Increasing Risks for the Advertising Ecosystem: Lawsuits Relying on the Bulk Data Transfer Rule Gain Traction

On June 16, 2026, Judge Matthew Kennelly of the U.S. District Court for the Northern District of Illinois denied a motion to dismiss in Baker v. Index Exch. Inc. This case was one of many filed in late 2025 and early 2026 that used the Department of Justice’s 2025 Bulk Sensitive Data Rule to invoke a “crime-tort” theory under the Electronic Communications Privacy Act (ECPA). Judge Kennelly’s ruling allows that theory to proceed, at least for now.

The legal issues underlying the decision are complicated, but, given the initial success of the theory raised in Baker, there is a serious risk that this type of claim will be used to create the next cottage industry of lawsuits, similar to the waves of lawsuits brought under statutes like the Video Privacy Protection Act (VPPA) and the California Information Privacy Act (CIPA). We are also following two similar cases in California federal court that currently have motions to dismiss pending.

Ways to Minimize Risk

In light of the Baker decision, and based on the more detailed analysis below, organizations should consider steps to mitigate the risk of an ECPA enforcement barrage by private plaintiffs. For example, organizations should consider:

• Data mapping to identify potential cross-border data sharing of DOJ Bulk Transfer Rule sensitive data; 
• Reviewing relationships with partner companies (such as demand-side partners or “DSPs”, data integration partners or cookie syncing partners) to determine if those companies have ties to countries of concern: China, Cuba, Iran, North Korea, Russia, and Venezuela;
• Revisit DOJ Bulk Data Transfer applicability and, where applicable, ensure any transfer of data with a potential DOJ Bulk Transfer Rule covered person is a vendor relationship instead of a data brokerage; and
• Updating language in applicable policies and disclosures to ensure that consent has been obtained.

Interaction Between ECPA and the Bulk Rule

The ECPA (commonly referred to as the federal wiretap law) creates a private cause of action for any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in a way that violates the statute. Generally, such an action would be subject to the defense that at least one party to the communication consented to the communication’s interception. Pursuant to the ECPA’s crime-tort exception, however, both parties to a communication must consent to the interception if the communication is intercepted for the purpose of committing any criminal or tortious act in violation of any federal or state law. 

Enter the Bulk Rule. In 2025, the DOJ enacted regulations that prohibit companies from entering into “data brokerage” transactions with “covered persons.”¹  Broadly speaking, a “data brokerage” transaction is a commercial transaction involving the transfer of U.S. government-related data or bulk U.S. sensitive personal data to a recipient who did not collect or process the data directly from the parties whose data is being transferred. And a “covered person” includes an entity that is 50% or more owned, directly or indirectly, individually or in the aggregate, by one or more countries of concern—i.e., China, Cuba, Iran, North Korea, Russia, and Venezuela.

Thus, for example, the Bulk Rule might be implicated in the following situations:

1. As part of selling advertising space, a U.S. company provides IP addresses and advertising IDs of more than 100,000 U.S. users’ devices to an advertising exchange based in a country of concern.
2. A U.S. company’s mobile app or website contains one or more tracking pixels or software development kits (SDKs) that were knowingly installed or approved by the U.S. company. The pixels or SDKs transfer or otherwise provide access to Sensitive Data to a country of concern or a covered-person-owned social media app for targeted advertising.
3. A non-U.S. company is contracted to develop a mobile app for a U.S. company. In developing the app, the non-U.S. company knowingly incorporates tracking pixels or SDKs into the mobile app that transfer or otherwise provide access to Sensitive Data to a country of concern or covered person for targeted advertising, at the request of the U.S. company.

The Baker Case

Baker was one of the first cases to bring a claim arguing that the transfer of personal data to countries of concern, such as China, violated the Bulk Rule and thus triggered the ECPA’s crime-tort exception to the single-party consent defense.

According to the lawsuit, Index Exchange shared data with its demand-side partners, including companies like Temu with ties to countries of concern, that included details and identifiers unique to users, such as IP address, cookie data, and advertising IDs. This data also included inferred information about the user’s device, location, demographics, interests, browsing behavior, and content the user was viewing. The plaintiff further alleged that Index Exchange maintained data integrations, used various processes (including cookie syncing) to identify and track users, and matched data against identifiers for cross-platform tracking. 

The defendants moved to dismiss, arguing that:

1. The crime-tort exception did not apply because the Bulk Rule did not apply to the primary defendant as a Canadian entity, and 
2. The plaintiff had not sufficiently alleged that Temu was a “covered person” under the Bulk Rule.

The court disagreed, explaining that the alleged data transfer was facilitated through the action of the defendant’s U.S.-based employees, who were subject to the Bulk Rule, and the foreign company could be subject to vicarious liability for the actions of those U.S.-based employees. The court also concluded that Temu’s status as an alleged “covered person” was a fact-based issue and that the plaintiff had pleaded enough to support the “covered person” contention. As a result, the Court denied the motion to dismiss, thus allowing the case to proceed toward discovery and trial.

If you have any questions about the issues raised in this alert, please contact the authors or the Womble Bond Dickinson attorneys with whom you normally work. Also, click here to read our prior article on the DOJ Bulk Transfer Rule.

¹ The regulations were issued pursuant to Executive Order No. 14117, based on the President’s powers under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701.