DOJ Bulk Data Rule class action: What new class action means for adtech deployment

Introduction

On October 1, 2026, two California residents filed a putative class action, Cestrone v. Teads Holding Co., in the Southern District of New York against Teads Holding Co., formerly known as Outbrain (“Outbrain”). The complaint alleges that Outbrain intercepted users’ browsing activity, built persistent profiles on them, and passed their identifiers to Chinese technology companies in violation of the Department of Justice’s Bulk Sensitive Data Rule (the “Bulk Rule”). Plaintiffs then use that alleged Bulk Rule violation to overcome the party exception under the Electronic Communications Privacy Act (“ECPA”), turning a national security regulation into the basis for a private wiretap claim. This article breaks down the allegations and outlines practical steps organizations can take to reduce their Bulk Rule and ECPA litigation risk.

Key takeaways:

• Adtech as data brokerage. Plaintiffs are treating ordinary adtech plumbing, such as cookie syncing and real-time bidding, as possible “data brokerage” under the Bulk Rule. 
• Bulk Rule exposure is fueling large class actions. Alleged Bulk Rule violations are becoming a growing source of class action risk, because the rule’s 100,000-person threshold means any alleged violation involves a large pool of potential class members, and pairing it with ECPA opens the door to statutory damages on a class-wide basis. 
• Public statements as proof of knowledge. An organization’s own public disclosures and trade association memberships are being offered as proof that it knew the conduct was prohibited.

The Bulk Rule and the Outbrain allegations

The Bulk Rule

The DOJ issued the Bulk Rule on April 8, 2025 under Executive Order 14117 and is codified at 28 C.F.R. Part 202. It restricts “covered data transactions” that involve bulk U.S. sensitive personal data or bulk covered personal identifiers when the recipient is linked to a country of concern, including China. Covered identifiers include advertising IDs, device identifiers, and IP addresses. As pleaded, the bulk threshold for these identifiers is data on more than 100,000 U.S. persons over a 12-month period. The rule’s own examples include a U.S. ad seller that sends IP addresses and advertising IDs to an advertising exchange in a country of concern. 

For a fuller discussion of the rule’s scope and requirements, see our prior article, DOJ’s final rule on preventing access to U.S. sensitive personal data.

Allegations 

Plaintiffs allege that Outbrain’s own published cookie table identifies several China-based technology companies as cookie-syncing partners. Plaintiffs allege that, when a user loads a page running Outbrain’s code, the user’s browser silently transmits the user’s persistent Outbrain ID and IP address directly to those partners’ servers. The complaint further alleges that some of these recipients appear on the Department of Defense’s Section 1260H List of Chinese military companies operating in the United States. Plaintiffs contend that these transfers reach millions of Americans, far exceeding the Bulk Rule’s 100,000-person threshold, and that Outbrain continued them even after the rule took effect. The proposed Nationwide Class accordingly covers all U.S. users whose data was sent to China-based entities on or after April 8, 2025.

ECPA and the Bulk Rule 

Cestrone reflects a pattern now emerging in privacy litigation: Plaintiffs are invoking the Bulk Rule not as a standalone claim, but as the “crime or tort” needed to defeat the ECPA’s party exception (as previously explored). The ECPA generally does not apply when a party to the communication does the intercepting. That exception does not apply, however, when the interception is carried out to commit a crime or tort. Plaintiffs argue that Outbrain intercepted page URLs, which they say are communication “contents,” for the purpose of making transfers the Bulk Rule prohibits. They rely on Outbrain’s membership in industry groups that took part in the rulemaking and on its SEC risk disclosures (including its 10-k filing) to show it acted knowingly. If courts continue to accept this approach, any adtech integration that allegedly sends identifiers to a covered person could support not only regulatory exposure under the Bulk Rule, but also private wiretap claims carrying statutory damages.

What plaintiffs are seeking and the class action risk

Plaintiffs seek certification of two classes: a Nationwide Class of U.S. users whose data was sent to China-based entities on or after April 8, 2025, and a California Class of residents whose data Outbrain used to build or share profiles. On the ECPA claim, they seek actual damages and disgorgement or statutory damages under 18 U.S.C. § 2520(c)(2), whichever is greater, plus punitive damages, fees, and equitable relief. Under the California Invasion of Privacy Act (CIPA), they seek $5,000 per violation and an injunction. 

The template is easy to copy. Because ECPA and CIPA provide statutory damages, plaintiffs do not need to prove actual loss for each user, and per-violation awards multiplied across millions of page loads can produce very large exposure. The Bulk Rule’s 100,000-person threshold also fits naturally with class treatment, since any company that crosses it has, by definition, a large group of affected people. Publishers, adtech vendors, and any business that runs third-party pixels or cookie-sync partners should expect the plaintiffs’ bar to test this theory against other companies whose vendor lists include China-linked entities.

Preventative Action Items

Cestrone is still at the pleading stage, and its allegations have yet to be tested in court. But the case shows how quickly the Bulk Rule has moved beyond a compliance obligation enforced by the DOJ and into the plaintiffs’ bar's toolkit. By pairing the rule with the ECPA, plaintiffs have found a way to turn routine adtech data flows into potential classwide wiretap claims with statutory damages. Companies that rely on third-party tracking, real-time bidding, or cookie-sync partnerships should not wait for a court ruling to assess their exposure. The following steps can help organizations reduce both regulatory and litigation risk:

• Map identifier flows. Inventory every pixel, SDK, tag, cookie-sync partner, and bidstream recipient on your sites and apps, including those added by publishers, agencies, or tag managers. For each one, document what identifiers leave your environment (advertising IDs, IP addresses, device IDs, cookie data, URLs) and where they go, and confirm whether any recipient is a covered person. This data map is the foundation for every other Bulk Rule and wiretap defense. 
• Screen vendors. Check adtech partners, and their parents and affiliates, against the 1260H List and the rule’s ownership and jurisdiction criteria. Build this screening into vendor onboarding and repeat it on a set schedule, since lists and corporate structures change. 
• Align disclosures. Make sure SEC risk factors, privacy notices, and cookie tables match actual practice. Plaintiffs here relied on Outbrain’s own 10-K and published partner list to show knowledge, so statements that a company monitors data transfer rules can become evidence that it should have known better. Legal, privacy, and investor relations teams should review these documents together. 
• Revisit consent. Strengthen notice and consent for third-party tracking so that it is clear, conspicuous, and obtained before tags fire. Consider configuring consent tools to block nonessential trackers by default, and limit the sharing of full page URLs on sensitive pages such as health or financial content. Valid consent is a core defense to both ECPA and CIPA claims. 
• Paper contracts. Add Bulk Rule representations, prohibitions on onward transfer to covered persons, audit rights, and notice obligations to adtech and publisher agreements. Include termination rights and indemnities if a partner becomes a covered person or causes a prohibited transfer. In M&A diligence, ask targets for their data maps and vendor screening records, since this exposure follows the business.