On 1 August, your audience segments started quietly deleting themselves
A deletion mechanism commenced, a data pact was formally queried, a twelfth state joined an enforcement bloc, and the biggest walled garden opened a measurement door. All in eight days.
A deletion clock now runs under every purchased segment#
A fox does not count the field by what it saw last season. It re-reads the ground every night, because the warren moves and the scent goes cold. Most audience plans still count a segment purchased in March as though it were the same segment in August. From this month it demonstrably is not, which is why first party data has stopped being a virtue and started being arithmetic.
Beginning 1 August 2026, registered data brokers in California must access the state's accessible deletion mechanism, known as DROP, and begin processing deletion requests. The California Privacy Protection Agency's data broker page states the cadence plainly: brokers must access DROP "at least once every 45 days", and "starting August 1, you have 45 days to access DROP and process your first batch of deletion requests".
The penalties are per request and per day. The CalPrivacy data broker page sets a penalty of 200 dollars per day per deletion request for failing to delete information as required, alongside a separate 200 dollars per day for failure to register. Annual registration runs to 6,000 dollars plus a processing fee, with the registration window having run from 1 to 31 January 2026.
Nothing about this is theoretical for a media plan. If a supplier is deleting matched Californians on a rolling 45-day cycle, then match rates fall, segment counts fall, and any lookalike audiences seeded from that file inherit the decay. The seed shrinks, the model drifts, and the performance report blames creative. Follow that trail back far enough and the answer is always the same: first party data is the only ground that does not move under you.
Europe formally queried the pipe that carries US ad data#
Three days earlier, on 31 July 2026, the European Data Protection Board wrote to the European Commission about the EU-US Data Privacy Framework. The letter, from Chair Anu Talus to Commissioner Michael McGrath, is filed under the board's correspondence on international transfers and adequacy, per the EDPB's own document page, with the letter itself published as a PDF.
The trigger is the 29 June 2026 Supreme Court decision in Trump v. Slaughter, which overturned Humphrey's Executor v. United States (1935) and removed the statutory bar on presidential removal of Federal Trade Commission commissioners, as PPC Land set out. The adequacy decision at issue, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, relied in part on commissioners being removable only for inefficiency, neglect of duty or malfeasance in office.
The board's reasoning, as reported by the International Association of Privacy Professionals, turns on a single principle: "the existence and effective functioning of one or more independent supervisory authorities in the third country ... is one of the key elements to be taken into account when assessing the adequacy".
Not a suspension
The EDPB did not ask for the framework to be invalidated or suspended, and nothing about transfers changed on 31 July. Certifications remain in place and campaigns did not stop. Anyone telling you the pact has fallen is selling something.
The FTC independence ruling behind the EDPB query is detailed in this piece, explaining the Trump v. Slaughter mechanism.
A formal request to reassess
The board asked the Commission to assess the judgment's implications and report back. That is the first procedural step on the same road that ended two previous transfer frameworks, which makes it a planning signal rather than an emergency.
The practical response is unglamorous: know which of your platforms rely on framework self-certification rather than standard contractual clauses, and know it before you need to. Data privacy compliance work done calmly in August is considerably cheaper than the same work done urgently in a quarter's time. A fox that has already scouted the second exit does not need to hurry.
One gap now exposes you to twelve regulators#
On 4 August 2026, Vermont joined the Consortium of Privacy Regulators, taking it to twelve members: the California Privacy Protection Agency alongside the state attorneys general of eleven states spanning the west, the midwest and the eastern seaboard, per CalPrivacy's announcement. The consortium, announced in April 2025, coordinates investigations and shares expertise across jurisdictions. Vermont's entry follows the signing of its Data Privacy and Online Surveillance Act on 16 June. First party data governance now has to satisfy a bloc rather than a single authority.
Regulators in the consortium
Up from the founding group announced in April 2025. Investigations and expertise are shared across all of them.
Broker access cadence
The maximum interval at which a California-registered data broker must return to DROP and process deletions.
Penalty per request
For failing to delete information as required. A separate 200 dollars a day applies to failure to register.
Annual registration fee
Plus an associated third-party processing fee for electronic payments, per CalPrivacy.
Twelve regulators sharing findings changes the shape of risk rather than its size. A single defect in a consent flow or a supplier contract is no longer a conversation with one authority, it is a file that eleven others can read. Tom Kemp, CalPrivacy's executive director, put the intent bluntly: "Collaboration across states empowers consumers and leads to better privacy protections for everyone."
The walled garden opened a measurement door#
The same day Vermont joined, LiveRamp announced that Meta had been added to Cross-Media Intelligence, giving marketers de-duplicated attribution and incrementality measurement from Meta inside the LiveRamp Clean Room, with unified reporting built on first party data across Meta, connected television, programmatic, social and audio. Christine Grammier, vice president of product, framed it as giving brand marketers "the single, trusted view of campaign performance", per the LiveRamp release on Businesswire.
Hill's Pet Nutrition is the only named adopter, and the release discloses no pricing, customer count or performance metric. That is worth stating rather than glossing, because a launch without numbers is a direction of travel, not a proof point.
