Four months. Under the compromise text that European Union ambassadors are expected to take up on Sunday, October 11, that is how long a website would have to wait, after a visitor refuses cookies, before asking again for the same purpose. The figure sits in Council document 13886/26, a 163-page draft marked LIMITE and dated October 2, which PPC Land went through line by line on October 9. When the European Commission published its Digital Omnibus on November 19, 2025, it proposed six months. The Irish Presidency's text of September 3 kept six. Between September 3 and October 2, two months came off.

The number matters because it sets the rhythm of every consent banner in the bloc. A shorter wait means more prompts, and more prompts mean more chances for a refusal to turn into an acceptance. It is also only one of several changes in the draft that bear directly on advertising, and taken together they describe the day's dominant question: who has to ask permission, how often, and how long anyone else takes to check.

Most of the other news in the 24 hours to Saturday morning turned on the same question from a different side. Ireland's data protection regulator was shown to have taken 2,951 days to finish answering a query it had called urgent in 2018. A German state authority told small businesses that dragging a file to the recycle bin is not erasure. Denmark tabled a bill that puts the burden of proving consent on whoever publishes a digital likeness. Washington's Supreme Court, by contrast, ruled that a hospital website's tracking pixel needed nobody's agreement at all under the state's privacy act. And Google, Apple, OpenAI, HubSpot and Walmart each changed something about what counts, who sells what, or what gets measured.

The fine print of a four-month wait

The cookie rules in the draft stay where they have always been, in Article 5(3) of the ePrivacy Directive, rather than moving into the GDPR as the Commission had wanted. The Commission's November 2025 proposal created Articles 88a and 88b inside the GDPR; the Council text of June 18 removed the browser signal in Article 88b, and the September 3 text deleted both articles. Enforcement shifts all the same, since member states would have to designate their GDPR supervisory authority to police cookie rules under a new Article 15a(5). Transposition would run for 24 months after adoption.

The draft lists six purposes for which a site may access a device without consent, provided the access is strictly necessary. Five were expected: transmitting a communication, delivering a requested service, first-party audience measurement that produces anonymous aggregated data, media audience measurement under Article 24 of the European Media Freedom Act, and technical security. The sixth is new. It covers measuring the display and performance of contextual advertising, and the Council's own cover note acknowledges that a purpose has been added to allow cookies to be placed without consent.

The conditions, set out in recital 44g, are narrow on paper. Measurement data must be pseudonymised after collection as a key security measure. It cannot be used for profiling or programmatic advertising, and it cannot relate to past or future activity, including activity across sites or services. The recital names frequency capping cookies and measurement cookies explicitly, and it also covers placements triggered by a single search query. Contextual advertising has long been presented as the privacy-friendly alternative to behavioural targeting; under this text its delivery could also be counted and capped without a banner.

The four-month rule comes with its own exceptions. Recital 45 allows a site to ask again sooner if it launches a new service, makes substantial changes, or loses its record of the visitor's choice, for example after cookies are deleted. Since a refusal is commonly stored in a cookie, the last exception is not a small one. The French trade body Alliance Digitale had asked in a May 21 position paper for the re-request ban to be deleted entirely; it did not get deletion, but it got a shorter interval.

What disappeared is as instructive as what was added. The centralised browser signal, which would have let a person refuse cookies once rather than on every site, was dropped in the June text after a study commissioned by Google from Implement Consulting Group put the annual cost to EU businesses at 40 to 50 billion euros, an estimate noyb disputed. On September 10, 19 organisations wrote asking for Article 88b to be reinstated. It was not. In its place, Article 18 asks the Commission to report within 12 months of adoption on privacy-enhancing technologies, with possible legislation afterwards.

