California AG’s Sling settlement exposes privacy infrastructure gaps

At a glance

What this is: Ketch argues that the Sling TV settlement turns privacy compliance into an infrastructure problem, with four recurring failures: logged-out identity parity, disconnected opt-out design, contextual consent gaps, and missing non-web controls.

Why it matters: It matters because privacy, IAM, and data teams have to treat identity resolution, consent enforcement, and surface-specific opt-out as linked control functions rather than separate policy tasks.

Context

California privacy enforcement is increasingly testing whether consent and opt-out requirements are wired into product architecture, not just described in policy. The Sling TV settlement is useful because it exposes where privacy programmes break when device identity, profile state, content context, and non-browser surfaces are not connected.

For IAM and privacy practitioners, the interesting point is the identity boundary: if a system can associate a browser, device, or profile for targeting, it must be able to suppress that same linkage for opt-out enforcement. That makes the problem closer to governed identity resolution than to a standard banner-management exercise.

Key questions

Q: What breaks when privacy opt-out depends on login state only?

A: Opt-out breaks when a programme assumes authentication is the only identity boundary. If a platform can still connect a browser, device, or pseudonymous profile to the same person for targeting, the suppression path has to follow that linkage too. Otherwise logged-out users remain targetable even after exercising their privacy rights.

Q: Why do contextual consent controls matter for CCPA compliance?

A: Because the legal meaning of the same user action can change with profile type, content designation, and device context. A consent system that only stores a preference cannot reliably enforce those changing conditions. Privacy teams need rules that evaluate live context before the ad or data-sharing decision happens.

Q: What do marketing teams get wrong about consent management?

A: The most common mistake is treating consent as a banner interaction instead of an enterprise control. If a user changes preference and that change does not reach suppression, activation, and analytics systems, the organisation may continue processing data outside the permitted scope.

Q: How should organisations manage consent across smart TV, mobile, and web channels when users move between devices?

A: Organisations should treat consent as a cross-channel control, not a one-time event tied to a single device. The practical goal is to capture preferences consistently, authenticate the user where needed, and propagate the resulting signal to downstream ad tech and analytics systems. Without that continuity, consent records fragment, transparency drops, and compliance becomes difficult to prove.

Technical breakdown

Identity parity for logged-out users

The settlement treats identity as a capability issue, not an authentication-state issue. If a platform can link a device or browser to a known or pseudonymous profile for targeted advertising, opt-out must operate across that same linkage even when the consumer is not logged in. That means the control surface sits in identity resolution points, not only in account sessions. Privacy engineering therefore has to account for profile association, device identifiers, and third-party ad platform identity graphs as part of the consent path.

Practical implication: Map every place device or profile identity is resolved and ensure opt-out suppression follows the same path.

Contextual consent and rules-based decisioning

The settlement shows that consent is not a single account-level flag. It changes with profile type, content designation, and authentication state, which means a static preference centre cannot carry the whole load. In practice, consent behaves like a rules engine that consumes context signals from the profile service, ad stack, and content metadata. The technical failure pattern is fragmentation: when those systems do not talk at decision time, enforcement becomes inconsistent and hard to audit.

Practical implication: Treat consent as decisioning infrastructure and verify that the ad call sees profile and content context before it acts.

Non-browser opt-out surfaces

Connected TV exposes a common privacy gap because cookie-based tooling has nothing to attach to on devices without a browser. The settlement makes clear that the opt-out mechanism has to live on, or directly lead to, the same surface where device identifiers are used for advertising. That creates a distinct control requirement for apps on TVs, mobile devices, and other connected endpoints: the opt-out must suppress the device advertising identifier in the ad stack, not merely update a settings page. This is a surface-specific identity problem as much as a privacy one.

Practical implication: Inventory every non-browser surface and confirm that opt-out suppresses the relevant device identifier at the point of ad delivery.

NHI Mgmt Group analysis

Consent governance now depends on identity graph governance. The Sling settlement shows that privacy compliance is no longer just about notices and toggles. If a programme can associate a device with a profile for monetisation, it has also created a governance obligation to suppress that association for opt-out enforcement. For identity teams, that is the same class of problem as lifecycle control over access paths: the system must know what it has linked, why it linked it, and how that linkage is revoked.

