Data-Driven Advertising in 2026: What Your Data Platform Has to Handle Now

When your team plans next year’s advertising budget, the allocation questions now depend on the data underneath the campaigns. Which signals can you still collect, and from whom? Can you show a regulator where a conversion event went after it left your site? And when a platform reports a strong return, how much of it did the spend cause?

I first wrote this post in late 2024, and it was mostly about pipelines and machine learning. Those still matter, but the pressure has moved since then. The browser changes that were supposed to settle the signal question have mostly been withdrawn. Several US state regulators now treat honouring opt-out signals as a technical obligation and enforce it. The large platforms automate more of the buying and show less of how they do it. New inventory has arrived inside AI assistants, and bot traffic can distort the conversion data the optimisers learn from. AI is part of several of these issues and has its own section near the end.

If you only take one thing from the post, take the order I’d work in. First, the collection path and an egress gate that decides what each platform receives, because they carry the regulatory exposure and decide what every platform’s optimiser learns from. Second, the value you send with each conversion (margin, returns, and store sales matched back), because it’s one of the few inputs you still control on automated campaigns such as AI Max and Performance Max. Third, invalid traffic filtering, since it improves your reporting and the platforms’ optimisation at the same time. After that, experiments and a mix model calibrated by them, which need clean conversions underneath. New channels such as AI answer engines then plug into a platform that already knows how to handle them.

The rest goes through each issue and what it asks of the platform, with a decision table for the egress rules and one piece of tested code (Python and Rust) for checking what a platform reports. If you’d rather skip the code, the worked example before it carries the argument.

Where the money is going

Spend is still growing. WPP Media’s midyear forecast has global advertising revenue, excluding US political advertising, growing 8.9% in 2026 to $1.3 trillion, up from the 7.1% it forecast in December (WPP Media, 2025; WPP Media, 2026). In the US, IAB’s September update raised its 2026 growth estimate to 12.3%, with commerce media growing 13.6% (IAB, 2026b). Its January outlook, before that update, had connected TV growing 13.8% and social 14.6% (IAB, 2026a).

In our experience, more of the budget now goes to environments where the seller holds the outcome data, and for connected TV and retail media much of the measurement happens there too, with aggregated results coming back to you. Retail media networks, streaming platforms, and the large social and search platforms each bring measurement, audience tools, and a way of receiving your first-party data that are specific to them. The term “clean room” itself has largely been absorbed into broader talk of interoperability and data collaboration, though the technology is still used, retail media being one example (Hercher, 2026). For a data team that means more outbound integrations, each with its own matching rules and contract terms, and more results you can reconcile only at the aggregate level. It helps to decide per channel what you’ll reconcile and what you’ll accept as reported. Table 1 is how we’d typically start that conversation; the details vary by platform and contract.

Table 1. Where each channel’s outcome data sits, and what you can test yourself.

For retail media the data work is mostly agreeing what goes in and what can come out. That means deciding which first-party fields you upload and under which contract terms, learning what the network’s aggregation thresholds let you analyse, and lining up its attribution windows with how you count your own sales before comparing the two.

The signal loss that didn’t get a replacement

For several years the working assumption was that Chrome would remove third-party cookies and Google’s Privacy Sandbox APIs would replace them. Neither happened in the form planned. In April 2025 Google said it would keep its current approach to user choice on third-party cookies in Chrome and not roll out a new standalone prompt (Chavez, 2025a). In October 2025 it retired a list of Privacy Sandbox technologies, including Topics, Protected Audience, and the Attribution Reporting API, citing low levels of adoption, kept others such as CHIPS and FedCM, and said feedback on its attribution work would feed into the W3C Private Advertising Technology Working Group (Chavez, 2025b).

The other browsers went the other way years ago. Safari has blocked cross-site cookies by default since 2020 and deletes a website’s script-writable storage after seven days of Safari use without user interaction on the site (Wilander, 2020). Apple also removes tracking information that websites add to URLs from links shared in Messages and Mail and in Private Browsing (Apple, 2023). Firefox enabled its Total Cookie Protection, which partitions cookies by site, by default for all desktop users (Mozilla, 2022). Mozilla says its own privacy-preserving attribution experiment was never activated, and it has since been removed (Mozilla, 2025).

On iOS, competition authorities have challenged how Apple implements App Tracking Transparency. France fined Apple €150 million in March 2025 (Autorité de la concurrence, 2025), and Italy’s competition authority fined it €98.6 million in December 2025 (Lakshmanan, 2025). In Germany, the Bundeskartellamt accepted commitments in August 2026 that bring the wording and order of the options in Apple’s App Tracking Transparency prompt and its own personalised-ads prompt closer together (Rijo, 2026b).

So third-party cookies still work by default in Chrome, the proposed standards-based replacement is mostly gone, and the rules for the app layer are being renegotiated country by country. I don’t think teams should read Chrome’s decision as permission to keep depending on third-party cookies. The share of your traffic where they work is partial, it varies by browser and region, and consent rules apply to it regardless.

What we see work is a first-party collection path that doesn’t depend on any one browser’s behaviour, with the user’s consent and opt-out state attached to every event. The options range from serving browser tags from your own domain, as Google’s tag gateway does (Google for Developers, 2026), to server-to-server delivery through server-side tagging, enhanced conversions sent through Google’s Data Manager or API, and Meta’s Conversions API (Google, n.d.b; Meta, n.d.a). Google combined enhanced conversions for web and leads into one setting and, from April 2026, accepts user-provided data from tags, Data Manager, and API connections under it (Google, n.d.b). The server path can recover measurement lost to technical limits such as script failures and short cookie lifetimes. It doesn’t change what consent and opt-out rules require, and routing tags through your own domain to get around a person’s choice would undercut that consent. It also concentrates responsibility, because your server now decides what each platform receives, so it needs an owner on your side even when an agency runs the campaigns.

Most of these paths send hashed email addresses and phone numbers for matching. Hashing hides the raw value, but common identifiers can often be recovered by hashing likely candidates, which is why the FTC says companies shouldn’t treat hashed personal information as anonymised (Federal Trade Commission, 2024a). In the EU, the Court of Justice held in 2025 that pseudonymised data isn’t personal data in every case and for every recipient (Court of Justice of the European Union, 2025). A platform that matches the hash to its own users can identify the person, though, and that match is the reason you send it.

