Last year, Google decided not to deprecate third-party cookies in Chrome after all. This year, Google decided to jettison its backup plan and not even launch a planned choice prompt for cookies in its browser.
By October, the Privacy Sandbox was all but kaput. The UK’s Competition and Markets Authority released Google from its Privacy Sandbox commitments and –
Psych. I’m done writing about third-party cookie deprecation, guys. Let’s move on, fur real.
It would be easy to write a little end-of-year retrospective piece about the end (of the end) of third-party cookies in Chrome. But I won’t do that to you. Much like Bartleby, I simply prefer not to. Enough ink’s been spilled on the topic of cookies already.
I’d much rather scriven about something a little more forward-looking – and make my sources do the work for me.
And so I asked a bunch of experts to help me get a bead on the future and answer this question: What’s one data privacy shift or regulation you think will most reshape digital advertising in 2026, and who will be most unprepared for it?
- Camille Marcos Napa, VP, legal and head of privacy, Cadent
- Rohan Ramesh, VP, data science, Vevo
- Vikrant Mathur, co-founder, Future Today
- Holly Melton, partner, Frankfurt Kurnit Klein & Selz
- Damian Garbaccio, chief commercial and marketing officer, Affinity Solutions
- April Weeks, chief investment and media officer, Basis
- Craig Benner, CEO, Accretive
Camille Marcos Napa, VP, legal and head of privacy, Cadent
Heightened regulatory scrutiny of automated decision-making, profiling and the use of data to infer or predict sensitive characteristics from behavioral, location or engagement signals.
While US state privacy laws don’t yet uniformly treat inferred data as a standalone regulated category, regulators are increasingly focused on how personal data is combined, modeled and activated through analytics and AI, particularly where those practices may implicate sensitive data or consumer rights.
The organizations least prepared for this environment are those that depend on complex or opaque ad tech ecosystems and third-party AI tools without a clear understanding of underlying data flows, model functionality or downstream use.
Rohan Ramesh, VP, data science, Vevo
As AI becomes cheaper and more powerful, the volume of AI-generated and AI-edited video content will surge. That scale will force regulators and platforms to scrutinize not just where data comes from but what content advertisers are adjacent to and whether the metadata is accurate, transparent and verifiable.
This will elevate metadata from a technical detail to a compliance and brand safety issue. Advertisers will increasingly demand guarantees that content is premium, human-reviewed, clearly labeled and accurately described. Publishers that can certify content authenticity and metadata quality will have a meaningful advantage.
Vikrant Mathur, Co-Founder, Future Today
COPPA 2.0 – and the broader momentum around teen data protections – is going to fundamentally reshape how advertisers think about brand safety in 2026.
Marketers will be forced to move beyond generic compliance language and show verifiable, platform-level accountability, including providing age-appropriate contextual alignment, data minimization and real safeguards for under-17 audiences.
The most unprepared will be those who’ve relied on legacy audience proxies or assumed one-size-fits-all filters were enough. What’s coming is a shift in mindset, where trust, transparency and a privacy-first infrastructure become not just buzzwords but prerequisites for media investment.
Holly Melton, partner, Frankfurt Kurnit Klein & Selz
One of the biggest shifts that will reshape digital advertising in 2026 – and one of the issues clients are raising most urgently – is the surge of state-level youth privacy and age-gating laws. These proposals go way beyond COPPA, effectively requiring platforms and advertisers to treat every user as potentially under 18 unless age can be reliably verified.
Clients are increasingly worried because most companies will have no choice but to apply the strictest standards to all users; very few can distinguish a 16-year-old from a 26-year-old with confidence.
The advertisers most unprepared for this shift are the brands that insist they “don’t market to kids” but, in reality, have large teen audiences: beauty, fashion, gaming, entertainment and quick-service restaurants. They’ve never had to operate like youth marketers before, but state legislatures are working to effectively make that the default.
Damian Garbaccio, chief commercial and marketing officer, Affinity Solutions
Today, marketers are racing ahead with generative AI for creative, targeting and optimization, but governance hasn’t kept pace. The ad industry largely ignored early warning signs such as deepfakes, biased outputs and opaque data use – and now faces a reckoning.
Who will be most unprepared? Those who treat AI as a plug-and-play tool without understanding its data dependencies. Many advertisers don’t realize that the data used to train AI models could soon require explicit consent, compensation or transparency under new laws. This will upend current practices in personalization and measurement.
The winners will be proactive. They’ll engage regulators early, advocate for balanced frameworks and build privacy-by-design into their AI strategies.
April Weeks, chief investment and media officer, Basis
Privacy concerns are being voiced by consumers and are likely to sharply increase when ads become embedded in conversational AI tools.
But on the heels of the executive order to institute a federal framework to preempt state laws, we could be entering a period of uncertainty, especially if states challenge the practices included within the national framework.
Implement good AI governance and brand safety measures. We don’t want to turn consumers off with bad practices before marketers have a chance to truly find the right use cases and deliver real value.
Craig Benner, CEO, Accretive
The privacy shift that will most reshape advertising in 2026 is not a new law; it will be regulators finally enforcing what already exists, especially around precise location and inferred behavioral signals being treated as sensitive by default.
The most unprepared players will be legacy data brokers, DSPs and measurement vendors built on opaque supply chains and maximum-precision assumptions. Couple this with the fact that none of them have a direct relationship with any mass of consumers and you have trouble.
The reality is, many cannot and will not survive a real audit because their systems were never designed for scrutiny.
Answers have been lightly edited and condensed.
🙏 Thanks for reading! And happy New Year, of course. Here’s my gift to you. 😹 As always, feel free to drop me a line at allison@adexchanger.com with any comments or feedback.