The demand behind it is real enough. Trade coverage of the launch cites a TransUnion and EMARKETER study in which 54.1 per cent of marketers reported no year-on-year improvement in measurement, 49.5 per cent cited fragmented data, 48 per cent cited cross-channel de-duplication problems and 40.8 per cent cited walled-garden reporting limits, per PPC Land. We have not opened the underlying study, so treat those as reported percentages rather than figures we have verified at source. Measurement built on first party data is the common thread running through every one of those complaints.
| Asset | What it depends on | Durability from August 2026 |
|---|---|---|
| Purchased third-party segments | A broker's registration and deletion compliance | Lowest. Decays on a 45-day access cadence you do not control. |
| Lookalike audiences from a bought seed | The seed file staying intact | Low. Inherits every deletion applied to the source. |
| Platform interest targeting | Platform policy and regional rules | Medium. Stable in the short run, opaque and unappealable. |
| Clean room measurement on your own file | Your consent record and match quality | High. Depends on evidence you hold and can re-derive. |
| Consented first party data | Your own relationship and disclosure | Highest. The only asset a deletion mechanism cannot silently erode. |
Read the week as one movement rather than four announcements. Rented audience data is being made to expire on a published schedule, the transatlantic pipe carrying much of it has been formally questioned, enforcement has consolidated into a bloc, and the largest walled garden has made it easier to measure against a file you own. Every one of those pushes the same way, and the direction is first party data.
Five moves to make your first party data the durable asset#
This is not a call to burn the media plan. It is a call to know which parts of it are rented and on what terms. The patient animal knows which ground is its own.
Record when each segment was built, from what source, and when it was last refreshed. Any purchased audience older than 45 days should now be treated as an estimate rather than a count.
Find which models were seeded from bought files. Those models inherit the decay of their source, so rebuild them from consented first party data where the volume allows it.
List which martech and ad platforms rely on Data Privacy Framework self-certification rather than standard contractual clauses. You want that list before the Commission reports back, not after.
Start reporting match rate alongside reach. A falling match rate is the earliest visible symptom of audience decay, and it usually shows up months before the performance number does.
Put real budget into the mechanisms that generate owned data: preference centres, logged-in experiences, useful email, community. It is slower than buying a segment and it is the only asset that appreciates.
There is a broader point about audience segmentation hiding in the detail. For fifteen years the industry treated audience data as inventory: something you buy in volume, hold on a shelf, and draw down. Regulators have now attached an expiry date to the shelf. Inventory with an expiry date is not inventory, it is perishable stock, and perishable stock is managed completely differently. First party data is the only line on that shelf with no expiry stamped on it.
Starting August 1, you have 45 days to access DROP and process your first batch of deletion requests.
One sentence of guidance to brokers, and it quietly re-prices every audience a marketer buys from them. Work out which of your segments are perishable before the quarter does it for you, and keep the den stocked with data you actually own.
Frequently asked questions#
What is DROP and does it affect brands or only data brokers?
DROP is California's centralised deletion mechanism. The legal obligation sits on registered data brokers, who from 1 August 2026 must access it at least once every 45 days and process deletion requests. Brands are affected indirectly but materially, because any audience segment bought from a broker now shrinks on that cadence.
Has the EU-US Data Privacy Framework been suspended?
No. On 31 July 2026 the European Data Protection Board asked the European Commission to reassess the framework following the Supreme Court decision in Trump v. Slaughter, which removed protections against removal of FTC commissioners. The board did not request suspension or invalidation, and transfers continue while the Commission considers it.
Why would deletion requests affect my lookalike audiences?
A lookalike model is only as good as the seed file it was built from. If that seed came from purchased data and the supplier is deleting matched individuals on a rolling cycle, the seed shrinks and the model drifts away from the population you originally targeted. The symptom usually appears as unexplained performance decay.
What does the Consortium of Privacy Regulators actually do?
It coordinates investigations and shares expertise and resources across member jurisdictions. With Vermont joining on 4 August 2026 it has twelve members, comprising the California Privacy Protection Agency and eleven state attorneys general, so a compliance defect found in one state can be examined by all of them.
Is a clean room a substitute for consent?
No. A clean room governs how data is joined and measured, not whether you had the right to collect it. It is valuable because it lets you measure across channels against a file you own, but the underlying consent record still has to stand on its own. Treat it as measurement infrastructure, not as a legal basis.
What should I measure to spot audience decay early?
Match rate. Report it alongside reach for every audience you upload or activate, and track it over time by source. A declining match rate on a purchased segment is the earliest reliable signal that the underlying file is being deleted down, and it typically moves well before cost per acquisition does.
Read more on this topic#
Gen X vs Baby Boomers: the segmentation mistake
Before you rebuild the data, check the segmentation logic underneath it still holds.
Read the pieceMeta put its prices up 20 per cent in North America
What rising media prices do to a plan whose targeting is quietly getting weaker.
Read the pieceThe platforms just made AI slop a distribution problem
If targeting decays, creative carries more of the load. Here is what the platforms decided about it.
Read the pieceSearch traffic fell 34 per cent. The measurement caught up
The measurement half of the same problem, on the organic side of the house.
Read the piece
Want to know which of your audiences are perishable?
folkfox rebuilds audience strategy for brands in awkward categories: first party data mechanisms that actually collect, lookalike seeds rebuilt on ground you own, and match rate reported before performance slips.