For most people, this entire machine is invisible except for one moment: the retargeting — that pair of shoes that follows you around the web and beyond, for a week or more, after you glanced at them once. That is the part we notice, and it is the part we judge the whole system by, which is precisely why the questions around user privacy are not the real questions. All stakeholders — politicians on both sides of the Atlantic included — are dodging the primary question because facing it directly would force uncomfortable choices no one wants to own. 

So, should behavioral targeting be banned? 

Behavioral targeting funds the free internet. The free internet is politically sacred. The fines get paid. The banners get clicked. The consent strings travel through the bid stream. The ecosystem keeps running.

GDPR was an attempt to give users control over something that had been taken from them without their knowledge. It produced, in practice, the most sophisticated compliance theater in the history of commercial law. Whether that’s a failure of regulation, a failure of enforcement, or simply proof that you cannot legislate your way out of an economic incentive structure this powerful, I’ll let you, the reader, decide.

What nobody disagrees about is that the current situation satisfies nobody completely — not users, not regulators, and not even an industry that would prefer clear rules to the permanent threat of the next Schrems case, the next DPA ruling, the next adequacy decision that unravels everything.

Here’s a little thought experiment for you. Roughly 90% of users click Accept and move on when rejecting requires more than one click. I’m sure you’re not surprised. Nobody reads the terms of service and privacy policies that confront us every day.  And not because we are uninformed, but simply because we’re busy, because the alternative is not being able to use the service, and because no human being can meaningfully evaluate the privacy implications of a decision they are asked to make dozens of times a day.

Assume for a moment that everything works. Assume CMPs are correctly configured to collect and handle users’ consent. Assume a federal US privacy law passes and EU enforcement gets teeth. Every consent banner is perfectly compliant. Now, would the percentage of users who click Accept change? I argue that it wouldn’t. The result would still be the same. From a regular user’s perspective, being forced to click “Accept” multiple times a day just to dismiss those obnoxious dialog boxes may satisfy “European regulators’ consent fetish” (copyright Alan Chapell), but it’s straight-up counterproductive if the goal is to protect personal data.

Conclusion

The consent model was always theater. GDPR didn’t create it; it just built a more elaborate stage. Individual informed consent is not a meaningful mechanism for keeping data collection and profiling in check in the age of the internet and AI. Forcing millions of people to constantly click those Accept buttons does not serve any purpose — with one important exception: cleaning the conscience of regulators who couldn’t do better than this.

The theatrical performance continues. Samuel Beckett would have recognized the consent model immediately. The characters perform. Godot never arrives. Nothing is done.

A Brief Breath of Fresh Air (Before We Move On)

If your brain feels slightly bruised after our dive into GDPR, ePrivacy directives, CIPA class-action lawsuits, and Samuel Beckett-style consent theater—take a deep breath. You survived the heaviest, most legally suffocating stretch of this series.

Now for the good news: we are officially stepping out of the regulatory hazmat facility.

In the next installment, we arrive at the programmatic equivalent of a breezy, tropical vacation: Contextual Advertising. No tracking cookies, no identity tokens, no clean rooms, and zero risk of Max Schrems invalidating your entire business model over breakfast.