Opt-out signals are now enforced as data

In the US, the number of state comprehensive privacy laws keeps rising. Vermont became the 23rd state to enact one in June 2026, though its law doesn’t take effect until 2028, and Indiana, Kentucky, and Rhode Island’s laws took effect on 1 January 2026 (IAPP, 2026a; IAPP, 2026b). These laws give people a right to opt out of targeted advertising. At least a dozen states now require businesses to honour opt-out preference signals such as Global Privacy Control (GPC), and The California Privacy Protection Agency and the attorneys general of California, Colorado, and Connecticut ran a coordinated enforcement sweep on GPC in September 2025 (CPPA, 2026).

The enforcement cases are specific about what went wrong technically. The California Privacy Protection Agency fined Tractor Supply $1.35 million in part for failing to provide an effective opt-out mechanism, including through opt-out preference signals such as GPC (CPPA, 2025b). California’s Attorney General settled with Disney for $2.75 million in February 2026, in part because Disney limited GPC opt-outs to “the specific device the consumer was using”; the Attorney General said that “[a] consumer’s opt-out right applies wherever and however a business sells data” (California Department of Justice, 2026). California’s regulations already require a business to apply the signal to the browser or device that sent it, to any profile associated with it, and to the consumer where the consumer is known (California Code of Regulations, 2023). From January 2027, California’s Opt Me Out Act requires browsers to offer an opt-out preference signal setting, which will put the signal in front of far more people (CPPA, 2025a).

Other laws add rules that depend on who the person is and what the data reveals. Maryland’s Online Data Privacy Act, in force since 1 October 2025 and applying to processing from 1 April 2026, bars targeted advertising to anyone the controller knew or should have known is at least 13 and under 18, bans the sale of sensitive data, and limits collection to what is reasonably necessary and proportionate for the product or service requested (Maryland General Assembly, 2024). Washington’s My Health My Data Act treats information derived or extrapolated from non-health data as consumer health data when it’s used to associate a consumer with a health condition, and inferences from purchases could fall within it; such data can’t be collected or shared without consent, and it can be enforced through private action as well as by the Attorney General (Washington State Office of the Attorney General, n.d.). Website pixels have also become a litigation target in their own right: plaintiffs in California increasingly bring wiretap and pen-register claims against tracking that fires before consent, and courts aren’t uniform in how they treat them (Cohen, 2026). The FTC’s amended COPPA Rule, with a compliance date of 22 April 2026 for most provisions, requires operators covered by it, such as child-directed services, to get separate verifiable parental consent before disclosing a child’s data to third parties such as ad networks (Federal Trade Commission, 2025).

In Europe, the model for tracking technologies and ad data sharing is consent first. Alongside ad_storage, which governs advertising cookies and device identifiers, Google’s consent mode carries ad_user_data for sending user data to Google for advertising and ad_personalization for personalised advertising (Google for Developers, n.d.a), and Google requires consent from EEA users for its measurement, personalisation, and remarketing features (Google, n.d.a). In basic consent mode no data reaches Google before the user interacts with the consent banner, and none if they decline. In advanced mode, Google tags send measurements without cookies when consent is denied, and Google uses them to model the conversions it can’t observe (Google for Developers, n.d.a). Which mode fits is a question for your counsel as much as your analysts. The European Commission fined Meta €200 million under the Digital Markets Act in April 2025 for not giving users a choice of a service that uses less of their personal data, and Meta has since committed to offer EU users less personalised advertising as an option (European Commission, 2025a; European Commission, 2025b). The Digital Services Act separately bars online platforms from showing ads based on profiling that uses special categories of personal data, or on profiling of users they know with reasonable certainty to be minors (European Data Protection Board, 2026). National regulators also act on cookie practices directly: France’s CNIL fined Shein €150 million and Google €325 million in September 2025, in particular for failing to comply with the cookie rules; Google was also found to have shown ads in Gmail without prior consent (CNIL, 2025).

The Commission’s Digital Omnibus proposal, which would change the ePrivacy cookie rule in Article 5(3) and several GDPR articles, is still in negotiation. As of 20 September 2026, Parliament’s tracker showed more than 1,750 amendments tabled to the draft report, with a joint committee discussion in July as its latest listed step, and the Council had not adopted a negotiating mandate (Council of the European Union, 2026; European Parliament, 2026). In the UK, the Data (Use and Access) Act 2025 brought new consent exceptions for storage and access technologies into force from 5 February 2026 (UK Government, 2026), and the ICO’s guidance says the statistical exception doesn’t apply to online advertising purposes (Information Commissioner’s Office, n.d.).

For a data team, the common thread is that consent, opt-out, age, and sensitivity state now have to travel with each event to every destination, and the scope of each signal matters. A GPC signal arrives on a request, but it has to be written to an opt-out record for that browser, any linked profile, and the person if you know who they are, so it reaches events that never carry a request, such as offline conversions. A consent choice in the EEA belongs to a purpose, and an objection or withdrawal recorded anywhere has to override an older consent snapshot. Our earlier post Consent Is Data Engineering, Not Legal made the general case for treating consent as a runtime data flow. Table 2 shows one narrow piece of that: the rules a gate applies before an event leaves your platform for an ad destination. If you’re on the marketing side, the paragraph headed “What a block costs” below is the one that matters most.

Table 2. An illustrative set of egress rules for ad destinations, checked in order. Each region an event touches (location, residence, and EU establishment) gets its own rule, and the strictest outcome wins. The rules are deliberately incomplete; your counsel sets the real ones for each jurisdiction you serve.

Browser tags are a second way out that this table doesn’t govern. The same rules have to reach them through your consent platform and the client-side checks described below, and a network-level scan of what fires before anyone interacts with the page is the simplest way to test that.

The choices in the table are where we see real implementations differ, so they’re worth spelling out.

Four outcomes. Google’s restricted data processing and Meta’s Limited Data Use let you send data that the platform then processes in a more limited, service-provider role (Google, n.d.c; Meta, n.d.c). Those modes only cover the states each platform lists: Meta’s Limited Data Use covers a set of states for its business tools, but only California for customer-list audiences (Meta, n.d.c). So the gate takes the destination as an input and blocks where the destination has no restricted mode for that state. Whether a restricted send keeps measurement outside “sale” or “sharing” under a given state law depends on the destination’s contract and your counsel’s reading; the table assumes it does for measurement and still blocks audience use. Consent that’s missing in an opt-in region counts as refused, and a region with no policy is blocked. Other missing inputs, such as an unresolved region or an opt-out lookup that failed, put the event on hold. Held events are replayed once the input resolves and expire to a block after a short window. Meta’s API rejects events older than seven days (Meta, n.d.e), so treat that as an outer bound; “Two callers, one rule set” below covers how much sooner it wants them.

What a block costs. Each rule removes some of the signal that the platforms’ bidding uses. Rules the law already requires apply from day one. To see what each rule costs, replay historical events through the gate and measure what share of conversions each rule would hold, restrict, or block, by channel, and run shadow mode only for rules that go beyond the legal minimum. That number is what lets a marketing lead and a privacy lead agree on the trade-off with the same facts.

Where the inputs come from. The opt-out flag is a lookup in a ledger keyed by person, browser, and device, written to whenever a GPC signal, a preference-centre choice, or an objection arrives. The streaming path can only use the identity links known at send time, so the batch path re-checks with resolved identity. An event can touch more than one region on purpose. For a business with no EU establishment, GDPR’s reach over advertising generally depends on whether it targets or monitors people who are in the EU (European Data Protection Board, 2019), while US state laws follow residence (see, for example, Maryland General Assembly, 2024), so a California resident browsing in Paris can trigger both and the stricter outcome wins. A business established in the EU applies GDPR to processing in the context of that establishment’s activities, wherever the visitor is, so it adds “EEA” to every event’s regions. In practice that means collecting purpose-level consent from every visitor wherever they are, or having counsel set a narrower rule for visitors outside the EU; with the table as written, a visitor with no recorded consent is blocked. The same guidance also lists behavioural advertising and online tracking as forms of monitoring (European Data Protection Board, 2019). The consent fields reuse Google’s names for readability; in practice they’re mapped from your consent platform, often from an IAB TCF or Global Privacy Protocol string plus your own preference centre (IAB Tech Lab, n.d.), and translated into each destination’s own parameters. An unknown age passes these rules, which is only reasonable where the service isn’t directed at children or teens and nothing in your data suggests a user is a minor. Maryland’s “should have known” standard expects you to act on what your data already suggests.

What it leaves out. The table treats all US states alike and groups Switzerland with the EEA and the UK, which errs strict for Switzerland. Its US default of “send” assumes notice at collection, a working opt-out link, and the contract terms each state requires for selling or sharing with that destination; for audience use those are third-party terms, since restricted or processor modes only cover measurement. It treats a US opt-out and an EU objection alike, which errs toward blocking. And it ignores ad_storage, which governs cookie-based collection in the browser. A production rule set handles each jurisdiction you serve separately, and the sensitive-data row expands into rules per category and state (Maryland, for example, bars the sale of sensitive data whether or not the consumer consents). Health data is the clearest case, given Washington’s law, and so is tracking that fires before consent, given the pixel litigation above. Age thresholds also differ by law, so “minor” means different ages under COPPA and Maryland’s law.

Two callers, one rule set. Meta advises sending server events in real time or within an hour, and warns that events delayed by 24 hours or more can cause significant attribution and delivery problems (Meta, n.d.d). So the gate runs inline in the streaming path from server-side collection, and again in the batch path from the gold layer for offline and store conversions, value adjustments, and audience uploads. Both callers use the same rules and write to the same decision log, which records the event ID, destination, inputs, region sources, and the version of the rules alongside each decision. Where a browser pixel runs alongside the server path, both send the same event ID so the platform can deduplicate them (Meta, n.d.b). Some platforms use their own deduplication fields, so the collection layer generates one canonical ID and maps it to each destination’s field. The pixel sits outside the gate and its log, and it can’t see the ledger by itself, so for any browser or signed-in user with a ledger entry the server sets a first-party flag that switches the pixel to its restricted mode or turns it off. A first-time visitor has no ledger entry yet, so the tag code also reads the browser’s GPC signal and the consent platform’s state before the pixel loads. In our view, the decision log is likely to be personal data in its own right and needs its own retention period and access controls.

Opt-outs that arrive later. Conversions already sent generally stay sent, apart from the retractions some platforms support (Google, n.d.d). Audience lists can be updated, so a new opt-out triggers removals from every list the person was uploaded to. For batch replays, apply the stricter of the consent state at the event and at egress. When identity resolution merges two profiles and one has opted out, the merged profile carries the opt-out, and if the merge is later undone, both profiles keep it.

Platforms automate more and show less

The large platforms keep moving campaign decisions into their own models. Google brought AI Max for Search out of beta in April 2026 and said Dynamic Search Ads and other legacy formats, including the campaign-level broad match setting, would upgrade to it from September (Adams, 2026). Meta now lets advertisers and agencies generate video from static assets, and is adding agentic capacity so its business assistant can generate creative, update targeting, and change budgets from conversational prompts (Hutchinson, 2026). Google has also given back some visibility that advertisers asked for, including a beta channel performance report, search terms reporting for all Performance Max campaigns, and campaign-level negative keyword lists (Wertz, 2025).

Many advertisers already rely on these products, so for 2026 the practical questions are what you feed them and how you check them. A platform optimiser is trained on the conversions you send it. If those conversions include duplicates, bot traffic, or orders that are later returned, the model optimises toward them. The value you send is one of the few inputs you still control, and the hard part is the data behind it: margin by product, return rates by category, store and loyalty sales matched back to digital campaigns, and a named owner for each. Someone has to decide whether a new customer is worth more than a returning one, how to handle returns that arrive after the platform’s conversion window has closed, and who signs off the formula, which is usually a conversation between marketing and finance. Store-sales match rates are worth tracking as a quality measure in their own right, because a falling rate lowers the value every store-influenced campaign appears to drive, and the platform’s campaign reports don’t flag it. Google lets you retract or adjust a conversion after it was reported, for example after a return (Google, n.d.d), which only helps if returns reach your gold tables quickly. Read the platform’s reported return as one input to the budget, alongside measurement you run yourself.

Creative is the other input that still moves results in automated campaigns, and it’s become a data problem. When the platform assembles ads from your assets, learning which messages, formats, or products work outside the platform’s own reporting depends on tagging every asset with consistent metadata when it’s made and keeping that catalogue in your own platform.

Bots and the quality of what you pay for

Invalid traffic is still a cost and, increasingly, a data quality problem. The ANA’s programmatic benchmark for the second quarter of 2025 estimated that $26.8 billion of global media value is lost each year to inefficiencies, and found median spend on made-for-advertising sites had fallen to 0.8%, though some advertisers still spent far more (ANA, 2025). DoubleVerify reported falling fraud rates in North America and EMEA in its 2026 data, but found that in the unprotected campaigns it studied, AI bots generated 15% of clicks (Rijo, 2026c). Figures from different vendors measure different things and shouldn’t be combined.

The feedback loop is what makes this a data problem. Bot clicks and form fills that reach your conversion tables get sent back to the platforms as conversions, and the platforms can then bid for more of the same traffic. A light filter in the streaming path catches the obvious cases before they’re sent. The fuller analysis runs in the silver layer, and conversions it later finds invalid can be retracted where the platform supports it, as above, and excluded going forward where it doesn’t. The same flags keep invalid traffic out of your own reporting and experiments.

AI agents complicate the picture. Shopping agents and agent-driven browsers can generate sessions that aren’t human but still end in real orders. Treating all of them as bots drops revenue, and counting their journeys as human trains bidders on behaviour no person showed. In the silver layer we’d separate declared agents, known crawlers, and suspected fraud, keep agent-completed orders as revenue, and decide per destination whether those conversions are sent back at all.

Measuring what the spend caused

Marketing mix modelling has drawn renewed attention, helped by open-source tools. Google made its Meridian model available to all marketers and data scientists in January 2025 (Nair, 2025). Meridian’s documentation advises using incrementality experiments to inform its priors on return on investment (Google for Developers, n.d.b), and Meta’s open-source Robyn treats calibration against experiment results as one of the objectives when it selects models (Meta Marketing Science, n.d.). Trade press reported in November 2025 that the minimum budget for Google’s incrementality experiments had come down to $5,000, self-serve for some campaign types (Rijo, 2025b).

The combination that tends to hold up is experiments for the channels where you can run them, a mix model calibrated by those experiments for the overall allocation, and platform-reported results read alongside both. On the large platforms you usually can’t randomise users yourself, so user-level holdouts run through the platform’s own lift tools, and those results come from the platform being evaluated. Two designs give the data team its own counts. A geo experiment, where you assign regions and use geo-level methods, is the usual choice for prospecting, connected TV, and retail media, which often make up a large share of the budget. A holdout you assign in your own customer data and enforce at upload covers CRM and retargeting audiences, with outcomes from your own orders. Take an illustrative test of that second design. A treatment list of 900,000 customers has 13,500 converters, a holdout of 100,000 has 1,200, and the platform attributes 6,000 converters to campaigns that target only the treatment list over the same window. Targeting the treatment list caused about 2,700 additional converters (95% interval roughly 2,050 to 3,350), a lift of 25% (roughly 18% to 33%), and about 45% of what the platform reported, with a range of roughly 34% to 56% treating the platform figure as fixed. Most of that uncertainty comes from the small holdout. The comparison only works when those campaigns are restricted to the uploaded list with audience expansion off, and when the platform or a clean room can give a converter-level count for it; otherwise compare conversions with conversions.

Listing 1 computes those figures.

from dataclasses import dataclass
from math import exp, sqrt

Z95 = 1.96


@dataclass
class Arm:
    users: int       # everyone assigned to the arm, whether or not they saw an ad
    converters: int  # users with at least one conversion in the test window


@dataclass
class LiftReadout:
    incremental: float     # converters the campaign caused in the treatment arm
    low: float             # 95% interval on incremental
    high: float
    relative_lift: float   # treatment rate over holdout rate, minus one
    relative_low: float    # 95% interval on relative lift (log ratio)
    relative_high: float
    share: float           # incremental / platform-reported, same arm and window
    share_low: float
    share_high: float


def lift_readout(treatment: Arm, holdout: Arm, platform_reported: int) -> LiftReadout:
    for arm in (treatment, holdout):
        if arm.users <= 0 or not 0 <= arm.converters <= arm.users:
            raise ValueError("each arm needs users, and 0 <= converters <= users")
    if 0 in (treatment.converters, holdout.converters) or platform_reported <= 0:
        raise ValueError("need converters in both arms and a positive platform figure")

    p_t = treatment.converters / treatment.users
    p_h = holdout.converters / holdout.users
    se = sqrt(p_t * (1 - p_t) / treatment.users + p_h * (1 - p_h) / holdout.users)

    incremental = (p_t - p_h) * treatment.users
    margin = Z95 * se * treatment.users
    low, high = incremental - margin, incremental + margin

    ratio = p_t / p_h
    se_log = sqrt((1 - p_t) / treatment.converters + (1 - p_h) / holdout.converters)
    return LiftReadout(
        incremental=incremental,
        low=low,
        high=high,
        relative_lift=ratio - 1,
        relative_low=ratio * exp(-Z95 * se_log) - 1,
        relative_high=ratio * exp(Z95 * se_log) - 1,
        share=incremental / platform_reported,
        share_low=low / platform_reported,
        share_high=high / platform_reported,
    )

const Z95: f64 = 1.96;

pub struct Arm {
    pub users: u64,      // everyone assigned to the arm, whether or not they saw an ad
    pub converters: u64, // users with at least one conversion in the test window
}

