Federal judge rules PubMatic must face class-action profiling privacy lawsuit
A federal judge in California has ruled that ad tech company PubMatic must face a class-action lawsuit alleging that it illegally collected and shared consumer browsing data for ad-targeting purposes. The court rejected PubMatic's argument that its tracking and data-compilation practices constitute routine commercial behavior.
Key Takeaways
- Judge Susan Illston ruled users adequately pled a 'highly offensive' privacy intrusion regarding PubMatic's data collection.
- The lawsuit alleges PubMatic technology can de-anonymize browsing data and assign users to sensitive categories like 'credit risk' and 'affluence level.'
- PubMatic argued its practices constitute routine commercial behavior, similar to a store clerk observing shoppers, but the court distinguished cross-site tracking as more invasive.
- The decision allows claims for violations of federal and state wiretap laws and the California 'intrusion upon seclusion' claim to move forward.
Why It Matters
The ruling limits the 'routine commercial behavior' defense often used by ad tech intermediaries to justify cross-site tracking. By distinguishing automated, cross-site profiling from single-site session recording, the court establishes a higher bar for consent in the programmatic supply chain. This creates immediate litigation risk for SSPs and DSPs that rely on de-identified device IDs if those IDs can be linked back to specific individuals. Streaming platforms and publishers must now evaluate if their third-party ad tech integrations meet the 'highly offensive' threshold as defined by this precedent. Watch for whether PubMatic attempts an interlocutory appeal or moves toward a settlement similar to Oracle’s $115 million privacy deal.
Additional Context
The ruling against PubMatic mirrors a broader trend of judicial pushback against ad tech tracking in California. In July 2025, U.S. District Judge Jon Tigar similarly ruled that data broker LiveRamp must face class-action claims for allegedly creating real-time identity profiles of hundreds of millions of people using online and offline data. Per MediaPost (July 2025), that court also rejected the notion that tracking individuals across thousands of websites constitutes standard commercial activity, characterizing it instead as 'dragnet-style' collection. These cases follow the massive $115 million settlement reached by Oracle in mid-2024 to resolve a long-running privacy class action concerning its now-shuttered advertising business.
Beyond consumer privacy, PubMatic is currently navigating significant market and legal headwinds. In September 2025, the company filed its own lawsuit against Google in the Eastern District of Virginia, alleging anticompetitive behavior in the publisher ad server market (per Marketing Dive, September 2025). Simultaneously, PubMatic is defending against a securities class action filed in August 2025. This suit, per ZLK (January 2026), alleges that the company failed to disclose that a major Demand Side Platform (DSP) partner was shifting business away to a competitor, leading to a 21% share price drop after a revised Q3 revenue guidance of $61 million to $66 million was issued.
Read full article at mediapost.com
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source