Two hours and fifteen minutes of video, roughly 70,000 dollars and more than 500 staff hours went into the most detailed public teardown yet of what a television does when nobody is watching it. The findings landed in the advertising trade press this week, and they describe a device that does considerably more than recognise content.

At almost the same moment, a French regulator published a 300,000 euro fine that turned on nothing more exotic than unanswered emails, California signed a package of child safety statutes that price harm per minor rather than per violation, and two of the largest advertising platforms quietly changed who is allowed to connect to their measurement pipes at all.

The open web is the channel that never simplified itself
Sixteen terms, four groups of four. The awkward part is not the jargon: it is the handful of tiles that read as plain English right up until they do not.
PPC LandLuis Rijo

None of these are announcements about audience growth. Every one of them is about who holds the data, who may look at it, and what it costs to mishandle it.

What the television in the room was doing

Gamers Nexus published its investigation on September 7. By the time PPC Land reported the findings on September 12, the video had been watched 5,165,512 times. The work was carried out with MrBruh on firmware decompilation, alongside uturn and Wendell of Level1 Techs, across four retail units bought in the United States: an LG G5, a G3, a 43-inch QNED 73B and an LG smart monitor. All four run webOS, the operating system LG ships on its television line.

The measurements were taken in layers, which is what makes them useful.

With the G3 configured as a display only, before any optional consent was granted, one hour of monitoring recorded 8.9 megabytes transferred, 38 DNS queries to LG domains and eight distinct endpoints contacted. Extrapolated, that is 6.4 gigabytes a month from a set doing nothing but showing a picture. No content recognition data appeared in that baseline.

After consent, the same set as a monitor reached 29 endpoints across 107 connections, 44 of them to Alphonso, LG's advertising data subsidiary. The QNED 73B, sampled twice for fifty minutes, reached 22 endpoints and 157 connections as a monitor, 54 to Alphonso. Running LG Channels, the free streaming service, the same television reached 60 endpoints across 847 connections, 618 of them to Alphonso. The researchers put the aggregate at roughly four gigabytes of content recognition data per television per month.

Then there is the figure that gives this story its shape. One television mapped 38 devices on the network it was plugged into, capturing display names, MAC addresses, internal IP addresses and signal strengths. The inventory included staff smartphones, smartwatches, a 3D printer, an air purifier, network switches and thermostats. LG, responding to Tom's Hardware on or about September 9, confirmed device scanning as a "standard function."

The voice findings are harder to categorise. Speech transcripts were found stored as plain text in RAM disk logs, with a capture window running roughly 10 to 15 seconds after speech stopped. Usable capture was achieved at more than 40 feet, and in some room configurations at 60 to 70 feet around corners. Four audio paths were identified that bypass the microphone toggle entirely: a USB webcam, the remote control microphone, HDMI audio and a feedback microphone. The sampling method itself is documented precisely: six-second audio and video samples downsampled to 8 kHz mono, with a fast Fourier transform applied across 40 chunks of 100 milliseconds each.

LG denied the core allegations, stating that voice processing occurs only when a remote button is pressed or a wake word is detected, and that content recognition is opt-in. The company did not address the plain-text transcript storage, nor the residential proxy findings.

That second omission matters, because it has a history. Spur research on July 2, 2026 identified proxy software development kits in roughly 43 percent of webOS applications tested, 1,213 of 2,851. LG suspended non-compliant webOS apps on July 21, updated its United States arbitration terms on July 28, and Samsung banned proxy SDKs across Tizen in August. Gamers Nexus had published a first video on LG monitors on July 16. The September investigation is the escalation, not the opening.

The consent architecture deserves its own paragraph, because it is where the advertising question actually sits. Seven documents govern what an LG television may do, totalling roughly 22,300 words: a legal notice of about 1,270 words, terms of use from July 2026 at about 10,700, a May 2026 privacy policy at about 6,780, an automatic content recognition agreement at about 1,580, an interest-based advertising agreement at about 1,085, a voice agreement at about 865, and a marketing communications agreement of about 40 words. Two are mandatory. Four are optional. At 220 to 350 words a minute, reading all of it takes between 64 and 101 minutes. Whether that structure constitutes a dark pattern or merely thorough disclosure is precisely the question regulators in Europe will be asked, and the answer will turn on how an opt-out signal is presented rather than on whether one exists.

