Key Themes from the IAB Compliance Salon 2026: Execution and Evidence

How do you turn privacy requirements into practices that work across a complex advertising ecosystem? That question connected the discussions at the IAB Compliance Salon, where speakers explored vendor diligence, sensitive data, enforcement, advertising to young audiences, and the realities of implementing privacy programs.

A recurring message was clear: organizations need evidence that their technology and business practices deliver on their privacy commitments. Here are five themes that stood out.

1. Technical verification belongs alongside contracts and questionnaires

Vendor questionnaires and contracts remain essential, but speakers repeatedly emphasized the need to validate what happens in practice. A vendor may describe its capabilities accurately while a particular implementation, default setting, or configuration results in unexpected data sharing.

The discussion covered reviewing code, examining network requests, testing software development kits, and checking consent and opt-out configurations. One example highlighted embedded webviews: opening a web page inside an app can introduce website tracking technologies into an environment where teams may not expect them.

Speakers also stressed that diligence should continue throughout the vendor relationship. The cadence should reflect risk, changes in technology, and the organization’s ability to act on findings.

How do we confirm that what the contract says is actually happening in practice?

And then, how often are we checking?

The takeaway is to connect vendor representations with technical evidence, assign responsibility for remediation, and revisit the implementation as it changes.

2. Sensitive data can emerge from context and inference

Sensitive data was discussed as a challenge that extends beyond obvious fields such as a medical diagnosis. Page URLs, browsing patterns, audience segments, and the purpose of a website can reveal or support inferences about sensitive characteristics.



A hypothetical involving an immigration-focused website illustrated why context matters. Visiting a general news article about immigration is different from interacting with a site dedicated to helping people seek asylum. Participants explored how an analytics tool could turn those interactions into audiences used elsewhere in the advertising ecosystem.

Practical approaches included reviewing page content and URLs, restricting tags in sensitive areas, examining how audience segments are built, and limiting downstream uses through contracts. Speakers cautioned that obscuring a URL does not resolve the underlying issue if the same sensitive audience is still being packaged and monetized.

The takeaway is to examine what data reveals in context, where it travels, and how recipients use it.

3. Enforcement discussions kept returning to consumer expectations

The enforcement conversation emphasized unfair or deceptive practices and whether data handling matches what consumers reasonably expect. It also explored coordination among state attorneys general, including offices operating under different statutory frameworks.

Consent design was a particular focus. Speakers discussed confusing choices, consent bundling, and the burden placed on consumers to understand how to opt in or out. The broader discussion also highlighted litigation risk and the scrutiny that tracking technologies can attract.

Across sessions, participants described the importance of a defensible process: understanding data flows, documenting diligence, testing implementations, and following through when problems are found. The operational question was whether an organization could explain and substantiate its practices when challenged.

The takeaway is to review the consumer experience alongside the underlying data flow, and retain evidence that privacy commitments are being carried out.

4. Protecting children and teens requires changes across the advertising ecosystem

The children and teens panel explored evolving restrictions on advertising, the difficulty of understanding audience age, and the implementation challenges created by age signals.

Participants raised questions about conflicting signals, shared devices, and how downstream partners can apply appropriate protections.

The discussion also exposed a tension between learning enough about a user’s age to apply safeguards and collecting more personal information than the business otherwise needs.

Contextual advertising emerged as an important alternative, but speakers distinguished ad targeting from measurement.

Choosing an ad based on page content does not automatically prevent attribution pixels or other measurement tools from tracking the individual afterward. Protecting younger audiences therefore requires examining both how an ad is selected and what happens after it is served.

The takeaway is to evaluate age information, targeting, and measurement together, including the responsibilities of partners throughout the chain.

5. Privacy works through relationships and everyday business processes

The implementation panel brought the conversation back to people. Privacy teams need relationships with marketing, product, engineering, and leadership before a difficult approval decision or imminent launch.

Speakers described privacy champions within departments, leadership support, and communication tailored to each team. Engineering needs clear requirements and acceptance criteria. Product teams need to understand the impact on the customer experience. Leadership needs concrete decisions and an explanation of their consequences.

Operational examples showed why that collaboration matters. Deletion and suppression discussions raised questions

about shared identifiers and preventing deleted records from returning through data refreshes. Vendor diligence discussions explored what happens when an existing partner can no longer meet the business’s requirements. These are ongoing operating decisions that require ownership across teams.

The takeaway is to bring privacy into planning, contracting, development, and vendor management early enough to help shape the outcome.

Turning discussion into action

The IAB Compliance Salon highlighted how much of privacy compliance depends on execution and evidence. Organizations need to understand the information their technology shares, test whether controls work, and give teams a practical way to resolve problems. For privacy, marketing, and technology leaders, the next step is to turn those insights into a repeatable process with evidence, clear ownership, and ongoing review.