[j1elo]

The person or team who gave green light to storing phone numbers without giving the data appropriate access controls and protections to avoid it being used for anything that is not strictly related with security and fraud control. A system such that if the Ads team tried to access it, they would get an access denied error, or maybe a red alert warning stating that this field cannot be used for marketing operations.

If a system to provide such protections didn't exist, then that system should have been implemented before agreeing on collecting phone numbers. Again, whoever didn't have that insight, should be the one to blame.

(all this is just wishful thinking on my part, of course)