The commercial stakes are visible in the filings. Alphonso reported sales of 273.698 billion Korean won in the first quarter of 2026, roughly 185 million dollars, on profit of 32.646 billion won, about 22 million dollars. LG Ad Solutions claims 363 million addressable secondary devices in the United States, against 216 million smart televisions sold globally and a 200 million global installed base as of October 2025, with 45 million connected devices in the United States as of July 2025. Serge Matta, president of LG Ad Solutions, settled SEC charges connected to Comscore in 2019, paying a 700,000 dollar penalty and accepting a ten-year bar from public company officer roles.

The data does not stay inside LG. Nielsen gained access to the LG ACR footprint for national measurement in October 2023. A 33 million household viewership dataset appeared on the Databricks marketplace in October 2025. Taboola added exposure-to-conversion tracking in December 2025, Viant integrated in July 2025, and Affinity Solutions runs a product called Loop IQ that connects advertisement exposure to card and bank transactions. Projected connected TV spending on the 2026 United States midterms stands at 2.7 billion dollars, and products routing voter data through streaming were identified in the investigation.

European exposure runs through LG Electronics Deutschland GmbH in Eschborn, Hesse, which makes the Hessian data protection commissioner in Wiesbaden the competent authority. South Korea has held an adequacy decision since December 2021. Texas sued Hisense in December 2025 over comparable consent design, citing 1.27 million affected residents. The pattern of ad personalization on the television set is now a regulatory file in at least three jurisdictions.

Three hundred thousand euros for not replying

Which leads to a decision that reads like an instruction manual for how consumer data rights enforcement actually works, and which has almost nothing to do with advertising technology in its facts.

France's CNIL fined EXTIA 300,000 euros under deliberation SAN-2026-010, adopted July 21, 2026 and published on Legifrance and the CNIL website on September 9. The EDPB issued an English summary on September 11. EXTIA is a consultancy created in 2007, headquartered at 1 avenue de la Cristallerie in Sevres, with about 2,000 employees of whom 1,600 to 1,700 are consultants, across roughly 20 French establishments.

The arithmetic is the case. EXTIA received 28,322 job applications in 2024 and 265 erasure requests. It mishandled 204 of them, a little over 77 percent.

Three findings were upheld. Twelve erasure requests from 2024 were never processed at all, despite sufficient identifying information, breaching Articles 12 and 17 together. A further 166 people were never told what had happened to their request: 125 unshortlisted candidates whose data was said to have been deleted on a 60-day timer, four former employees whose data was retained under a legal obligation, and 37 others. That breached Article 12(3) and 12(4), which require communication within one month. Twenty-seven responses arrived late, 26 erasure answers delayed by more than five to six months and one access request answered more than a year late. An Article 13 transparency claim was abandoned for insufficient substantiation.

The reasoning carries further than recruitment. EXTIA argued that automatic deletion after 60 days had handled the requests. The restricted committee, chaired by Philippe-Pierre Cabourdin with Sophie Lambremon as rapporteure, rejected that flatly: automatic deletion of the data of 125 unshortlisted candidates after 60 days "cannot conceal that none of those 125 requests was actually examined when it arrived." The one-month obligation is autonomous, triggered when a request lands, not when the underlying record expires. For any marketing stack that relies on a retention window to discharge data subject requests, that is the operative sentence.

The open web is the channel that never simplified itself
Sixteen terms, four groups of four. The awkward part is not the jargon: it is the handful of tiles that read as plain English right up until they do not.
PPC LandLuis Rijo

The 60-day purge period was also undocumented, raised for the first time in defence, and contradicted by an email to applicants stating a two-year retention period. Under Article 5(2), the burden of proof sat with EXTIA, and an undocumented practice carried no weight. Qualified candidates were retained two years by default from last interaction. EXTIA designed, developed, administers and maintains the applicant tracking system itself, so no vendor default was available as an explanation.

