Topic starter
24/10/2026 8:48 pm
TL;DR: Identity parity failures appear when opt-out scope, consent capture, and suppression do not line up across logged-out users, brands, and non-web surfaces, according to Ketch. Privacy controls have to follow the identity graph and the monetisation graph, or a request can succeed in one place while processing continues elsewhere.
Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “The real lessons of the Disney CCPA settlement: a technical guide for privacy leaders”.
Key questions
Q: Why do logged-out users create a harder compliance problem than logged-in users?
A: Logged-out users are harder because the obligation still follows identity resolution, not authentication state.
Q: What are the signs that a privacy programme is not honoring opt-out signals?
A: Common signs include different outcomes for logged-in and logged-out users, opt-outs that apply on one device but not another, and consent logs that show success while outbound tracker traffic keeps flowing.
Q: What breaks when opt-out controls are split across consent, DSR, and ad-tech systems?
A: The programme loses enforcement continuity.
Practitioner guidance
- Audit identity parity across advertising and opt-out scope Identify every point where anonymous, device-level, or pseudonymous signals are linked to a consumer profile, then verify that opt-out logic reaches the same graph.
- Unify consent and DSR enforcement paths Test whether a request captured by the webform actually changes tag firing, partner notification, and downstream suppression in the CMP and adjacent systems.
- Verify cross-brand opt-out propagation Confirm that a consumer choice submitted on one brand or property automatically suppresses selling and sharing across every related property and account context.
Bottom line: The Disney settlement shows that privacy compliance fails when identity resolution, consent capture, and downstream suppression are not governed as one system.
Glossary terms: Identity Parity, Opt-Out Propagation, Connected Surface, Architectural Fragmentation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Identity parity is now a privacy control, not just a legal concept. When a business can resolve a consumer across devices for advertising, that same capability defines the boundary of opt-out enforcement. Privacy programmes that treat logged-in and logged-out users as separate governance classes are already misaligned with how regulators are reading modern identity graphs. Practitioners should treat identity resolution as a policy-bearing control surface, not just a marketing enabler.
A question worth separating out:
Q: How should organisations enforce privacy choices across web, app, and connected TV experiences?
A: They should bind each choice to a persistent identity or profile record and push that state into every downstream system that uses the same consumer data. If consent lives only in the originating interface, it will drift. The control objective is consistent policy execution across all channels, not isolated banner compliance.
👉 Read our full editorial: Disney CCPA settlement exposes identity parity gaps in privacy programs
This post was modified 7 days ago by NHI Mgmt Group