#[derive(Debug)]
pub struct LiftReadout {
    pub incremental: f64,   // converters the campaign caused in the treatment arm
    pub low: f64,           // 95% interval on incremental
    pub high: f64,
    pub relative_lift: f64, // treatment rate over holdout rate, minus one
    pub relative_low: f64,  // 95% interval on relative lift (log ratio)
    pub relative_high: f64,
    pub share: f64,         // incremental / platform-reported, same arm and window
    pub share_low: f64,
    pub share_high: f64,
}

pub fn lift_readout(treatment: &Arm, holdout: &Arm, platform_reported: u64) -> Result<LiftReadout, String> {
    for arm in [treatment, holdout] {
        if arm.users == 0 || arm.converters > arm.users {
            return Err("each arm needs users, and 0 <= converters <= users".into());
        }
    }
    if treatment.converters == 0 || holdout.converters == 0 || platform_reported == 0 {
        return Err("need converters in both arms and a positive platform figure".into());
    }

    let (n_t, n_h) = (treatment.users as f64, holdout.users as f64);
    let p_t = treatment.converters as f64 / n_t;
    let p_h = holdout.converters as f64 / n_h;
    let se = (p_t * (1.0 - p_t) / n_t + p_h * (1.0 - p_h) / n_h).sqrt();

    let incremental = (p_t - p_h) * n_t;
    let margin = Z95 * se * n_t;
    let (low, high) = (incremental - margin, incremental + margin);
    let reported = platform_reported as f64;

    let ratio = p_t / p_h;
    let se_log = ((1.0 - p_t) / treatment.converters as f64 + (1.0 - p_h) / holdout.converters as f64).sqrt();
    Ok(LiftReadout {
        incremental,
        low,
        high,
        relative_lift: ratio - 1.0,
        relative_low: ratio * (-Z95 * se_log).exp() - 1.0,
        relative_high: ratio * (Z95 * se_log).exp() - 1.0,
        share: incremental / reported,
        share_low: low / reported,
        share_high: high / reported,
    })
}

Listing 1. Comparing a customer-list holdout with platform-attributed converters.

The listing uses a normal approximation, which is reasonable when both arms have plenty of converters; small tests need an exact or bootstrap interval. The relative-lift interval is wider than the absolute one scaled by the baseline, because the holdout rate also sits in the denominator.

Attribution and incrementality answer different questions. Attribution credits some conversions that would have happened anyway, and misses others the campaign did cause, such as offline, cross-device, or longer-lag sales, so the ratio of incremental to platform-reported converters can land on either side of one and usually differs by channel and campaign type. It’s only meaningful when the platform figure covers the same group, the same dates, and the same unit (converters or conversions) under a stated attribution setting, and when you know whether it includes modelled conversions. Between tests, teams use the ratio to scale platform-reported numbers for that channel. For the mix model, the experiment is converted to incremental return on spend for that channel, period, and outcome, and used as a calibration point; a test that only saw online conversions calibrates only that outcome, and a customer-list holdout calibrates only the CRM or retargeting part of the channel, which is best modelled as its own media variable, with a geo test informing the channel as a whole. In practice you’d run the same comparison on value as well, using a bootstrap or another method suited to revenue, which is mostly zero with a long tail.

A readout like this holds up when the arms are compared as assigned; in our experience, comparing only the people who saw an ad against the holdout overstates lift. It also needs to be sized before it runs, with a minimum detectable lift and holdout share fixed up front (at a 1.2% baseline and a two-sided 5% significance level, the 90/10 split in the example can detect a relative lift of roughly 8.5% to 9% with 80% power), because an underpowered test that finds nothing tends to be read as proof the channel doesn’t work. And the data team checks for leakage between arms, such as the same person on two devices, or broad and automated targeting that reaches holdout members anyway, which biases lift toward zero. The holdout rule in Table 2 keeps holdout members out of audience uploads, which closes the most direct route.

Search answers and new AI inventory

AI-generated answers are changing where clicks come from. A Pew Research Center study of US adults’ browsing in March 2025 found that users clicked a traditional search result in 8% of visits to pages with an AI summary, against 15% without one (Chapekis and Lieb, 2025). Google disputed the methodology (Rijo, 2025a). Ahrefs’ analyses of 300,000 keywords also associated AI Overviews with lower click-through for the top-ranking page on informational keywords, by 34.5% in its 2025 study and 58% in a February 2026 update (Law, 2025; Law, 2026). For advertisers this shifts the baseline that attribution and mix models are built on, since organic and paid search behave differently on pages with AI answers.

The answer engines are also becoming ad inventory. Google is testing new ad formats in AI Mode, labelled as sponsored (Google, 2026). OpenAI now runs ads in ChatGPT, has added cost-per-click bidding and a Conversions API and pixel, began testing self-serve buying, and by late August said ads were available in more than 40 countries (OpenAI, 2026a; OpenAI, 2026b). WPP Media projects generative search ad revenue of $5.1 billion in 2026 (WPP Media, 2026).

A new channel like this arrives with a pixel, a conversion API, and terms of its own. For the data platform it’s another destination behind the egress gate and another set of platform-reported results to reconcile. It’s also worth bringing into experiments early, before its reported numbers become the default way it’s judged.

Competition rulings and the ad tech stack

For anyone buying on the open web, the useful step now is to keep your own record of supply paths, fees, and outcomes by exchange and seller, so you can act on whatever the Google ad tech cases open up. In the US, Judge Brinkema rejected the Justice Department’s request to divest Google’s ad exchange and accepted behavioural remedies instead, including integration with Prebid. The final judgment was still being argued in October 2026, and AdExchanger’s commentary assumes Google will appeal (Schiff, 2026a; Schiff, 2026b). The European Commission fined Google €2.95 billion in September 2025 for self-preferencing in ad tech and said its preliminary view was that only the divestment of part of Google’s services could address the conflicts of interest (European Commission, 2025c). Neither case is likely to change much for advertisers who buy mostly through the large platforms directly.

Where AI fits

AI runs through most of the sections above: in the platforms’ bidding and creative, in the answer engines, and in the bots. A few points are specific to it.

Generative creative is now common in many teams’ workflows, and disclosure rules apply to some of it. Under Article 50 of the EU AI Act, which has applied since 2 August 2026, deployers must disclose content that meets the Act’s definition of a deepfake (European Parliament and Council of the European Union, 2024; K&L Gates, 2026). The AI Act omnibus adopted in 2026 left that date in place, with a short grace period for some machine-readable marking requirements on systems already on the market (K&L Gates, 2026). The closest US federal rule is narrower: the FTC’s rule on consumer reviews and testimonials prohibits fake reviews, including AI-generated reviews that misrepresent who wrote them (Federal Trade Commission, 2024b), and other uses fall under general deception law. Teams producing creative with these tools need a record of what was generated and how it was disclosed.

