Lawsuits Allege Trade Desk Secretly Breaks US Privacy Laws

Two new lawsuits allege that adtech giant The Trade Desk systematically tracks people online without their knowledge, builds out detailed user profiles, and monetizes consumer data without adequate disclosures or consent—potentially violating consumer privacy laws. Filed on March 31 in the Central District of California, one of the class action cases takes aim at The Trade Desk’s Unified ID 2.0 (UID2) identifier, alleging that the tracking tech collects personally identifiable information, like email addresses and phone numbers, and uses it to enable user profiling and real-time bidding. Plaintiffs say that while the status quo has shifted away from user-tied online tracking in alignment with consumer privacy demands, “The Trade Desk saw this trend away from traditional ad-targeting tools as an opportunity to build a new form of online tracking that circumvented existing privacy controls.” Through UID2, and its predecessor Unified ID that debuted in 2018, The Trade Desk “has been secretly harvesting and monetizing directly identifiable user data from millions of U.S. residents without their knowledge,” thereby breaching California wiretapping laws, the lawsuit alleges. No court has previously ruled UID2 illegal, but similar tracking cases against players including Google and Meta have survived motions to dismiss. While the legal claims of potential privacy violations are not unique, the facts surrounding UID2's operation might differentiate this case, according to Gary Kibel, a partner at Davis+Gilbert LLP and an expert in data privacy and technology law. In this case, he predicts the court may look more closely at the claims than some other lawsuits around the California Invasion of Privacy Act (CIPA). "They may say, 'Look, there's some factual issues here about how UID works, how people have their email addresses turned into an identifier. Is that an interception [in the legal sense]? Is that happening with appropriate disclosures on every single site?' While there are strong defenses to many CIPA lawsuits, this one may not be dismissed out of hand by the court due to the unique facts." Just days before the filing, on March 28, another class action was filed against the $25 billion company in the Northern District of California, accusing it of illegally tracking millions of consumers through its advertising platform Adsrvr. The Trade Desk, plaintiffs allege in this case, operates like a data broker as it tracks, profiles, and de-anonymizes internet users without their knowledge or consent via its Adsrvr Pixel, which follows users across different parts of the web and across devices. Collecting a broad range of personal data—from device identifiers and IP addresses to sensitive information like health data—the company builds out user profiles and shares this information with entities looking to advertise through real-time bidding, meaning that consumers’ personal data is exposed not just to winning ad bidders but to a range of third parties, plaintiffs allege. The lawsuit also argues that The Trade Desk’s technology works as both a demand-side provider (DSP) and a data management platform (DMP), or data broker, which enables it to artificially inflate bid values with the consumer data it has collected. The Trade Desk, the lawsuit says, “has wrongfully and unlawfully trafficked in the named Plaintiffs’ and Class Members’ personal information and other personal data without their consent for substantial profits.” The Trade Desk is not only practicing what the Federal Trade Commission categorizes as high-risk behavior around real-time bidding, but is also in violation of both federal and California state privacy laws, according to the complaint. Proving injury may be challenging in both cases, especially in light of recent court rulings that effectively heighten the requirements for showing material harm for plaintiffs in class actions involving alleged breaches of CIPA. Nonetheless, the cases appear strong enough to warrant serious consideration, according to Arielle Garcia, COO of adtech watchdog Check My Ads. “I don't think it's ambulance-chasing,” she said. “It seems more likely to be a strategic litigation pursuit … [an approach that] is going to be very attractive to privacy advocates right now. I'd anticipate continued pushes at the state level, both for strong privacy legislation—as we're seeing in Vermont and Massachusetts—and via private litigation like this. So, I wouldn't sleep on this.” The Trade Desk did not respond to a request for comment. Outside of the new legal challenges, The Trade Desk has found itself under pressure in recent weeks following subpar Q4 revenues and widespread discontent around its Kokai platform update. Update April 11, 1:05 pm ET: This story has been updated to clarify Kibel's comment. Kibel believes that many legal complaints concerning CIPA are hollow, but that the unique facts of these two lawsuits may lead the courts to take these complaints more seriously.

Ad Tech Industry News

Two Lawsuits Allege The Trade Desk Secretly Violates Consumer Privacy Laws

The adtech company faces new legal challenges over its use of consumers' personal information

UNLOCK FULL ACCESS

Kendra Barnett

Programmatic

ADWEEK Tech Advantage: AI Agents Are Increasingly Getting Their Hands on Ad Dollars

Google Gets to Keep Its Adtech Stack Intact. Does The Trade Desk's Pitch Lose its Punch?

Runway’s AI Video Agent Creates and Measures Ads Across Platforms

The Trade Desk's 10 Years on Wall Street: Booms, Busts, and the Battle for What's Next

Apostra Wants to Be the Agentic Ad Layer. Does the Industry Need One?

Entering the New World of Marketing With LLMs

Scope3’s Rebrand to Apostra Solidifies Shift from Sustainability to AI

Former Magnite Exec Adam Soroca Named PebblePost CEO

Is The Trade Desk Running Out of Room to Turn Around?