Three days before a Montgomery County jury was due to hear the case, TikTok signed a document that does something money alone cannot. It fixed numbers to product behaviour: 120 minutes, midnight to 6am, 14% in year one and 10% in year two, January 25, June 25, September 25. Numbers of that kind bind. They can be checked against a screen.

The rest of the week produced numbers of a different sort. A German court put a ceiling of 250,000 euros on each future breach by a company that had argued it held no data at all. Google added a column to a customer file upload and switched it off in 32 territories, without saying what happens to the rows it will not use. A product manager at a biotechnology firm re-read two Marketing Science papers and concluded that the industry's standard measurement is wrong by a factor of three often enough to matter. And two of the largest physical networks in the world, a burger chain and an airline group, began selling advertising against footfall and passenger counts that no outside party audits.

Game: The client brief lands on four desks that never talk
Sixteen terms, four groups of four, and a grid where the obvious reading is usually the wrong one. The hardest group is four entirely ordinary words.
PPC LandLuis Rijo

The pattern is not hypocrisy. It is a difference in who writes the number down. When a court, a regulator or a consumer federation sets the figure, it comes with a date, a penalty and an enforcement path. When the ad industry sets it, it usually comes with a deck.

Alabama put a stopwatch inside TikTok, and priced the rest at $183.8m

Circuit Judge Monet M. Gaines signed the consent decree at 4:29:53pm on Friday, September 25, 2026, in State of Alabama ex rel. Steve Marshall v. TikTok Inc. et al., case 03-CV-2025-900628.00, Montgomery County Circuit Court. The trial it averted was set for September 28. Alabama had filed in April 2025, alleging addictive algorithmic design, exposure to harmful material and misrepresentation of safety; TikTok moved to dismiss in June 2025 on Section 230 and COPPA grounds. That motion will now never be decided, as PPC Land reported on September 26.

The guaranteed money is $116.2 million, split into $14.2 million of attorneys' fees and costs due by October 25, 2026, and $100 million of compensatory restitution due by November 9, 2026. A second fund of $183.8 million sits behind it, released in four tiers as other states sign substantively equivalent agreements: $55.14 million at ten states, another $55.14 million at twenty, then $36.76 million at thirty and $36.76 million at forty, each tier carrying a 24-month window from the last. A most-favoured-nation clause adds up to 1.55% of any recovery above $5.1 billion that other states extract in the Meta matter, excluding Texas, Florida and New Mexico, paid across five annual instalments.

What matters more for anyone building against the platform is the injunctive schedule. Alabama teen users, defined as anyone with a predicted or stated age of 13 to 17, get a 120-minute default daily maximum that resets at midnight. Search, messaging, settings and videos of at least ten minutes are excluded from the count, a carve-out that quietly rewards longform uploads. Night Access Mode blocks the app from midnight to 6am device local time, with messaging, settings and Search still reachable, and push notifications go dark from 10pm to 7am apart from urgent security and messaging alerts. School-hours notifications stop between 8am and 3pm on weekdays. Productive pauses must appear at 60 and 90 cumulative minutes by January 25, 2027, with a further notice after any continuous 15-minute session that follows a pause. Cosmetic procedure filters, those making a face "idealizable without cosmetic surgery", come off teen accounts by March 24, 2027, with fantasy effects, character effects, ordinary makeup and parody exempt.

The provision with the longest reach is the feed. By June 25, 2027, TikTok must offer Alabama teens a non-personalised option ranked "chronologically, by general popularity, or based on other neutral or uniformly applied criteria", prompt every new teen account within ten days, and preselect neither answer. Parents can set it and control the switch back. Ranking is where the advertising value sits, and a court has now written a specification for an alternative to it.

