Two Lawsuits Allege The Trade Desk Secretly Violates Consumer Privacy Laws

Two new lawsuits allege that adtech giant The Trade Desk systematically tracks people online without their knowledge, builds out detailed user profiles, and monetizes consumer data without adequate disclosures or consent—potentially violating consumer privacy laws.

Filed on March 31 in the Central District of California, one of the class action cases takes aim at The Trade Desk’s Unified ID 2.0 (UID2) identifier, alleging that the tracking tech collects personally identifiable information, like email addresses and phone numbers, and uses it to enable user profiling and real-time bidding. 

Plaintiffs say that while the status quo has shifted away from user-tied online tracking in alignment with consumer privacy demands, “The Trade Desk saw this trend away from traditional ad-targeting tools as an opportunity to build a new form of online tracking that circumvented existing privacy controls.” 

Through UID2, and its predecessor Unified ID that debuted in 2018, The Trade Desk “has been secretly harvesting and monetizing directly identifiable user data from millions of U.S. residents without their knowledge,” thereby breaching California wiretapping laws, the lawsuit alleges. 

While the legal claims of potential privacy violations are not unique, the facts surrounding UID2’s operation might differentiate this case, according to Gary Kibel, a partner at Davis+Gilbert LLP and an expert in data privacy and technology law. 

In this case, he predicts the court will take the claims seriously. “They’ll probably say, ‘Look, there’s some factual issues here about how UID works, how people have their email addresses turned into an identifier. Is that an interception [in the legal sense]? Is that happening with permission on every single site?’ It’s not going to be dismissed out of hand by the court.”

No court has previously ruled UID2 illegal, but similar tracking cases against players including Google and Meta have survived motions to dismiss.

Just days before the filing, on March 28, another class action was filed against the $25 billion company in the Northern District of California, accusing it of illegally tracking millions of consumers through its advertising platform Adsrvr. 

The Trade Desk, plaintiffs allege in this case, operates like a data broker as it tracks, profiles, and de-anonymizes internet users without their knowledge or consent via its Adsrvr Pixel, which follows users across different parts of the web and across devices. 

Collecting a broad range of personal data—from device identifiers and IP addresses to sensitive information like health data—the company builds out user profiles and shares this information with entities looking to advertise through real-time bidding, meaning that consumers’ personal data is exposed not just to winning ad bidders but to a range of third parties, plaintiffs allege. 

The lawsuit also argues that The Trade Desk’s technology works as both a demand-side provider (DSP) and a data management platform (DMP), or data broker, which enables it to artificially inflate bid values with the consumer data it has collected. 

The Trade Desk, the lawsuit says, “has wrongfully and unlawfully trafficked in the named Plaintiffs’ and Class Members’ personal information and other personal data without their consent for substantial profits.” 

The Trade Desk is not only practicing what the Federal Trade Commission categorizes as high-risk behavior around real-time bidding, but is also in violation of both federal and California state privacy laws, according to the complaint. 

Proving injury may be challenging in both cases, especially in light of recent court rulings that effectively heighten the requirements for showing material harm for plaintiffs in class actions involving alleged breaches of the California Invasion of Privacy Act.

Nonetheless, the cases appear strong enough to warrant serious consideration, according to Arielle Garcia, COO of adtech watchdog Check My Ads. 

“I don’t think it’s ambulance-chasing,” she said. “It seems more likely to be a strategic litigation pursuit … [an approach that] is going to be very attractive to privacy advocates right now. I’d anticipate continued pushes at the state level, both for strong privacy legislation—as we’re seeing in Vermont and Massachusetts—and via private litigation like this. So, I wouldn’t sleep on this.”

The Trade Desk did not respond to a request for comment. 

Outside of the new legal challenges, The Trade Desk has found itself under pressure in recent weeks following subpar Q4 revenues and widespread discontent around its Kokai platform update.