The GDPR changes are larger still. Article 4(1) would make personal data relative to the means of identification available to the recipient, a reading drawn from the Court of Justice's September 2025 ruling in EDPS v SRB, and one the European Data Protection Board and the EDPS opposed in a joint opinion in February. A renumbered Article 88 bis would allow AI development and operation to rely on legitimate interest, with a right to object under Article 21, although recital 33a states that AI development is not in itself a legitimate interest; the Council had already dropped an unconditional opt-out from that clause in September. A new Article 9(2)(k) would permit incidental processing of residual sensitive data during AI training. Breach notification under Article 33 would apply only to high-risk breaches, with the deadline moved from 72 hours to 96. Controllers could refuse or charge for abusive access requests.

How close is this to adoption? Agreement is not assured. A Coreper meeting planned for Wednesday, October 7 ended without a vote. Fabien Lehagre, a business development director at HomeServe France who has tracked the file on LinkedIn, attributes the failure to the Data Act chapter, where trade secret protections in Articles 4(6) and 5(9) were tightened and the smart contract requirements of Article 36 deleted. The Antici Group on simplification met ten times between January 16 and September 25 to produce the text. The Platform-to-Business Regulation would be largely repealed, with some provisions kept until December 31, 2032, over Dutch objections recorded in November 2025.

Eight years to answer an urgent question

The Council has been generous with time elsewhere. The European Parliament proposed that national regulators handle simple GDPR complaints within three months and complex ones within nine; the Council's position on the separate procedural regulation is 33 months. On October 9, PPC Land set that negotiating gap against a single Irish case, and the arithmetic was unkind.

On August 15, 2018, after the Associated Press reported that Google kept storing location data when Location History was paused, Ireland's Data Protection Commission put questions to Google and said publicly on August 23 that they required an urgent response. The €403 million fine announced on September 21, 2026 came 2,951 days after that statement, as PPC Land counted in a piece published October 9. It took 538 days from the original questions to the opening of an own-volition inquiry on February 4, 2020, and another 2,421 days from the inquiry to the decision. Johnny Ryan, director of Enforce at the Irish Council for Civil Liberties, who reposted the 2018 statement on the day of the fine, put it in four words: "'Urgent' meant 8+ years."

The decision itself covers Web and App Activity, Location History and Location Accuracy on Android, and finds four categories of infringement across those three features, including breaches of lawfulness, fairness, transparency, storage limitation and accountability. The examined period runs only from May 25, 2018 to February 4, 2020, some 620 days. Google Ireland did not become the EEA data controller until January 22, 2019, partway through it. Article 25, on data protection by design, which consumer groups in seven countries invoked in complaints coordinated by BEUC on November 27, 2018, is not addressed in the DPC's statement. Google has six months to comply, which would end around March 21, 2027 if counted from the announcement.

The case sits inside a larger pattern that PPC Land has tracked. Ireland accounts for about 4.04 billion euros, or 66%, of the 7.1 billion euros in announced GDPR fines, drawn from 37 enforcement actions, and an Alliance Risk analysis in May found 40% of the total annulled or under challenge. noyb puts the share of Irish fines actually collected at 0.6%. Jason Kint, chief executive of Digital Content Next, reposted Ryan's post and described the regulator in harsh terms before comments were switched off. Niamh Sweeney, a former Meta executive, began a five-year term as one of the three commissioners on October 13, 2025, and signed the Google decision alongside Des Hogan and Dale Sunderland. The Council's 33-month figure belongs to the GDPR Procedural Regulation, a measure meant to speed up cross-border cases that noyb criticised in an analysis PPC Land reported in April 2025.

If Dublin shows how long enforcement can take, a state authority in Magdeburg spent September explaining something more basic. The State Commissioner for Data Protection of Saxony-Anhalt published an 18-page guide for small businesses on drawing up a deletion policy, and PPC Land reviewed it on October 9 from an English machine translation of the German original. Its central point is that moving a file to the recycle bin, or even emptying the bin, does not meet the erasure duty in Article 17, because individual files can often be recovered with little effort. Backups are harder still: the guide concedes that selectively deleting individual records from a backup is often technically impossible.

The guide sets out a catalogue with eight fields and six model rows. Invoices are kept for ten years; applicant data for six months after a recruitment procedure closes; newsletter data until consent is withdrawn. Video surveillance footage carries a 72-hour deletion period in the model catalogue. Paper is to be shredded to at least security level P-3 under DIN 66399, with P-4 or higher for sensitive material. Requests must be answered within one month, extendable by up to two more.