Then there is accuracy. By September 25, 2027, TikTok's age-band estimation must hold false positives to 14% for the 16 to 17 band and 7% for 13 to 15; by September 25, 2028 those fall to 10% and 5%. Compliance is self-certified against internal testing unless 40 or more attorneys general sign equivalent terms, at which point an independent auditor takes over through a 60-day process. An under-13 detection prototype is due March 25, 2027, reviewing friend networks of deleted accounts and assessing posts and comments for age indicators, with a presumption of under-13 status where no indicator exists. That obligation is conditioned on the FTC keeping the age-verification enforcement policy statement it issued in February 2026; if the statement is withdrawn, the duty drops to best efforts. Data gathered for age assurance must be held only as long as needed and then deleted, vendor metadata within 90 days at the "coarsest viable granularity", and under-13 data may not feed ad targeting, marketing or algorithmic optimisation.

The structure borrows directly from the Meta consent judgment of August 26, 2026, which tied a $5.02 billion contingency to whether Snap, TikTok and YouTube adopted equivalent rules. Alabama inverted it. Where Meta's money depended on rivals signing, TikTok's contingent tranches depend on TikTok itself signing with more states, and a further set of restrictions activates only once Meta, Snap and YouTube are all bound: the night block widens to 10pm-7am, numerical reaction counts disappear from teen Friends Feeds and profile pages though not the For You feed, and the daily cap runs across explicitly linked accounts. Should Meta's obligations be read as requiring a 60-minute per-company limit, TikTok's ceiling drops to 60 minutes too. Analysts have already questioned whether that tobacco-style architecture holds, and the decree's own drafting supplies ammunition: the attorney general described pauses at 15, 60 and 90 minutes while the text specifies 60 and 90; the feed is called a default in the announcement and an option in the decree; paragraph 3.2 runs teen educational tools to September 2033 while the term expires September 25, 2031.

TikTok's federal exposure has not moved. Judge George Wu issued a tentative ruling on September 18, 2026 that would refuse to lift the 2019 COPPA order despite the $400 million federal settlement, $100 million of which was tied to vacatur. Massachusetts' highest court has already held that Section 230 does not shield design claims, and California has moved to fine platforms up to $50,000 per child served an addictive feed. Alabama's contribution is the calendar.

Cologne told Snap that a chatbot conversation is advertising data

On September 17, 2026, the 33rd Civil Chamber of the Regional Court of Cologne granted the Verbraucherzentrale Bundesverband its injunction in full against Snap Group Limited, the London entity behind Snapchat in Germany. Case 33 O 120/24 had been running since the warning letter of October 24, 2023; the action was filed on March 22, 2024, served on June 25, 2024, heard on July 16, 2026, and certified by the registry on September 18, PPC Land reported on September 26.

Three prohibitions came out of it. Snap may not process personal data from My AI conversations for advertising without a legal basis. It may not use pre-ticked boxes in ad preferences. And it may not preset alcohol and gambling as advertising interest topics in the accounts of minors, even though its backend policies block those ads from serving. Each future breach carries up to 250,000 euros or six months of coercive detention against board members. Snap also reimburses 242.99 euros for the warning letter plus interest at five points above base rate from June 26, 2024, bears costs on a case value of 22,500 euros, and faces provisional enforcement secured at 20,000 euros for the injunctions.

The reasoning is the part that travels. Snap argued it collected nothing, attributing processing to the US parent under its privacy policy. The court looked instead at the German terms of service, exhibits K17 and K18, where Snap Group Limited reserved processing rights, and at evidence that "the text query of a user entered into the chat interface with My AI" is processed for ad selection. That made the London entity at minimum a joint controller under Article 4(7). On the chatbot itself, the chamber held that Article 9 special-category protection attaches because users disclose sensitive material to conversational interfaces, regardless of whether the operator intends to derive sensitive inferences. Intent does not govern; content does.