Two formal reminders, issued April 19 and June 20, 2024, went unheeded, which the committee treated as aggravating negligence. Cooperation was rated neutral rather than mitigating, because essential information arrived at the defence stage and figures shifted between the company's first and second observations. Turnover and net income for 2023, 2024 and provisional 2025 were redacted, though the committee noted that revenue figures on the company website ran considerably higher than filed accounts, which EXTIA explained as worldwide rather than French-only.

A proposed injunction was withdrawn before the July 2 hearing after EXTIA produced evidence of a mass remediation email sent April 14, 2026, with twelve individuals unreachable. Publication was ordered with anonymisation after two years. The company's objection on client trust grounds was rejected. Appeal lies to the Conseil d'Etat within two months.

The case came out of the EDPB coordinated enforcement action on the right to erasure, which surveyed 764 controllers across 32 authorities in 2025 and reported in February 2026. Related penalties in the same cluster include Criteo's 40 million euros upheld in March 2026 on Articles 12, 15 and 17, Piaggio at 460,000 euros, a reprimand for Flightradar24, and a 2 million euro fine plus dataset erasure order against Lusha.

California prices the harm per child

The week's legislative news arrived as a package rather than a single bill, and the pricing mechanism is the part that will change behaviour.

Governor Gavin Newsom signed four measures on September 10. AB 1709 prohibits addictive features for users under 16, meaning algorithmic feeds and autoplay, with civil penalties of up to 50,000 dollars per affected minor for knowing violations and up to 25,000 dollars for negligent ones. Penalties scale per child, not per violation, which converts a compliance question into a multiplication problem. Platforms must delete the accounts of minors who cannot be served a stripped-down experience. There is no private right of action: enforcement belongs to the Attorney General or local prosecutors. The bill, authored by Assemblymember Josh Lowenthal, passed the legislature on August 31 without opposition votes, and its age-gating obligations depend on the Digital Age Assurance Act, AB 1043, which takes effect January 1, 2027.

SB 1119, informally called Adam's Law, regulates companion chatbots, requiring operator risk assessments, independent audits, parental controls and in-app crisis support, with specific attention to self-harm and sexually exploitative material. AB 2 raises damages liability for large social media companies that harm children. The package also created a seven-member e-Safety Advisory Commission inside the Department of Justice, advisory only, with four appointments by the Governor and one each from the Senate President pro Tempore, the Assembly Speaker and the Attorney General. Required expertise spans paediatrics, child psychology, platform design, age assurance, advocacy, academia and K-12 education, and at least one member must have LGBTQ+ civil rights experience.

Newsom framed the package as groundwork: "We're establishing a framework so that we can really enact a more aggressive posture as it relates to enforcement." Jim Steyer of Common Sense Media called it "the first step in the United States towards comprehensive regulation and commonsense guardrails." Chris Lehane, a vice president at OpenAI, said SB 1119 meets "the moment for parents and sets teens up for educational success." Cesar Fernandez of Anthropic noted that "more work is needed to ensure AI developers are required to have safeguards evaluated by independent third-party experts."

Games - PPC Land
Daily word games for advertising professionals. Test how well you really know the industry: a new Connections-style grid every day, sorting 16 ad tech terms into four hidden groups, plus a weekly crossword built from the terminology that fills programmatic briefs, DSP dashboards, and measurement decks. Free to play, no account needed. Come back each morning for a fresh puzzle — and find out whether you know your bid shading from your supply path optimization.
PPC LandLuis Rijo

Pinterest endorsed SB 1119 on the day it was signed and stated plainly that it does not build AI designed to simulate friendship, romance or emotional dependence. Pinterest Assistant, which entered beta on November 4, 2025 and reached the vast majority of United States users by July 2026, is restricted to adults 18 and over. Teen accounts default to private, with limited social features and comments off.

