[Aerroon]

But the publisher and advertiser might not know where the data came from. The broker could easily just say "oh yeah, we have permission from these people to share this data".

I'm sure some of them will get caught, but how long will that take?

[MereInterest]

A free-market solution would be to establish strict liability for the publishers and advertisers, regardless of intent. Establishing liability creates an incentive to manage the risk, and therefore establishes an insurance market. The insurance companies would gather additional information in order to price the insurance accordingly, including audits of the data brokers and determining risk factors of each data broker. Doing business with a disreputable data broker would then lead to higher insurance premiums. While this cost would larger be passed through to the purchaser (the companies purchasing adtime), the cost would be lower for advertisers that deal only with reputable data brokers and follow best practice, thus having a market advantage for well-behaved advertisers.

Granted, this relies on several levels of the efficient market hypothesis. At some point, it is more efficient to ban poor behavior than to introduce 3rd-order effects that slightly discourage poor behavior.

[lucb1e]

If you buy a stolen bike and could reasonably have known that it was not obtained with consent, you're also liable. For example, an unusually low price from someone who doesn't own a bike shop and wants cash can be indicators for that. In the case of data, it may be that they are able to provide lots of data without plausible source.

[Aerroon]

Sure, you might be liable, but do you think that in practice this will matter? It's not like it's somehow obvious that an advertising company has data on you that they shouldn't have. Somebody needs to actually suspect that for any investigation to happen.

[lucb1e]

I find it hard to say without a specific example, but I'm afraid that you might very well be right in the general case.