The consent findings are more conventional but no less useful. Pre-ticked boxes fail Planet49, decided in October 2019, and the court said so plainly. On legitimate interest, Snap had not identified its specific interests at the moment of collection, which Case C-394/23 requires. Two supervisory authorities filed statements the chamber expressly adopted, the federal BfDI on September 8, 2025 and North Rhine-Westphalia's LDI on January 14, 2026. A late written submission from Snap on September 13, 2026 citing European Data Protection Board guidance was disregarded as unauthorised. Standing rested on section 4 UKlaG, with GDPR treated as consumer protection law under section 2(2) no. 13, and jurisdiction on section 32 of the Code of Civil Procedure applied by analogy to a UK-based defendant whose app works throughout Germany. The vzbv published the documents with a status date of September 21; nothing indicates an appeal.

Conversational surfaces are not a side experiment for the company. Snap has been selling AI Sponsored Snaps that let brands chat directly with users, and its child-safety exposure in the United States runs through New Mexico's suit over Snapchat. The Cologne judgment lands while European regulators are still arguing among themselves about how GDPR applies to AI systems. One chamber has now answered a narrow version of that question: whatever a user types into an assistant is data about that user, and monetising it needs a basis like any other.

Google will take a raw IP address, except from 32 places

Google Ads now accepts two additional unhashed columns in Customer Match uploads: User IP address and User interaction timestamp. Advertisers can build lists from IP alone or in combination with the older identifiers, with eight headers in total across email, phone, first name, last name, country, zip, IP and timestamp. Files must be CSV in ASCII or UTF-8; UTF-16 is refused. Both IPv4 and IPv6 are accepted as strings, IPv6 case-insensitively, and the documentation is explicit that the value should be passed "as a plain, unhashed string". Anu Adegbola reported the change for Search Engine Land on September 25, and PPC Land examined the documentation on September 26.

IP matching does not apply to end users located in the 30 European Economic Area states, the United Kingdom or Switzerland. What happens to those rows is undocumented. They may be discarded on ingestion, rejected outright, or left to advertisers to filter before upload, and the help page does not say which. Nor does it resolve its own labelling: the timestamp column appears as "User interaction timestamp", "User Engagement timestamp" and "User Interaction timestamp" in three different places, and the text describes both an earliest and a last timestamp while providing one column. Where no timestamp is supplied, the system defaults to the "latest known" user of that address, which is a policy decision about attribution disguised as a fallback.

Game: The client brief lands on four desks that never talk
Sixteen terms, four groups of four, and a grid where the obvious reading is usually the wrong one. The hardest group is four entirely ordinary words.
PPC LandLuis Rijo

None of this arrived without warning. Data Manager API v1.7 added IP ingestion through the CompositeData structure on May 28, 2026, the same day Google promised higher Customer Match match rates from the third quarter. The Data Manager API became the required path for new integrations on April 1, 2026. On February 2, 2026, Google stopped accepting new IP and session implementations in conversion imports, and in February 2025 it set a 540-day maximum membership duration for these lists, a figure the create-list instructions repeat while the modification instructions still say duration is unlimited. The match-rate section claims the system "doesn't receive or view actual email addresses" on a page that requires unhashed addresses of another kind, and says data is deleted after processing without stating whether IP rows run inside trusted execution environments, Google's default since September 2024. For a company that has spent two years marketing data minimisation as a design principle in CRM onboarding, the documentation is unusually loose.

The awkward part is what the signal is worth. NumberEight published a 20-page report on demographic accuracy, distributed September 23 and written up on September 25, comparing a leading US IP-based provider against its own identifier-free model across five mobile games. For Fashion Battle, the IP model returned 51% female where the alternative returned 82%, a 31-point gap. Cooking Fever came in at 52% against 67% female. Golf Clash ran the other way, 49% female by IP against 26%. Nitro Nation showed 50% male against 74%, Mini Football 50% male against 35%. Across every title, the IP model clustered at the population mean, which is what a method looks like when it is not measuring the thing it claims to measure. The connected television sample was larger and no better: 7,013 shows, roughly 1,400 records each, more than three million unique users, and a female share pinned between 53% and 55% regardless of genre.