Agents are starting to appear in the buying chain. The Ad Context Protocol (AdCP) launched in October 2025 with backing from a consortium of publishers and ad tech firms (Triton Digital, 2025), and IAB Tech Lab released its Agentic RTB Framework for public comment the following month, later placing it within a wider framework it calls AAMP (Gerber, 2025; Rijo, 2026a). Adoption is early; in September 2026 one ad tech CTO agreed in an interview that very little money passes through either AdCP or AAMP yet (Rijo, 2026d). I’d prepare with controls you’d want anyway: spend limits enforced outside the agent, a record of what each agent was allowed to do and did, and the same egress gate for any data an agent sends on your behalf.

The models you build yourself, for lifetime value, churn, or propensity, depend on the same first-party data as everything else here. A model trained on conversion data that includes bot traffic, or on people who later opted out, has the same problems as the platform optimisers, with the added question of whether the opt-out needs to reach your training data too.

What the platform underneath needs

Figure 1 pulls these together. The products behind each box vary from one client to the next; the figure shows where each decision in this post sits.

The components from the original version of this post (ingestion, storage, processing, and reporting) are still there, under collection, the lakehouse, and measurement. Most of the new work sits around them, in the rules attached to the data and in checking numbers that someone else produces. If you’re reviewing your own setup, a few questions tend to show quickly where it stands:

• What share of your conversions does each platform receive, and why are the rest missing?
• Does an opt-out made on a phone reach the browser pixel on a laptop, and the offline conversions you upload?
• Do returns and cancellations reach the values you send to the platforms?
• Which channels have you tested for incrementality recently, and what was the ratio to platform-reported results?
• Does invalid traffic get flagged before conversions are sent, or only in reporting afterwards?

If those questions turn up work, our data team is happy to compare notes.

References

Adams, P., 2026. Google brings AI Max for Search out of beta, will deprecate legacy tools. Marketing Dive, 16 April. Available at: https://www.marketingdive.com/news/google-brings-ai-max-for-search-out-of-beta-will-deprecate-legacy-tools/817688/ [Accessed 24 October 2026].

ANA, 2025. The ANA Q2 2025 Programmatic Transparency Benchmark Finds $26.8B in Wasted Programmatic Spend. Association of National Advertisers, 14 August. Available at: https://www.ana.net/content/show/id/pr-2025-08-programmatictrans [Accessed 24 October 2026].

Apple, 2023. Apple announces powerful new privacy and security features. Apple Newsroom, 5 June. Available at: https://www.apple.com/newsroom/2023/06/apple-announces-powerful-new-privacy-and-security-features/ [Accessed 24 October 2026].

Autorité de la concurrence, 2025. Targeted advertising: the Autorité de la concurrence imposes a fine of €150,000,000 on Apple for the implementation of the App Tracking Transparency (“ATT”) framework. Autorité de la concurrence, 31 March. Available at: https://www.autoritedelaconcurrence.fr/en/entityprint/pdf/node/11089 [Accessed 24 October 2026].

California Code of Regulations, 2023. Cal. Code Regs. tit. 11, § 7025: Opt-Out Preference Signals. Legal Information Institute, Cornell Law School. Available at: https://law.cornell.edu/regulations/california/11-CCR-7025 [Accessed 24 October 2026].

California Department of Justice, 2026. California Won’t Let It Go: Attorney General Bonta Announces $2.75 Million Settlement with Disney, Largest CCPA Settlement in California History. Office of the Attorney General, 11 February. Available at: https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million [Accessed 24 October 2026].

Chapekis, A. and Lieb, A., 2025. Google users are less likely to click on links when an AI summary appears in the results. Pew Research Center, 22 July. Available at: https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/ [Accessed 24 October 2026].

Chavez, A., 2025a. Next steps for Privacy Sandbox and tracking protections in Chrome. Google Privacy Sandbox, 22 April. Available at: https://privacysandbox.google.com/blog/privacy-sandbox-next-steps [Accessed 24 October 2026].

Chavez, A., 2025b. Update on Plans for Privacy Sandbox Technologies. Google Privacy Sandbox, 17 October. Available at: https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies [Accessed 24 October 2026].

CNIL, 2025. Cookie regulation: the CNIL is continuing the action plan initiated in 2019 and has imposed two fines on SHEIN and GOOGLE. Commission nationale de l’informatique et des libertés, 3 September. Available at: https://www.cnil.fr/en/node/167505 [Accessed 24 October 2026].

Cohen, A., 2026. The Millisecond Problem: How Pre-Consent Tracking Is Driving CIPA Lawsuits in 2026. Loeb & Loeb LLP, April. Available at: https://www.loeb.com/en/insights/publications/2026/04/the-millisecond-problem-how-pre-consent-tracking-is-driving-cipa-lawsuits-in-2026 [Accessed 24 October 2026].

Council of the European Union, 2026. Mandate for negotiations with the European Parliament (Digital Omnibus), note ST 10729/26. Council of the European Union, 22 June. Available at: https://data.consilium.europa.eu/doc/document/ST-10729-2026-INIT/en/pdf [Accessed 24 October 2026].

Court of Justice of the European Union, 2025. Judgment of the Court in Case C-413/23 P, EDPS v SRB (Concept of personal data). Press release No 107/25, 4 September. Available at: https://curia.europa.eu/jcms/jcms/p1_5127926/en/ [Accessed 24 October 2026].

CPPA, 2025a. Governor Signs Groundbreaking Privacy Bill Making It Easier for Californians to Protect Their Personal Data. California Privacy Protection Agency, 8 October. Available at: https://cppa.ca.gov/announcements/2025/20251008_2.html [Accessed 24 October 2026].

CPPA, 2025b. Nation’s Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations. California Privacy Protection Agency, 30 September. Available at: https://cppa.ca.gov/announcements/2025/20250930.html [Accessed 24 October 2026].

CPPA, 2026. An Overview of the History, Laws, and Technology Behind Opt-out Preference Signals. California Privacy Protection Agency board materials, 6 August. Available at: https://cppa.ca.gov/meetings/materials/20260806_07_02.pdf [Accessed 24 October 2026].

European Commission, 2025a. Commission finds Apple and Meta in breach of the Digital Markets Act. European Commission, 23 April. Available at: https://digital-markets-act.ec.europa.eu/commission-finds-apple-and-meta-breach-digital-markets-act-2025-04-23_en [Accessed 24 October 2026].

European Commission, 2025b. Meta commits to give EU users choice on personalised ads under Digital Markets Act. European Commission, 8 December. Available at: https://digital-markets-act.ec.europa.eu/meta-commits-give-eu-users-choice-personalised-ads-under-digital-markets-act-2025-12-08_en [Accessed 24 October 2026].

