The Regulatory Tsunami No One In Advertising Is Talking About

Avi Chai Outmezguine is CEO of Becausal, powering next-generation audience intelligence through causal AI-driven data innovation.

getty

​The industry is celebrating the end of the cookie wars. It should be preparing for something far worse: Regulators are coming for the AI models themselves, and those models can’t answer the questions they’re about to be asked.​

The adtech industry may feel like the crisis of privacy has passed. The cookie wars are over. Clean rooms are booming. Retail media is surging. Everyone has a privacy-first strategy. Panels promise privacy-safe personalization at scale. The crisis hasn’t passed, though; it has shapeshifted.​

While the industry focused on cookies, privacy regulation hardened. More than 20 U.S. states now have comprehensive consumer privacy laws. Amendments are tightening definitions, expanding enforcement and removing grace periods.

​California has expanded accountability for companies that sell or share consumer data, including new disclosure obligations around sensitive data and AI-related data flows. Colorado now requires opt-in consent before processing minors’ data for advertising, sale or profiling, alongside formal risk assessment requirements. Maryland goes further, prohibiting the processing of sensitive data unless it is strictly necessary for the requested service.​ ​Enforcement budgets are growing, and regulators are moving from data collection to model accountability.​

There is no federal rescue coming. The patchwork seems permanent.​

Meanwhile, consumers have already moved. Trust in companies handling personal data remains low, and large majorities view AI-based data collection as a risk. Many consumers are opting out, turning off tracking or using fake information. The result is a shrinking, biased and increasingly fragile data environment.​

We’ve reached an inflection point. The industry is repeating the same mistake: moving fast, assuming regulation won’t catch up and relying on transparency language without structural transparency.​

This time, regulation is already here.​

Apparent transparency is not actual transparency.​

Organizations deploying AI face growing risks around privacy, explainability and compliance. Yet mitigation efforts lag behind adoption. Advertising, which uses AI across segmentation, bidding and attribution, sits directly in this exposure.​

Most platforms claim transparency. They publish policies, dashboards and aggregated reporting. But this is apparent transparency, not actual transparency.

Actual transparency requires answering four questions:​

• Can you trace an output to the specific data that produced it?

• Can you explain why a decision was made about a specific person?

• Can you quantify uncertainty?

• Can you remove a person’s influence from the model when deletion is requested?​

For the parameterized models that dominate advertising, neural networks, gradient-boosted systems and deep learning architectures, the answer is typically no.​

During training, data is compressed into weights. Afterward, decisions cannot be traced to individuals. Reasoning is opaque. Deletion requires retraining. Bias can be measured in aggregate but not at the individual level.​

The model becomes a black box with a transparency sticker on it. Regulators are about to peel off that sticker.​

Consider deletion mandates. When a consumer requests removal, companies can delete raw data. But if that data already influenced model weights, its impact remains. Removing it would require retraining. This creates a structural gap between regulatory promises and technical reality.

Advertising already operates on layers of opacity. Platforms evaluate their own performance. Models evaluate their own accuracy. Attribution systems claim causation using methods outsiders cannot audit. Transparency is performative from reporting layer to model architecture.​

Regulation is beginning to demand the real thing.​

The way out is through better science​.

Regulators, consumers and CFOs are converging on the same demand, even if they express it differently. Regulators want explainability, deletion and non-discrimination. Consumers want minimal data use. CFOs want proof that advertising caused result.​

These are not separate requirements. They converge on three principles:

• Transparency

• Minimal data dependency

• Causal rigor​

The problems described are not inherent to AI itself, but to a specific kind of AI: parameterized, weight-based models. Alternative approaches exist.​

Non-parameterized AI, where the data itself constitutes the model rather than being compressed into weights, offers fundamentally different properties. Outputs are traceable. Decisions are explainable. Deletion is structurally clean. Bias can be evaluated at the individual level. Uncertainty is measurable.​

Approaches grounded in information theory, combined with deterministic purchase data and causal inference, can offer a more reliable way to measure outcomes. In practice, they tend to improve transparency and accuracy while reducing reliance on privacy-sensitive techniques common in traditional models.​​

No cookies. No identity graphs. No black boxes. The regulations did not create this need. They formalized what rigorous measurement already required.​

The tsunami doesn't care.​

The U.S. privacy landscape will not simplify. Expect dozens of comprehensive laws within the next two years. I believe enforcement will increasingly target AI models themselves, not just what data was collected, but how models operate and whether they can explain decisions.​

Globally, the acceleration is even sharper. The EU AI Act introduces fines up to 7% of global revenue. GDPR enforcement continues to expand. Most of the world now lives under modern privacy regulation.​

The direction is unmistakable.​

The industry has framed privacy and performance as a trade-off. That framing is wrong. The most rigorous measurement is inherently privacy-safe because it relies on causal proof rather than surveillance. And privacy-safe systems are often more accurate because they avoid biased tracking samples.​

Privacy and performance converge.​ Companies that understand this will build the next generation of advertising infrastructure. Those that don’t will discover that apparent transparency is no defense when regulators ask them to show their work.​

The cookie era trained us to ask: What can we track?

The era we’ve entered demands a different question: What can we prove?​

The companies still asking the first question are living in a fool’s paradise. The tsunami doesn’t care.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?