Bill Ready, Pinterest's chief executive, put it this way: "AI is powerful, and so is its effect on young people. Teens deserve technology that supports their wellbeing, not technology that puts it at risk." Assemblymember Rebecca Bauer-Kahan, a co-author alongside Senator Steve Padilla and Assemblymember Buffy Wicks, responded that "protecting children must be a shared priority." Ted Lempert of Children Now noted that more than 250 organisations supported the bill.

The commercial position is worth stating precisely. Pinterest reports more than 640 million monthly active users, and its own research published September 1, 2026 found teens re-pinning 64 percent more often than other age groups, searching 44 percent more and organising boards 68 percent more. Gen Z accounts for more than half the global user base. Pinterest disclosed no United States teen percentage, no engagement data for the cohort excluded from Assistant, and no revenue impact from the 18-plus restriction. Endorsing a statute that constrains a product a company has chosen not to build is a low-cost position, and the absence of those figures makes the cost impossible to check.

The research behind the legislation is thinner than the penalties suggest. A JAMA Network Open study published November 7, 2025, lead-authored by Ryan K McBain, found one in eight United States adolescents and young adults using AI companion chatbots for mental health advice, two thirds of them at least monthly. DeepSee research released August 3, 2026 found 60 percent of 4,346 surveyed AI companion apps carrying ratings accessible to minors. SB 1119 is silent on the mechanism by which thousands of small operators with permissive store ratings would be reached.

The wider map is fragmenting. SB 243 was signed October 13, 2025, requiring disclosure where a reasonable person would be misled and crisis routing. New York's chatbot liability law took effect in November 2025 on an output-liability model. Connecticut passed a 64-page AI bill on April 21, 2026 by a 32-4 Senate vote, mandating hourly in-session reminders. Tennessee proposed felony penalties for certain companion AI training in December 2025. Idaho, Oregon and Washington passed their own rules in 2026. Compliance now varies by state, by feature and by age band.

The pipes get new locks

Two platform changes in the same week altered who may connect to advertising measurement infrastructure, and both moved in the direction of per-account gatekeeping.

Google announced on September 10 that it is sunsetting developer tokens as the basis for Ads API access. Authority moves from the 22-character token issued in a manager account API Center to the Google Cloud project identifier. Signup relocates from the API Center to the Google Ads API Overview page in the Cloud Console. Token headers are still accepted but the value is ignored by API servers, and a future major version will reject them outright. Version 25 now returns CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION rather than the older ACTION_NOT_PERMITTED for permission failures, which at least makes the cause legible. Anash P. Oommen of the Google Ads API team wrote the announcement.

Two details carry weight. Brand verification became mandatory for all new Basic and Standard Access applications, having been an optional pilot since July 7, 2026 that cut approval from five business days to hours. And access levels for existing integrations were mapped automatically based on recent API activity rather than any action by the developer. Google acknowledged a backlog on February 6, 2026 and now reviews Basic Access within minutes after verification. It did not disclose how many pending applications were closed, when the API Center retires, which version will reject tokens, or how many integrations failed the automatic mapping. Four major versions ship annually and each is supported for twelve months, so multiple versions coexist throughout.

Microsoft moved in parallel on the conversion side. Its new Conversions API is not self-service: access requires a manual enrolment request through an account manager or support, and the flag attaches to the customer account identifier rather than the UET tag. The documentation is public, dated August 4, 2026, while the interface option is simply absent until enrolment completes.

The specification is tight. Events post to capi.uet.microsoft.com at /v1/{tagId}/events. Required fields include eventTime as a UNIX timestamp no more than seven days old, a pageLoadId in UUID v4 format, an eventName matching an existing conversion goal, and a userData object carrying at least one identifier from an anonymous ID, external ID, SHA-256 hashed email or phone, click ID, Apple IDFA or Google GAID. Batches cap at 1,000 events, and if a single event fails validation the API returns HTTP 400 and processes none of them. Microsoft suggests 90 days of Click ID storage, having auto-enabled Click ID on eligible accounts back in April 2024.