European Commission, 2025c. Commission fines Google €2.95 billion over abusive practices in online advertising technology. Press release IP/25/1992, 5 September. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1992 [Accessed 24 October 2026].

European Data Protection Board, 2019. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1. European Data Protection Board, 12 November. Available at: https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf [Accessed 24 October 2026].

European Data Protection Board, 2026. Guidelines 3/2025 on the interplay between the DSA and the GDPR, version 2.0. European Data Protection Board, 17 September. Available at: https://www.edpb.europa.eu/system/files/2026-09/edpb_guidelines_202503_interplay-dsa-gdpr_v2_en.pdf [Accessed 24 October 2026].

European Parliament, 2026. The Digital Omnibus Regulation Proposal. Legislative Train Schedule, updated 20 September. Available at: https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package [Accessed 24 October 2026].

European Parliament and Council of the European Union, 2024. Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng [Accessed 24 October 2026].

Federal Trade Commission, 2024a. No, hashing still doesn’t make your data anonymous. FTC Office of Technology blog, 24 July. Available at: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous [Accessed 24 October 2026].

Federal Trade Commission, 2024b. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials. Federal Trade Commission, 14 August. Available at: https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials [Accessed 24 October 2026].

Federal Trade Commission, 2025. Children’s Online Privacy Protection Rule. Federal Register, 22 April. Available at: https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule [Accessed 24 October 2026].

Gerber, J., 2025. The IAB Tech Lab releases its first framework for agentic ad buying standards. AdExchanger, 13 November. Available at: https://adexchanger.com/platforms/the-iab-tech-lab-releases-its-first-framework-for-agentic-ad-buying-standards [Accessed 24 October 2026].

Google, n.d.a. Mapping ad_storage to ad_user_data. Tag Manager Help. Available at: https://support.google.com/tagmanager/answer/14754100 [Accessed 24 October 2026].

Google, n.d.b. Set up enhanced conversions for web using the Google tag. Google Ads Help. Available at: https://support.google.com/google-ads/answer/9888145 [Accessed 24 October 2026].

Google, n.d.c. Helping advertisers comply with the U.S. states’ privacy laws in Google Ads. Google Ads Help. Available at: https://support.google.com/google-ads/answer/9614122 [Accessed 24 October 2026].

Google, n.d.d. About conversion adjustments. Google Ads Help. Available at: https://support.google.com/google-ads/answer/7686447 [Accessed 24 October 2026].

Google, 2026. A new generation of ads for the AI era of search. Google, 20 May. Available at: https://blog.google/products/ads-commerce/a-new-generation-of-ads-for-the-ai-era-of-search/ [Accessed 24 October 2026].

Google for Developers, n.d.a. Consent mode overview. Tag Platform, Google for Developers. Available at: https://developers.google.com/tag-platform/security/concepts/consent-mode [Accessed 24 October 2026].

Google for Developers, n.d.b. Calibrate treatment priors. Meridian, Google for Developers. Available at: https://developers.google.com/meridian/docs/advanced-modeling/roi-priors-and-calibration [Accessed 24 October 2026].

Google for Developers, 2026. Set up Google tag gateway for advertisers. Google for Developers. Available at: https://developers.google.com/tag-platform/tag-manager/gateway/setup-guide [Accessed 24 October 2026].

Hercher, J., 2026. Why 2025 Marked The End Of The Data Clean Room Era. AdExchanger, 7 January. Available at: https://www.adexchanger.com/measurement/why-2025-marked-the-end-of-the-data-clean-room-era/ [Accessed 24 October 2026].

Hutchinson, A., 2026. Meta introduces new AI-powered tools at Advertising Week. Social Media Today, 6 October. Available at: https://www.socialmediatoday.com/news/meta-introduces-new-ai-powered-tools-at-ad-week-2026/832288/ [Accessed 24 October 2026].

IAB, 2026a. 2026 Outlook: A Snapshot of U.S. Ad Spend, Opportunities, and Strategies for Growth. Interactive Advertising Bureau, 28 January. Available at: https://www.iab.com/research/2026-outlook-a-snapshot-of-u-s-ad-spend-opportunities-and-strategies-for-growth/ [Accessed 24 October 2026].

IAB, 2026b. 2026 Outlook Study: September Update. Interactive Advertising Bureau, September. Available at: https://www.iab.com/wp-content/uploads/2026/09/IAB_2H_2026_Ad_Spend_Outlook_Study.pdf [Accessed 24 October 2026].

IAB Tech Lab, n.d. Global Privacy Protocol. IAB Tech Lab. Available at: https://iabtechlab.com/gpp/ [Accessed 24 October 2026].

IAPP, 2026a. New year, new rules: US state privacy requirements coming online as 2026 begins. IAPP, 5 January. Available at: https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins [Accessed 24 October 2026].

IAPP, 2026b. Vermont becomes 23rd state to enact consumer privacy law. IAPP, 17 June. Available at: https://iapp.org/news/a/vermont-becomes-23rd-state-to-enact-consumer-privacy-law [Accessed 24 October 2026].

Information Commissioner’s Office, n.d. What are the exceptions? Guidance on the use of storage and access technologies. Available at: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/ [Accessed 24 October 2026].

K&L Gates, 2026. EU Digital Omnibus On AI Enters Into Force. Mondaq, 3 August. Available at: https://www.mondaq.com/eu-digital-omnibus-on-ai-enters-into-force/1825722 [Accessed 24 October 2026].

Lakshmanan, R., 2025. Italy Fines Apple €98.6 Million Over ATT Rules Limiting App Store Competition. The Hacker News, 24 December. Available at: https://thehackernews.com/2025/12/italy-fines-apple-986-million-over-att.html [Accessed 24 October 2026].

Law, R., 2025. AI Overviews reduce clicks by 34.5%. Ahrefs, 17 April. Available at: https://ahrefs.com/blog/ai-overviews-reduce-clicks/ [Accessed 24 October 2026].

Law, R., 2026. Update: AI Overviews Reduce Clicks by 58%. Ahrefs, 4 February. Available at: https://ahrefs.com/blog/ai-overviews-reduce-clicks-update/ [Accessed 24 October 2026].