None of this is abstract. France's CNIL fined consultancy EXTIA 300,000 euros on July 21 after it mishandled 204 of 265 erasure requests, and Italy's Garante fined sales intelligence broker Lusha 2 million euros in July and ordered erasure of Italian contact data. On October 1, Advocate General Laila Medina told the Court of Justice that a legible strike-through in a register is not erasure, in the Diocese of Ghent case. The same Digital Omnibus that shortens the cookie interval would also stretch the breach-notification deadline to 96 hours, so a small business in Saxony-Anhalt could soon find the rules on reporting loosened while the rules on forgetting are spelled out more strictly.

Deletion concerns what happens after consent is withdrawn. Copenhagen is drafting rules about consent that has to be shown before anything appears at all. Bill L 49, tabled on October 8 by Culture Minister Zenia Stampe and reported by PPC Land on October 9, would amend the Danish Copyright Act from January 1, 2027. A new section 73 a prohibits making realistic digital imitations of a person's appearance, voice or movements available to the public without that person's consent. The burden of proving consent falls on the person who makes the imitation available to the public. Satire and parody are exempt unless they amount to harmful misinformation; private uses are generally outside the rule.

The protection lasts until 50 years after the end of the year of death, and section 86 a extends it to all natural persons, including foreign nationals. A separate section 65 a gives performers a collectively licensable right. There is no criminal penalty, since section 76 excludes the new provision from fines; the remedies are damages, compensation for non-pecuniary harm and court-ordered removal. Consent can be withdrawn at any time, but only for future publication. An earlier version lapsed after a general election, following a political agreement of June 26, 2025 between the then government and six other parties, and consultations that drew more than 100 bodies.

Denmark is not acting alone. In September a Frankfurt court ruled that Meta could not rely on the hosting provider defence for fake ads, exposing it to fines of up to 250,000 euros per future breach. The EU AI Act's Article 50 labelling duties have applied since August 2, 2026, with fines of up to 15 million euros or 3% of worldwide turnover. And on October 5 Italy's prime minister filed a four-second recording of her own voice as an EU sound trademark. What the Danish bill adds is a clear allocation of proof.

A server is not a person

Across the Atlantic, a court reached the opposite conclusion about whether anyone needed to have agreed. On October 8 the Washington Supreme Court, sitting en banc, affirmed the dismissal of a suit by parents who alleged that Seattle Children's Hospital's website, through the Meta Pixel, passed their clicks and searches to Meta. PPC Land covered the ruling on October 9. In Baker v. Seattle Children's Hospital, No. 104590-5, Justice Angelis wrote for the majority that the Washington Privacy Act, RCW 9.73.030(1)(a), protects private communications between two or more individuals, and that clicks and searches answered automatically by a hospital's server are not communications between individuals. The majority left open whether the searches were private. Justice González concurred in the result, noting that nothing in the complaint alleged anyone had read a parent's query.

Washington is one of 11 states that require the consent of all parties to a recorded communication, which is why the case drew attention: the IAB filed an amicus brief on April 10 arguing that a ruling for the parents could reshape ad measurement across the state. The court accepted review on January 8, 2026, after a trial court dismissal in February 2024 and an unpublished appellate affirmance on August 18, 2025. PPC Land noted two discrepancies in the record: the opinion dates the suit to 2013, probably a typo for October 2023, and cites a Court of Appeals docket number that differs by one digit from earlier coverage.

California's pressure points remain. More than 4,000 suits have been filed under the California Invasion of Privacy Act, and Governor Gavin Newsom signed SB 690 on September 30, ending private pen register claims from January 1, 2027 while leaving other theories open. In Europe, similar tracking has produced liability under data protection law: a Jena court ordered Meta to pay 3,000 euros in March, and Sweden fined the pharmacies Apoteket and Apohem a combined 45 million kronor in August 2024. A pixel that has produced damages and fines in Germany and Sweden is, in Washington, a conversation with a machine.

Proof, and who sells what

The ad industry's own guidance, published the same week, made a version of the Danish point about proof. The IAB's report Data Clean Rooms in Commerce, released in September with BVDW, IAB Australia, IAB Canada and IAB Europe, states plainly that using a clean room does not by itself establish a legal basis for processing or sharing data. PPC Land's reading of the 13-page document on October 9 found that it sorts 14 commerce use cases into two groups. Five typically depend on a clean room: audience overlap analysis, data enrichment, bring-your-own-data targeting, suppression and exclusion, and retailer audience activation. The other nine, including attribution, incrementality, reach and frequency, segmentation and lookalike modelling, often work without one when the data already sits inside a single retailer.

The report offers five screening questions, beginning with what business question is being asked and whether answering it needs data from more than one party. It contains no survey, no adoption rates and no pricing benchmarks. Of its 71 named contributors, Instacart supplied the most, with four, and Amazon Ads three. The Federal Trade Commission's technologists had warned in November 2024 that clean rooms are not a privacy guarantee; the IAB's text now says something similar in the language of opportunity cost.

Consolidation in identity continued on both sides of the ledger. Zeta Global said on October 6 that it had agreed to buy Digital Audience, a data infrastructure company focused on identity and activation, and PPC Land detailed the deal on October 9. No price, structure, headcount or closing date was disclosed, and regulatory approval was not addressed. Digital Audience, led by founder Ruben Niet, is already integrated with Zeta and will become part of the Zeta Data Cloud. Its backer, FirstPartyCapital, called it the fund's first portfolio exit. Zeta's release says the deal will strengthen its European presence, which brings the GDPR questions above directly into its data business.

It is Zeta's third data acquisition in two years, after LiveIntent in October 2024, a $250 million package whose identity graph processes more than 235 million hashed email addresses a month, and Marigold's enterprise business for up to $325 million in 2025. Second-quarter revenue was $442.8 million, up 44%, and full-year guidance stands at $1,811 million to $1,824 million. In July a federal judge refused to dismiss a securities suit over Zeta's past claim of more than 240 million opted-in US individuals, which keeps the provenance of consent in its data before a court. The transatlantic route for such data is also uncertain: noyb argued in July that a Supreme Court ruling on FTC independence undermines the EU-US Data Privacy Framework.

ID5 went the other way. The London and New York identity company has sold the third-party audience marketplace and brand it acquired with TrueData to Cloud Technologies S.A., which will run the business in North America as a wholly owned subsidiary under a new chief executive, Ophelia Livingstone. PPC Land reported the exit on October 9, some 11 months after ID5 announced the TrueData acquisition at the end of October 2025. ID5 keeps the identity graph, the team and its US expertise. In a post dated October 1 and titled Staying Focused on Identity, the company said it has no audiences to sell and no media to buy. Co-founder and chief executive Mathieu Roche wrote that the activity was a small part of TrueData's overall business and not strategic for ID5. Price, staff numbers and data-sharing terms were not disclosed.

Neutrality has a commercial logic this autumn. WebKit bug 324771, filed on September 21 by Ian Meyers of The Trade Desk, lists nine domains blocked in Safari, two of them belonging to ID5: id5-sync.com and eu-1-id5-sync.com. PPC Land had earlier traced the block to an eleven-line WebKit change merged in February, with the iOS 27 rollout beginning September 14.

The browser and the tag

AdExchanger's weekly podcast, The Big Story, devoted its October 9 episode to Apple. Senior editor James Hercher and editor-in-chief Allison Schiff noted that Apple had, that week, removed The Trade Desk's ad-serving problem in a new iOS 27 beta, but that WebKit carries a second, separate list covering several ad tech and martech categories that could widen the blocking. That second list is hard to find: a company would have to download, decompile and examine WebKit's code to learn whether it appears. The first list named The Trade Desk and its Unified ID 2.0, ID5, LiveRamp, Audigent and Permutive. Schiff argued that the industry has not "really earned much benefit of the doubt on data practices," and the episode set the block list against App Tracking Transparency, which stopped identifier use without consent; the WebKit list goes further, shutting some companies out of parts of their business entirely.

