Ad Tech & Identity · Ad Tech (demand-side platform / identity) · Private litigation
The Trade Desk (UID2)
Headline
The Trade Desk built Unified ID 2.0 (UID2) as the industry's 'privacy-safe' replacement for third-party cookies, but UID2 is built from hashed email addresses and phone numbers — data that identifies a real person…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The Trade Desk built Unified ID 2.0 (UID2) as the industry's 'privacy-safe' replacement for third-party cookies, but UID2 is built from hashed email addresses and phone numbers — data that identifies a real person — and the FTC said in 2024 that hashing does not make data anonymous (as reported by AdExchanger). Two class actions filed in C.D. Cal. on March 31, 2025 allege the company is 'secretly harvesting and monetizing directly identifiable user data' via UID2, partly under the California Invasion of Privacy Act; per AdExchanger they were consolidated and a motion to dismiss was pending as of late September 2025. No ruling or settlement verified this pass. The Trade Desk's own privacy policy says the data it processes can include inferred demographics that may reveal health, sexual orientation or religion, and precise geolocation.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.adexchanger.com/data-privacy-roundup/putting-uid2-under-the-legal-microscope — Unverified - heuristic first draft.
Terms
Arbitration
Not applicable to consumers — no consumer-facing contract.
Data sharing
Collects pseudonymous IDs incl. hashed email/phone-derived IDs, IP, device data, ad impressions, inferred interest/demographic data (policy flags some may reveal health, sexual orientation or religion), and possibly precise geolocation. Policy says some activities 'may be considered sales or sharing'. Pending consolidated class action alleges UID2 tracks consumers and profiles them without consent.
Fees and billing
None identified (no consumer billing relationship).
Contacts
Privacy contact. dpo@thetradedesk.com; The Trade Desk, Global Privacy Office, Attn: Global DPO, 42 N. Chestnut St., Ventura, CA 93001; opt-out at adsrvr.org
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State registered agent in the state of incorporation must accept service. Privacy policy lists global HQ: 42 N. Chestnut St., Ventura, CA 93001.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| News (Adweek) · 2025-04-10 www.adweek.com/programmatic/lawsuits-trade-desk-consumer-privacy-laws/ | whole row | Unassigned | confirmed | “as an opportunity to build a new form of online tracking that circumvented existing privacy controls” Quote basis: not recorded. |
| News (AdExchanger) · 2025-10-06 www.adexchanger.com/data-privacy-roundup/putting-uid2-under-the-legal-microscope | whole row | Unassigned | confirmed | “secretly harvesting and monetizing directly identifiable user data” Quote basis: not recorded. |
| Law firm alert · 2025-04-24 www.nge.com/news-insights/publication/tips-to-reduce-risk-of-exposure-to-uid2-class-actions/ | whole row | Unassigned | confirmed | “no court has yet ruled on the legality of UID2” Quote basis: not recorded. |
| Company privacy policy · 2026-10-16 www.thetradedesk.com/legal/privacy | whole row | Unassigned | confirmed | “may be considered 'sales' or 'sharing' of your personal information” Quote basis: not recorded. |
| SEC EDGAR ticker file · 2026-10-16 www.sec.gov/files/company_tickers.json | whole row | Unassigned | confirmed | “'ticker': 'TTD', 'title': 'Trade Desk, Inc.'” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.thetradedesk.com/legal/privacy | Not fetched yet | NOT CONFIRMED |
| Terms of service No URL recorded | Not fetched yet | NOT CONFIRMED |
| Website https://www.thetradedesk.com | Not fetched yet | — |
| Primary source https://www.adexchanger.com/data-privacy-roundup/putting-uid2-under-the-legal-microscope Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |