[jeffparsons]

Solution #2 modified to be safer:

> Solution: Store A HASH OF the phone number - so those kinds of misuse can be detected.

If you don't need to store PII verbatim, don't store it verbatim.

> Who is to blame here? The Ads team that didn't check if the number can be used?

Yes. 100% yes. It's insane that we've normalized the idea that if you can physically get your hands on some data then that means you're allowed to do whatever you want with it. Anyone even remotely responsible working in advertising should be tracking provenance of the data they're using. I've heard all sorts of excuses about why this isn't practical, but with each year that passes I find them less convincing, and I've finally reached the point where I reject those excuses outright. If you don't _know_ you're allowed to use some PII for marketing, then you _can not_ use it for marketing. It's that simple.