Apple controls the browser. Google controls the tag, and on October 8 it changed how the tag behaves. PPC Land explained the change on October 9: under a release note titled Standardizing gtag('config') command behavior for Google Tag Manager, gtm.js container snippets, with IDs beginning GTM-, now initialise as soon as the container loads instead of waiting for gtag('config') commands. Those config commands now surface in the dataLayer as visible gtag.config events, which means tags attached to a catch-all custom event trigger using the .* pattern can fire on them. Google classifies the common pattern of a gtm.js snippet plus a standalone gtag('config') line with a G-, AW- or DC- ID as an unsupported implementation and warns of unexpected changes to tag behaviour.

Google said it emailed owners of affected containers but did not say how many. Its help page says gtm.js snippets will soon stop recognising gtag('config'), while the release note describes the change as already in effect. The prescribed fix is the full gtag.js snippet, or moving the ID inside the container. Simo Ahava, co-founder of Simmer, flagged the new dataLayer event as the thing to watch. The change follows a July adjustment to containers loaded through unsupported paths and the plan, announced in May, to merge Google Tag Manager and the Google tag. PPC Land's piece recalls a case in which a consent misconfiguration reportedly cut a client's Google Ads conversions by 90%, a reminder that the order in which tags initialise is not cosmetic.

The tag is one part of Google's plumbing; the ad itself is another, and on October 9 PPC Land described how an ad became the way in. David Vallejo, founder of Analytics Debugger, posted on October 7 that he had been phished after clicking a Google Ads listing that appeared among the first ad results for the query cloud console. The ad led to a replica of the Google Cloud Console homepage hosted on sites.google.com, and from there to accounts.gtoosl.com, a domain registered in August through a Hong Kong-based registrar and sitting behind Cloudflare. The kit was a reverse proxy: it relayed Google's genuine login and second-factor prompts to the victim while letting the attacker see what passed through. Vallejo reproduced the attack in a freshly installed Firefox to rule out a browser extension, changed his password and reported no losses. The advertiser name, the ad text and the campaign's duration were not in the source.

The incident sits awkwardly against Google's own figures. Its 2025 Ads Safety Report, released in April, said it blocked or removed more than 8.3 billion ads and suspended 24.9 million advertiser accounts. Google Ads began requiring passkeys for certain sensitive account actions on July 15. A commenter on Vallejo's post tagged Ginny Marvin, Google's Ads Product Liaison; no reply appeared in the captured thread.

Counting differently

Google also changed, with a help-page edit rather than an announcement, what counts as a video engagement. PPC News Feed reported at 06:05 UTC on October 10, the last item in this window, that the minimum watch time has risen from five seconds to ten. In-stream and video app promotion ads now need ten seconds watched or a click; in-feed video ads ten seconds watched while muted or a thumbnail click; Masthead ads ten seconds muted or a click to watch the full video; YouTube Shorts ten seconds or a call-to-action click. Bumper and non-skippable in-stream ads count clicks only. Lightbox and Gmail ads are unchanged. No effective date appears on the page, so engagement rates on either side of the change will not compare cleanly: the same viewing behaviour will now produce fewer reported engagements.

The definition change landed amid a run of smaller adjustments to AI Max, Google's AI-driven search campaign setting. On October 9, PPC News Feed reported that new AI Max columns are rolling out in Google Ads, shared by Vivek Gupta: Locations of interest, Optimized targeting and Brand inclusions, with a fourth, Commission, visible in a screenshot but not confirmed in the text. The same morning, Search Engine Roundtable's Barry Schwartz wrote up text customization asset previews, a new section of Google's help documentation that lets advertisers see up to ten sample headlines and descriptions generated from a landing page URL before opting in to AI-written text. Google says the samples mostly appear in under 30 seconds and are available in eight languages: English, Spanish, Portuguese, Italian, French, German, Japanese and Dutch. Excluded words and themes filter the samples automatically. Schwartz credited Hana Kobzová of PPC News Feed, which had first reported it.

Another default arrived in Demand Gen. PPC News Feed reported on October 9 that a new Overlay on videos option, spotted by Gert Jan van Egmond, adds text drawn from an advertiser's text assets on top of video ads. It sits in the asset optimisation settings beside Shorter videos and Resized videos and appears to be switched on by default, with a Disable all control to turn the set off. Ads using assets optimised this way are labelled as created or edited with AI when shown in the EU, India and New York state. That is the same disclosure logic as the AI Act's Article 50: the label follows the machine's involvement, whoever set the switch.

Policy moved on the same calendar. PPC News Feed reported on October 9 that Google's Gambling and games policy will change for Colombia on October 21 to permit online lottery advertising by entities authorised by the Consejo Nacional de Juegos de Suerte y Azar. Online gambling promotion requires registration with Colijuegos and a valid licence, and advertisers must apply for certification before the effective date. October 21 is also the day YouTube's Masthead opens to certified online gambling advertisers, as PPC Land reported on October 8.

Search pages lose their furniture

Microsoft spent the same Friday rearranging Bing's results page in small ways, none announced. Search Engine Roundtable documented three tests on October 9. Bing is testing the removal of favicons from organic result snippets, first noticed by Khushal Bherwani on October 6 on a sponsored result and posted by Sachin Patel with screenshots pointing to organic listings; Schwartz could not replicate it but described the screenshots bluntly: "The search results look naked." Bing is also showing local packs without their usual outline border, which Bherwani posted on October 7 and Schwartz reproduced himself, and fading the horizontal line separators toward the end of each line, from a Bherwani post of September 30 that Schwartz could not reproduce. Each is minor, and none came with an explanation from Microsoft.

Google, for its part, rewrote a page that tells publishers where their subscribers will see them. Search Engine Roundtable reported on October 9 that the Reader Revenue Manager homepage now says subscriber or contributor content can carry a subscriptions label across Google Search, AI Mode, AI Overviews and Gemini; the previous version, archived on October 6, listed Search, Discover and News. A new Advanced features section lists 12 tools, among them metered reads, rewarded ads, newsletter sign-up, a registration wall and subscription linking. There was no formal announcement. For publishers revisiting registration walls as AI answers reduce referrals, the redesign puts in writing that Google's AI surfaces can display that relationship.

The cost of those AI answers to smaller organisations is the subject of another October 9 piece, about a UK agency selling local visibility checks to pharmacies. Brand Champions opened a postcode marketing check on October 8, promising a snapshot within a fortnight; no price was given. The pitch rests on the expansion of England's Pharmacy First scheme, which began on January 31, 2024 with seven common conditions and widens this autumn. PPC Land set the vendor's claims against the evidence: Google says it answers one billion health questions a day; Blood Cancer UK lost 53% of leukaemia page views after AI answers arrived; Tank data show average monthly organic traffic growth across 800 UK companies falling from 26.3% to 3.7%; Places Scout counted local pack ads up 733% in three months; 8ight.AI found ChatGPT named 3.4% of tested local businesses with fewer than 25 reviews against 22.2% of those with 1,000 or more. A Semble survey cited by the agency says 34% of 16 to 25-year-olds use ChatGPT for health guidance. The figures for Costa Coffee that Brand Champions supplied came with no method or period.

Outcomes, priced

If the search page is losing furniture, the software that runs marketing departments is losing staff. HubSpot will cut about 7% of its workforce, nearly 660 people, chief executive Yamini Rangan told employees on October 6; PPC Land reported the details on October 9. HubSpot did not give a total headcount, a restructuring charge or the functions affected; PPC Land's arithmetic implies about 9,400 employees. The company is reorganising teams around four outcomes (generating demand, winning deals, delighting customers and scaling growth) rather than around its product hubs. Rangan said the cut was not driven by AI efficiencies and was not simply about cost.