Context for why any of this exists: Safari 26 shipped Advanced Fingerprinting Protection on September 4, 2025, and a July 2026 analysis confirmed the Bing UET endpoint blocked in Safari 27. The client-side identity sync pixel at c.bing.com/c.gif remains vulnerable to the same blocking, and Microsoft did not say how that is resolved. The IAB published a 26-page conversion API standardisation guide on October 30, 2025, and the ECAPI 1.0 specification was finalised May 3, 2026. An IAB survey run July 22 to August 19, 2025 found two thirds of advertisers reporting improved return on ad spend after implementation, with 67 percent running a conversion API alongside a pixel rather than replacing it. Meta launched one-click Conversions API in April 2026 and reported 17.8 percent lower average cost per result for web events. Current Microsoft connectors are Commanders Act, Freshpaint, Invoca, MetaRouter, Segment, Stape.io and Tealium, with Adobe Real-Time CDP and Switch Growth listed as coming. Microsoft disclosed no timeline to general availability, no enrolment processing duration and no count of enrolled accounts.

Buying moves inside the exchange

The last piece of the week concerns physical location rather than policy. PMG moved its buying decisions inside Index Exchange's data centre, announced September 10, gaining access to more than 3,000 media owners globally on day one.

The architecture is specific. A containerised demand-side platform, built by London-based Bedrock Platform, runs inside Index Cloud. Decisioning is activated from PMG's Alli Buyer Cloud operating platform. Subjective supplies content and audience signals at bid time. The container reports a sub-five-millisecond execution window, unverified by any third party, and per-request cost approaches zero inside the cluster compared with external cloud egress. Rollout begins with premium streaming television, with mobile app inventory and display to follow on no announced schedule.

Mike Treon, head of CTV and video strategy at PMG, described the gain as signal fidelity: "Operating at the supply edge means our agents can better evaluate every impression, with no round trips, no signal loss, and full transparency." Shane Shevlin, co-founder and chief executive of Bedrock Platform, framed it as economics, saying Index Cloud lets a platform deploy its own decisioning at exchange scale "without the infrastructure tax." Michael Richardson, vice president of product at Index Exchange, was more expansive: "Sell-side decisioning has the potential to reshape how the open internet transacts."

Undisclosed: cost per outcome, win rate changes, latency measured in PMG's own configuration, spend volume in the pilot, the names of supply partners, any definition of the incremental benefits claimed, per-impression auditor access to the decision logic, and any performance comparison against a conventional demand-side platform.

The precedents are accumulating. Zillow ran a containerised real-time bidding pilot with Chalice in August 2025. Index Exchange reported a 75 percent reduction in cost per site visit in February 2026. Bedrock's first containerised DSP on Index Cloud went live April 21, 2026. PubMatic launched Decision Fabric on June 1, 2026, Magnite took a dual-path container and server-to-server approach on August 6, and OpenX countered on September 2 with a claim of three million queries per second on self-managed infrastructure.

The reason any of this is attractive is concentration. Display & Video 360, The Trade Desk, Amazon DSP and Yahoo DSP together controlled roughly 85 percent of global programmatic spend in the first quarter of 2026, with DV360 alone near 41 percent. Moving decisioning into an exchange is one of the few structural responses available to a buyer that does not involve choosing among those four.

Put the week's five stories side by side and a single question runs through them. A television sends four gigabytes a month to a subsidiary that sells the result, and an independent teardown rather than a disclosure document is what revealed it. A consultancy paid 300,000 euros because it could not show what it did with 204 requests. California set a per-child price on a feature and left the measurement of compliance to an advisory commission with no binding power. Two platforms tightened who may hold the keys to their own measurement interfaces. And an agency physically relocated its buying logic into an exchange, declining to publish what changed as a result.

In every case the mechanism is documented and the outcome is not.

Also noted