Contextual consent is the named concept privacy programmes now need to operationalise. Consent varies by logged-in state, profile type, and content classification, so the control is not a single setting but a context-aware decision layer. Static CMPs that only record a preference are insufficient where product state changes the legal meaning of the same user action. Practitioners should treat this as a rules orchestration problem spanning identity, content metadata, and ad delivery.

The compliance gap is not legal ambiguity alone, but disconnected control planes. The settlement reads like a critique of organisations that split identity, adtech, and consent into separate systems that do not resolve together at decision time. That fragmentation creates audit weakness because no single control can prove the opt-out path actually reaches every relevant identifier and surface. The practical conclusion is that governance evidence now has to be generated from live control behaviour, not policy artefacts.

Non-browser channels are becoming the stress test for privacy architecture. Browser-centric thinking fails once the monetised surface is a TV app, mobile app, or connected device. The enforcement logic implies that any surface with its own identifier must have a native or directly connected suppression path. Practitioners should assume regulators will keep moving beyond web-only compliance and will judge privacy programmes by surface coverage, not by banner sophistication.

Identity parity is the failure mode most teams underestimate. The article makes clear that logged-out users can still be in scope if the organisation can recognise them through pseudonymous or device-linked profiles. That collapses the common assumption that authentication is the boundary of privacy duty. Privacy and IAM leaders should align on where identity resolution starts, because that is where opt-out obligation now starts too.

What this signals

Context-aware consent is becoming a control requirement, not a UX preference. Privacy programmes that cannot combine identity state, profile metadata, and content classification at decision time will keep producing blind spots. The practical challenge is to prove that suppression works across the exact surfaces where targeting happens, including connected TV and other non-browser channels.

IAM and privacy teams should align on one question: where does recognised identity become a regulated identity obligation? Once a browser, device, or pseudonymous profile can be linked for advertising, the same linkage must be suppressible for opt-out enforcement. That is an identity governance problem, not only a legal one.

For practitioners

• Map identity resolution points in the ad stack Document every system that links device IDs, pseudonymous profiles, and logged-in accounts for advertising or targeting, then trace where opt-out suppression must occur.
• Test opt-out flows against logged-in and logged-out states Verify that the experience changes based on authentication state and that logged-out users are still suppressed when the system can associate them to a profile.
• Separate children and minors logic from generic preferences Check that profile type and content classification actually drive suppression at ad decision time, rather than only in a settings screen or policy layer.
• Build native suppression for non-browser surfaces Confirm that CTV, mobile, kiosk, and device-based surfaces can suppress the relevant advertising identifier without sending users to a browser-only consent flow.
• Align compliance evidence with live control behaviour Prepare reporting that shows the opt-out path, identity linkage, and contextual suppression logic working together, not just documented in policy.

Key takeaways

• The Sling settlement shows that privacy enforcement now depends on whether identity, consent, and ad delivery are actually connected in the product stack.
• The most important failure pattern is identity parity gaps, where a consumer can be recognised for targeting but not reliably recognised for opt-out suppression.
• Privacy leaders need to audit surface coverage, decision-time context, and suppression behaviour together, because policy alone will not satisfy enforcement expectations.

Key terms

• Identity Parity: Identity parity is the governance approach of managing human users, service accounts, and AI agents under the same access framework. It applies one policy model, one approval path, and one audit trail across all identity types. That reduces exceptions and improves consistency in access control.
• Contextual Consent: Contextual consent is a consent approach that adapts the request to the user’s situation, intent, and preferences. Rather than presenting a generic prompt, it aligns the request with a specific data use and timing. This can improve comprehension, reduce friction, and make permission more meaningful in AI-enabled environments.
• Non-Browser Surface: A non-browser surface is any product interface that processes data outside a web browser, such as connected TV, mobile apps, kiosks, or embedded devices. These surfaces often use different identifiers, so privacy controls must be built to suppress those identifiers directly.
• Rules-Based Decisioning Layer: A rules-based decisioning layer evaluates context from identity, content, and product metadata before taking action. In privacy architecture, this is the mechanism that turns policy into live enforcement rather than leaving compliance to a static settings page or banner.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle controls. It helps security and privacy practitioners connect identity governance to the broader control environment their programmes depend on.