Supporting work points the same way. Truthset, commissioned by the Coalition for Innovative Media Measurement and Go Addressable, found IP-to-postal linkages 13% accurate and IP-to-email 16%, with six providers agreeing on the same household only 6.4% of the time. FreeWheel put missed households at up to 87% in February 2026. Adstra and InterMedia Advertising reported in July 2026 that 23% of residential IP addresses reached the intended geography. A Stanford study in August 2026 found 5% of addresses generating 55% of web requests, with IPv6 rotating at most every 24 hours by default. NumberEight sells an alternative and says so, which is worth holding in mind; its own scorecard rates identity resolution through third-party IDs and mobile advertising IDs as declining in scale. Still, the arithmetic cuts one way. Google has just made it easier to load a signal into data enrichment workflows in the 160-odd countries where it is allowed, at the moment several independent tests place that signal's household accuracy in the low teens.

Facebook ran 663 experiments, and the observational estimates missed

Karan Dhir, a principal AI product manager at Genentech, published an essay on September 9, 2026 dividing advertising analytics into two categories that platforms routinely merge. Modelled conversions and algorithmic lift estimates without randomised holdouts are telemetry: signals about system state. Randomised studies are evidence. PPC Land covered the argument on September 26, and its force comes not from the framing but from the two Marketing Science papers underneath it, both built on Facebook's own data.

The 2019 paper by Gordon, Zettelmeyer, Bhargava and Chapsky worked through 15 Facebook experiments covering 500 million user-experiment observations and 1.6 billion impressions. The observational methods tested were not weak candidates; they were the standard toolkit, and they repeatedly failed to reproduce the experimental result, in Dhir's characterisation by a factor of three or more. The 2023 paper by Gordon, Moakler and Zettelmeyer scaled it up to 663 large experiments and more than 5,000 user-level features. Median randomised lift for upper-funnel outcomes came to 29%. Machine-learning estimates on the same data produced a median of 83%. Stratified propensity score matching produced 173%. Nearly six times the measured effect, from a method in daily production use.

Three checks follow from that, and they are structural rather than tactical. Was there a randomisation mechanism, a question Dhir calls binary: "The answer is yes with a mechanism, or it's no." Who holds custody of the result, and can it be exported and audited by a third party. Does the outcome reconcile to the organisation's financials. None of the three is satisfied by a platform dashboard alone.

Platform behaviour over the past 18 months has pulled in both directions. Google cut the minimum incrementality test budget to $5,000 in May 2025, which widened access to genuine holdout studies considerably. Then in August 2026 it restricted 24 Conversion Lift metrics to allowlisted accounts in read-only form, narrowing who can pull the evidence programmatically. Meta redefined click-through attribution in March 2026 to count only link clicks, a correction that made its numbers more comparable to analytics platforms while quietly resetting every historical series. Its own suite of truth framework leans on the same distinction Dhir draws, which is why the 2023 result is so uncomfortable: the gap was measured inside Meta's infrastructure, on Meta's users, with Meta's features.

Sitting beside that is the August 2025 tribunal filing in which a former Meta product manager alleged that Shops ads ROAS had been inflated by 17 to 19% through the inclusion of shipping fees and taxes. That allegation concerns what goes into the numerator. The Marketing Science work concerns whether the causal claim survives a control group at all, which is the larger question, and the one that incrementality testing exists to answer. A view-through conversion counted without a holdout is telemetry by Dhir's definition, whatever line item it appears on.

