The Trade Desk, Inc.

Complaint filed

17.04.2026

Decision

15.05.2026

Time to decision

28 days

Decision number

2.1-1/26/820-1654-2

GDPR articles

12, 15, 57

What was in the complaint

First request — 17 February 2026

Sent under Art. 15 GDPR to privacy@thetradedesk.com and dpo@thetradedesk.com. Full name, two email addresses and a postal address were provided.

18 February — an auto-reply: this mailbox is checked irregularly, but a reply will be given in due course.

3 March — a substantive reply: “TTD conducted a search and did not find any data associated with the information you provided”.

The statutory deadline expired on 19 March. No substantive reply under Art. 15 followed.

Second request — 20 March 2026

Sent again, this time with a device identifier, extracted from a HAR analysis of the site thetradedesk.com. The recording was made through the anonymous Startpage proxy, without a VPN.

15 April — TTD’s reply: “we cannot fulfil the access request on the basis of the device identifier you provided, as we cannot verify whether it is associated with you”.

Why this reply contradicts the facts

The HAR records: a request of the form /consent/<identifier>.json returned HTTP 200 — three times.

That is, TTD’s server recognises this identifier and returns data for it. At the same time the company claims it cannot link it to a person.

Other breaches from the HAR

Art. 15(1)(c) — recipients not disclosed. The OneTrust consent console on the TTD site lists 330 partners. Not one is named in the reply to the request.

Art. 15(1)(h) and Art. 22 — profiling not disclosed. TTD’s own policy describes building cross-device graphs by algorithmic methods.

Art. 5(1)(a) and 6(1) — processing before consent. By the HAR timings: Google Tag Manager fired after 253 ms, geolocation — after 3328 ms, Marketo — after 3390 ms from the page opening. All of this before the consent banner appeared.

Articles: 12(2), 12(3), 15, 5(1)(a), 6(1), 22, 44–46.

What AKI decided

Proceedings discontinued on 15 May 2026. Decision No. 2.1-1/26/820-1654-2.

“Even if the circumstances described in the complaint indicated possible breaches, the inspectorate’s intervention would not lead to more effective protection of the complainant’s rights — given the location of the controller and the inspectorate’s limited possibilities to enforce its decision.”

“Although the complaint contains extensive technical argumentation, at the centre of the dispute is an individual request from a specific data subject. The inspectorate has not established circumstances indicating a direct and large-scale risk to the rights of Estonian data subjects.”

“AKI does not intervene where personal data is processed in a country outside the EU, beyond the reach of the inspectorate’s enforcement tools.”

On referral to the UK regulator. The complainant asked for the complaint to be sent to the ICO. AKI explained: The UK Trade Desk Ltd. is located in the United Kingdom, but the data controller of the site is the American parent company; moreover, the ICO is not an EU authority, and the one-stop-shop mechanism (Art. 56) does not apply to it.

Analysis

What is justified in the refusal — and it must be said directly

AKI noted a procedural flaw, and the point is fair. The complaint to the inspectorate was filed on 17 April, while the company itself had been given a deadline to reply of 20 April. The regulator considered it reasonable to first give the controller the chance to clarify its answers.

This was a deliberate choice, not an oversight — and all the more important to examine.

The reasoning was this: a substantive reply from TTD had already been received, it was unsatisfactory, and three days remained before the deadline — so there was nothing to wait for, and it could be filed. This is one of my first analyses, and the logic seemed convincing.

It turned out to be wrong. As long as the set deadline has not expired, the controller retains the possibility to supplement or correct its reply, and the supervisory authority has no basis to intervene: the right has not yet been definitively breached. The haste came at a high price — it gave the regulator a lawful pretext not to examine the substance.

The lesson is simple: a deadline you set yourself must be kept to the end. Even when the outcome seems obvious.

The argument about the unreachability of the USA also has grounds. TTD is an American company, and the Estonian regulator genuinely has no means of enforcement against it.

What remains disputable

“Even if they indicated possible breaches…” — the regulator admits the existence of breaches and refuses to establish them. Finding a breach and enforcing against it are different things. The first is possible without the second, and it creates a basis for further action: complaints in other jurisdictions, a class action, an approach to the lead authority.

The contradiction in TTD’s reply was not checked. The company claims it cannot link the identifier to a person. Its own server returned HTTP 200 for that identifier three times. This is a verifiable claim — and it went unverified.

330 partners in the consent console. Not one is named in the reply to the request. Art. 15(1)(c) requires disclosure of recipients. This point is not addressed in the decision.

← back to all cases