A ruling that changes vendor risk, not just Index Exchange's
On June 16, 2026, Judge Matthew Kennelly of the U.S. District Court for the Northern District of Illinois denied Index Exchange's motion to dismiss in Baker v. Index Exchange. The plaintiff, an Illinois resident, alleged the ad exchange shared IP addresses, cookie IDs, advertising IDs and inferred behavioral data with demand-side partners tied to countries of concern, including China, in violation of the Department of Justice's 2025 Bulk Sensitive Data Rule.
The ruling matters because of the legal theory it let through. Baker argued the alleged Bulk Rule violation triggers the "crime-tort" exception to the Electronic Communications Privacy Act, which would strip Index Exchange of its usual one-party consent defense against a federal wiretap claim. Kennelly allowed that theory to proceed past the motion-to-dismiss stage, per analysis from Womble Bond Dickinson and Morrison Foerster. Neither firm calls this a final win for Baker, but both flag it as the first judicial guidance on whether the Bulk Rule can be used this way, and Womble Bond Dickinson compares the pattern to how VPPA and CIPA claims turned into recurring class-action waves once one case proved the theory viable.
What changes for marketing teams: the exposure here sits in the programmatic supply chain, not the brand's own site. Any team running open-exchange programmatic or working with SSPs and DSPs that route bids through international partners now has a live question to ask: does any downstream bidder or data partner have ties to a country of concern under the Bulk Rule, and does the vendor contract actually disclose where bid-stream data ends up. That question was theoretical before June 16. It is not anymore.
Retail media's attribution windows get a rulebook, with a deadline
Separately, IAB Europe published version 2.1 of its Commerce Media Measurement Standards in May 2026, following a public comment period that ran from September to November 2025. The update sets a standard lookback window and iROAS definition for retail media attribution and calls for consistent day-level granularity even where retailers' attribution windows differ, so results can be reconciled across networks.
The standard carries a real deadline. Retailers and ad tech partners can certify under either V1 or V2 through a grace period running to the end of July 2026, after which only V2 certification is issued.
What changes for marketing teams: any brand running retail media across more than one network has been comparing iROAS numbers that were not necessarily built on the same lookback window. Ask each retail media partner which version they certify under today and when they move to V2. Reported results from a partner still on V1 after August are not comparable to one already on V2, and a team that does not know which version it is looking at will make budget calls on numbers that cannot be reconciled.
What to watch next
The next event that will tell marketing teams how seriously to take the Index Exchange ruling is whether Baker's counsel files, or other plaintiffs' firms follow, additional Bulk Rule-based ECPA suits against other exchanges before the case reaches summary judgment. On the measurement side, the July 31, 2026 end of the IAB Europe V1/V2 grace period is a fixed date: any retail media partner not yet certified under V2 by then is a data-quality flag, not a compliance one.
Sources: Womble Bond Dickinson: Increasing Risks for the Advertising Ecosystem · Morrison Foerster: Federal Court Greenlights Use of the DOJ Bulk Sensitive Data Regulations · Bloomberg Law: Index Exchange Must Face Wiretap Claim Over China Data Transfer · IAB Europe: Commerce (Incl. Retail) Media Measurement Standards V2.1