McDonald's found 450 screens, Lufthansa found 850 aircraft, neither found an auditor

McDonald's has been running third-party advertising on digital menu boards at 450 company-operated US restaurants since August 2026, roughly 3.2% of its approximately 14,000 US locations, PPC Land reported on September 26. Ads appear after the order is placed, so the screen is monetised during the wait rather than the decision. A Geico creative featured in the pilot. Global chief marketing officer Morgan Flatley said the company is "at the beginning of our aspiration to build McDonald's Media Network into a billion-dollar business across the McDonald's system over time", and described the opportunity as generating revenue "with little in the way of additional cost, no operational complexity, and no disruption to our customer experience". Chief financial officer Ian Borden put the reach case simply: "We serve about 85% of the U.S. population at least once a year." Chief executive Chris Kempczinski framed roughly 220 million 90-day active loyalty members as "more data and better insights than anyone else", valuable in particular for training new AI capabilities.

Game: The client brief lands on four desks that never talk
Sixteen terms, four groups of four, and a grid where the obvious reading is usually the wrong one. The hardest group is four entirely ordinary words.
PPC LandLuis Rijo

The franchise structure complicates the arithmetic. About 95% of restaurants globally are franchised, heading for 98% by the end of 2028, so a network built on company-operated locations is starting from the smallest slice of the estate. Pricing, measurement methodology, technology partner and rollout timetable were all absent from the disclosure. The $100 billion US commerce media projection for 2028 that frames the ambition is the same figure Mastercard used when it launched its own commerce media network, and the in-store channel's measurement problem has been examined before: screens near a point of sale generate exposure estimates, not verified impressions, and the retail media network label carries an expectation of closed-loop reporting that a drive-thru board does not meet. Perion's $12 million acquisition of in-store network PRN suggests where the consolidation pressure sits.

Lufthansa Group went live with the same proposition at altitude. Lufthansa Group Media appeared at ambientmedia.lufthansa.com in mid-September 2026, consolidating inventory across Lufthansa, SWISS and Austrian Airlines, with Brussels Airlines, Eurowings, Discover Airlines, Edelweiss and Air Dolomiti named but without published guides, PPC Land reported on September 26. The first Starlink-equipped flight was LH234 from Frankfurt to Rome on A320neo D-AINM on August 19, 2026, with up to ten more A320-family aircraft due by the end of 2026 and roughly 850 aircraft by 2029. Wi-Fi portal access requires Miles & More membership or a Travel ID sign-in, which turns the connectivity layer into an authenticated session, and Mastercard sponsors the service.

Rate cards are published, which is more than most new networks offer. Lufthansa asks 22,900 euros a month preflight, 40,600 euros for lounge screens and 45,100 euros onboard. SWISS lists CHF 10,000, CHF 12,800 and CHF 7,500 for preflight, airport and onboard. Austrian lists 8,000, 15,900 and 9,000 euros. The guides count 72 touchpoints across booking flows, loyalty apps, lounge screens and inflight entertainment, against roughly 135 million group passengers a year, 56 million at Lufthansa, about 18 million at SWISS and about 15 million at Austrian.

The audience figures do not reconcile. Passenger counts drift between 130 and 135 million across documents. SWISS boarding pass impressions appear as both 180,000 and 500,000 a month. Austrian lounge screen metrics differ between sections. One Lufthansa lounge calculation multiplies 11,200 daily broadcasts into 33,600 monthly rather than 336,000, an order-of-magnitude slip left in a published rate card. The reported currencies are contacts, share of voice, opportunity to see and dwell time. Closed-loop attribution, clean room analysis and incrementality testing are absent, and no independent audit is mentioned. That is a notable omission in a sector where JCDecaux has taken airport inventory programmatic and ReachTV wired airport screens into Nielsen ONE Ads precisely to answer it. A place with a large number attached to it is inventory. It becomes a medium when somebody outside the seller can check the number.

Which is the week's through-line. Alabama's decree will be tested against a clock on a phone. Cologne's injunction will be tested against a pre-ticked box that either appears or does not. The 2023 Facebook paper was tested against 663 randomised experiments. The 51% female reading for a fashion game, the 11,200 broadcasts that became 33,600, the billion-dollar aspiration and the 85% annual reach are all still waiting for somebody with standing to count them.

Also noted