Maryland General Assembly, 2024. Maryland Online Data Privacy Act of 2024, Chapter 455 (SB 541). Available at: https://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf [Accessed 24 October 2026].

Meta, n.d.a. Conversions API. Meta for Developers. Available at: https://developers.facebook.com/documentation/ads-commerce/conversions-api [Accessed 24 October 2026].

Meta, n.d.b. Handling Duplicate Pixel and Conversions API Events. Meta for Developers. Available at: https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events [Accessed 24 October 2026].

Meta, n.d.c. Data processing options for US users. Meta for Developers. Available at: https://developers.facebook.com/docs/marketing-apis/data-processing-options [Accessed 24 October 2026].

Meta, n.d.d. Conversions API End-to-End Implementation. Meta for Developers. Available at: https://developers.facebook.com/documentation/ads-commerce/conversions-api/guides/end-to-end-implementation [Accessed 24 October 2026].

Meta, n.d.e. Using the API. Conversions API, Meta for Developers. Available at: https://developers.facebook.com/docs/marketing-api/conversions-api/using-the-api [Accessed 24 October 2026].

Meta Marketing Science, n.d. Key Features. Robyn documentation, Meta. Available at: https://facebookexperimental.github.io/Robyn/docs/features/ [Accessed 24 October 2026].

Mozilla, 2022. Firefox rolls out Total Cookie Protection by default to more users worldwide. Mozilla Blog, 14 June (updated 28 August 2024). Available at: https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users/ [Accessed 24 October 2026].

Mozilla, 2025. Privacy-Preserving Attribution. Firefox Help, updated 19 November. Available at: https://support.mozilla.org/en-US/kb/privacy-preserving-attribution [Accessed 24 October 2026].

Nair, H., 2025. Meridian is now available to everyone. Google, 29 January. Available at: https://blog.google/products/ads-commerce/meridian-marketing-mix-model-open-to-everyone/ [Accessed 24 October 2026].

OpenAI, 2026a. New ways to buy ChatGPT ads. OpenAI, 5 May. Available at: https://openai.com/index/new-ways-to-buy-chatgpt-ads [Accessed 24 October 2026].

OpenAI, 2026b. A milestone in expanding access to AI. OpenAI, 31 August. Available at: https://openai.com/index/expanding-access-to-ai-with-chatgpt-ads/ [Accessed 24 October 2026].

Rijo, L., 2025a. Google disputes Pew study showing AI Overviews reduce clicks by half. PPC Land, 28 July. Available at: https://ppc.land/google-disputes-pew-study-showing-ai-overviews-reduce-clicks-by-half/ [Accessed 24 October 2026].

Rijo, L., 2025b. Google lowers incrementality testing threshold to $5,000 for advertisers. PPC Land, 13 November. Available at: https://ppc.land/google-lowers-incrementality-testing-threshold-to-5-000-for-advertisers/ [Accessed 24 October 2026].

Rijo, L., 2026a. AAMP and AdCP overlap on 13 functions, IAB Tech Lab COO says. PPC Land, 20 August. Available at: https://ppc.land/aamp-and-adcp-overlap-on-13-functions-iab-tech-lab-coo-says/ [Accessed 24 October 2026].

Rijo, L., 2026b. Apple faces four-month deadline to redesign ATT prompt in Germany. PPC Land, 17 August. Available at: https://ppc.land/apple-faces-four-month-deadline-to-redesign-att-prompt-in-germany/ [Accessed 24 October 2026].

Rijo, L., 2026c. DoubleVerify: ad fraud drops 41% in North America, 45% in EMEA. PPC Land, 30 July. Available at: https://ppc.land/doubleverify-ad-fraud-drops-41-in-north-america-45-in-emea/ [Accessed 24 October 2026].

Rijo, L., 2026d. Neither of ad tech’s two AI agent protocols runs at scale, Adform CTO says. PPC Land, 24 September. Available at: https://ppc.land/neither-of-ad-techs-two-ai-agent-protocols-runs-at-scale-adform-cto-says/ [Accessed 24 October 2026].

Schiff, A., 2026a. The court just unsealed Judge Brinkema’s remedies decision in the Google ad tech antitrust case. Here’s your TL;DR. AdExchanger, 16 September. Available at: https://www.adexchanger.com/platforms/the-court-just-unsealed-judge-brinkemas-remedies-decision-in-the-google-ad-tech-antitrust-case-heres-your-tldr/ [Accessed 24 October 2026].

Schiff, A., 2026b. Google and the DOJ filed their proposed final judgments in the ad tech case. Here’s what they’re still arguing about. AdExchanger, 5 October. Available at: https://adexchanger.com/publishers/google-and-the-doj-filed-their-proposed-final-judgments-in-the-ad-tech-case-heres-what-theyre-still-arguing-about [Accessed 24 October 2026].

Triton Digital, 2025. Yahoo, PubMatic, and Others Launch New Standard for Agentic Advertising. Triton Digital, 15 October. Available at: https://tritondigital.com/news-item/October-15-2025/yahoo-pubmatic-and-others-launch-new-standardfor-agentic-advertising [Accessed 24 October 2026].

UK Government, 2026. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82). legislation.gov.uk. Available at: https://legislation.gov.uk/uksi/2026/82 [Accessed 24 October 2026].

Washington State Office of the Attorney General, n.d. Protecting Washingtonians’ Personal Health Data and Privacy. Available at: https://atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy [Accessed 24 October 2026].

Wertz, N., 2025. Unlock more visibility and control in Performance Max. Google Ads Help, 7 August. Available at: https://support.google.com/google-ads/answer/16451273 [Accessed 24 October 2026].

Wilander, J., 2020. Full Third-Party Cookie Blocking and More. WebKit blog, 24 March. Available at: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ [Accessed 24 October 2026].

WPP Media, 2025. WPP Media Global Advertising Forecast: Global ad revenue set to reach $1.14 trillion. WPP Media, 10 December. Available at: https://www.wppmedia.com/news/report-this-year-next-year-december-2025 [Accessed 24 October 2026].

WPP Media, 2026. This Year Next Year 2026 Midyear Forecast: Global ad revenue to grow 8.9% to $1.3 trillion. WPP Media, 16 June. Available at: https://www.wppmedia.com/news/report-this-year-next-year-midyear-2026 [Accessed 24 October 2026].