The package is specific: 20 weeks of base pay plus one week per year of service, capped at 30 weeks; five months of COBRA coverage as a lump sum in the US; six months of career transition support. The previous cut, in January 2023, was also about 7%, roughly 500 roles. HubSpot launched an AEO tool at $50 a month in April as organic traffic to its customers' websites fell 27% year on year, a decline of the same kind the pharmacy pitch describes. The Trade Desk ended about 575 roles on September 4.

Outcomes are also what agencies say they want to be paid for, and what clients are slow to concede. Adweek's monthly Agencies Advantage analysis, published October 9, argues that AI is squeezing the full-time-equivalent billing model and that agencies are pushing for performance pay, while brands stall. Bob Lord, president of the independent Horizon Media Holdings, called the FTE model the "old system" at an industry event earlier in October and questioned whether such models can be broken without an external force.

One external force is a new kind of media owner looking for a permanent place in the plan. OpenAI is hiring an Agency Partner for its Ads Solutions team in New York, Adweek reported on October 9, at a base salary of $216,000 to $273,000 plus equity and commission. The job is to lead joint business planning, run agency education and make ChatGPT ads a standing line item in agency media plans, working with independent agencies and holding companies alike. Adweek described the hire as part of building the sales layer Meta and Google use to secure recurring spend. OpenAI is staffing it while the meaning of an engagement or a conversion is being redefined by the platforms that report them.

Shelves, screens and a second peak

Some of the money is moving into rooms where cookie banners do not exist. Cotswold Outdoor, the UK outdoor clothing retailer, now sells advertising on 149 till, shelf, totem, large-format and front-of-store screens across 23 UK shops, roughly six and a half per store. The network runs on the Broadsign Platform, was built by Bristol systems integrator IUF, and connects to Zitcha, Cotswold's retail media platform; PPC Land reported the October 6 announcement on October 9. It went from tender to a live, revenue-generating network in 12 weeks. One HOKA campaign combining onsite and in-store placements is said to have lifted units sold per store by 13%, with no methodology disclosed. Programmatic trading is a stated later step, without a timeline.

The measurement scaffolding is still being built. IAB Europe's draft in-store standards, which cut the impression formula to six inputs, are open for comment until October 23, and an IAB survey reported by PPC Land on October 2 found 43% of US retail media buyers say they underuse in-store media. Broadsign itself, which bought Place Exchange in November 2025, now claims more than 3 million signs.

Walmart is blurring the store and the marketplace from the other direction. Adweek reported on October 9 that the retailer is testing placing third-party marketplace inventory in its stores so that it can be picked up or delivered locally, possibly during the coming holiday season. Kyle Carlyle, senior vice president of global marketplace fulfilment, described the test at a Walmart Connect event for advertising partners in New York. Today third-party sellers can only ship, which can take days. Walmart Connect, the retailer's ad business, has been courting brands that do not sell at Walmart at all since buying Vizio and, in August, Vibe.co.

Starbucks is chasing a different kind of shelf space: the afternoon. In an interview conducted on September 17 for Adweek's October cover and published as a standalone piece on October 9, chief executive Brian Niccol said the chain performs well at breakfast but needs to build a second sales peak after 2 p.m., and that it wants a category-defining food programme. He did not discuss the reports, which emerged weeks later, that Starbucks had explored a takeover of Chipotle.

Attention, by the season

Television's most sought-after inventory keeps getting dearer. Ad data company Guideline projects that NFL ad revenue will reach $6.3 billion this season, up 8%, after a 7% rise last year, Adweek's TV Advantage analysis noted on October 9, describing NFL inventory as the top prize of this year's upfront. Baseball took a different route to urgency. Major League Baseball ran full-page newspaper ads in postseason markets in late September, including in The New York Times and the Los Angeles Times, under the line October Starts Today, as part of a campaign called No Time Like October. Adweek, writing on October 9, credited it with part of a ratings boost, though no figures were in the visible text.

The midterms are the other fixed date on the calendar. CNN said its weeknight primetime anchors will host two-hour Sunday specials under the title Midterms 2026: Countdown to Election Night, starting on October 11 at 8 p.m. Eastern with Abby Phillip, Adweek's TVNewser reported on October 9. Laura Coates and Kaitlan Collins follow; on the final Sunday before the vote, Erin Burnett hosts at 6 p.m. and Anderson Cooper at 8 p.m. The first special airs on the same Sunday that EU ambassadors are expected to decide on the omnibus.

TVNewser's Friday ticker carried a cluster of smaller moves on October 9. Former White House press secretary Karoline Leavitt joins Fox News as a contributor on November 1, after serving from January 2025 to August 2026. Fox Nation will premiere Houdini: Back from the Dead on October 14, its first full-length project made entirely with AI-generated imagery. PBS News launched a Press Pass subscription at $8 a month or $96 a year after federal funding cuts; ABC News added a vertical video feed called Verts; CBS News will stream The Nerd Show before its election-night broadcast on November 3; and Rachel Jupp was named director of BBC News and Current Affairs. Earlier the same day, TVNewser wrote up Fox News co-host Jessica Tarlov's session at ADWEEK House during Advertising Week, where she told marketers that audiences are more politically diverse and tolerant than brands tend to assume.

A new entrant to an already packed conference circuit had a softer first year than its sponsor list suggested. Jupiter Festival, a four-day event on three stages in Miami Beach founded by Cannes Lions alumnus William Mellis and former Fox Sports Media Group marketing chief Eric Markgraf, reported 2,231 attendees and said that met its goal, but Adweek found the show felt sparse at times in a report published on the evening of October 9. MCH Group, the parent of Art Basel, owns 20% of the venture; Cannes Lions, YouTube, Boston Consulting Group and the IAB are listed as supporters.

Permission, again

The brands themselves spent Friday on more familiar ground. Adweek's weekly round-up of Ads of the Week, published October 9, gathered 12 campaigns, among them Goodwipes answering Wet Ones on billboards, an Asics parody nature documentary narrated by Sigourney Weaver about the inactive human, Mint Mobile casting Ryan Reynolds and Julia Stiles as sceptics of the brand, an Ikea dating show built around wardrobes, and the return of Twix's Zombie Claus. Its list of five marketer moves the same day confirmed Andy Pitts as Red Lobster's permanent chief marketer after serving as interim since January, and noted that Stephan Loerke will step down as chief executive of the World Federation of Advertisers on June 30, 2027, after more than 20 years.

And on the eve of World Mental Health Day, BetterHelp chose a word that has run through the whole day's news. Its Permission Project, reported by Adweek on October 9, was developed with actress and podcaster Sophia Bush and offers 10,000 hours of free therapy to listeners of her podcast, Work In Progress, alongside a $100,000 Therapist Impact Fund for five therapists' loan relief and five students' scholarships. The company's 2026 State of Stigma Report found that more than eight in ten women in their 30s reported excessive worry and 74% said they struggle to relax. Fifteen BetterHelp therapists identified ten unwritten rules that set conflicting expectations for women, and the campaign asks people to rewrite them using narrative therapy.

The campaign is about personal permission, not the regulatory kind. Yet the distance between the two is shorter than it looks. Under the Council's draft, a visitor who refuses cookies could be asked again four months later. A regulator that asked for an urgent answer in August 2018 gave its decision in September 2026. A Danish publisher would have to prove consent for a face; a Washington hospital needed none for a pixel. In Europe, and increasingly beyond it, permission has become a measurable quantity, with a waiting period, a burden of proof and a deadline attached. Sunday's meeting in Brussels will decide some of those numbers. The others are being set, one default and one definition at a time, in product help pages.

By the numbers

  • 2,951 days Time between Ireland's 2018 call for an urgent answer and its Google location fine. Source
  • €403 million Penalty Ireland's regulator imposed on Google over three location-related account settings. Source
  • 9 of 14 Commerce data use cases the IAB says can often run without a clean room. Source
  • 7% Share of HubSpot's workforce leaving as teams regroup around four business outcomes. Source
  • January 1, 2027 Proposed start of Danish rules requiring proof of consent before publishing digital likenesses. Source