The Google ad tech remedy is about competition, but it runs through the bidstream

What the court ordered

Google will not have to sell its ad exchange. On 2 September 2026, Judge Leonie Brinkema of the U.S. District Court for the Eastern District of Virginia issued the remedies decision in United States v. Google LLC (No. 1:23-cv-00108), the ad tech monopolisation case brought by the Department of Justice and a group of states. It follows her April 2025 liability ruling that Google unlawfully monopolised the publisher ad server and ad exchange markets for open-web display advertising, and unlawfully tied its exchange (AdX) to its publisher ad server (DFP).

The court rejected the government’s structural remedies, including divestiture of AdX and open-sourcing DFP’s final auction logic. It accepted behavioural remedies instead. The full 106-page opinion was unsealed on 16 September 2026.

Based on the unsealed opinion and reporting on it, the main obligations run for six years and apply worldwide. Google must build integrations between AdX and Prebid, the open-source header bidding framework, and between DFP and Prebid. AdX must submit real-time bids to rival publisher ad servers on the same terms it gives DFP. Publishers must be able to access and export their own data from DFP and AdX. Google’s advertiser tools cannot bid preferentially into AdX or other Google ad tech because of common ownership. A court-appointed monitor oversees compliance.

The parties were due to file a proposed final judgment by 2 October 2026, and reporting indicates the remedies take effect 60 days after the court enters it. Google has said it will appeal the underlying liability finding.

Why a privacy team should care

This is an antitrust order. It is not a ruling on lawful basis, consent or data protection, and it does not purport to be one. But the system it restructures, real-time bidding (RTB), has been under privacy scrutiny in Europe for years.

A bid request can carry a device or cookie identifier, location data and signals about the page and the user, sent to many prospective buyers in milliseconds. In June 2019, the UK Information Commissioner’s Office reported that the RTB ecosystem raised serious concerns under data protection law, including the volume of personal data shared with many parties and the processing of special category data without explicit consent.

In February 2022, Belgium’s data protection authority (APD) found that IAB Europe’s Transparency and Consent Framework (TCF), the standard that encodes a user’s consent choices into a “TC String” passed along with bid requests, infringed the GDPR, and fined IAB Europe €250,000. Litigation since then has narrowed IAB Europe’s role rather than cleared the bidstream. In May 2025, the Belgian Market Court held that IAB Europe is a joint controller for TC String processing but not for the downstream advertising processing that relies on it. In January 2026, the same court annulled the APD’s 2023 validation of IAB Europe’s TCF action plan, finding it rested on that broader view of controllership and was adopted without hearing IAB Europe. The APD must now reassess. The question of whether RTB consent signalling meets the GDPR has not gone away.

The seam to watch

The remedy multiplies connection points. AdX demand will flow through Prebid and into rival ad servers, alongside the routes that exist today. Each new integration is another hop that a bid request, and the consent signal attached to it, has to survive.

The public accounts of the remedies we have reviewed do not address how consent signals should travel across these new integrations. That is not a criticism of an antitrust court. It means the answer will come from the engineering of each integration and from existing frameworks, not from the decree. Publishers whose traffic includes visitors under opt-in regimes such as the GDPR or the DPDPA will want to confirm that consent state is passed and honoured on every new path before it goes live.

The working principle is the same as before the ruling. A bid request should leave the page only if the visitor’s consent covers it, and the publisher should be able to show which parties were inside that consent at the moment it was given. CookieGate records every consent decision in a tamper-evident ledger for that reason. More routes into the auction make that evidence trail more valuable, not less.

Sources

• U.S. Department of Justice, Department of Justice Again Wins Substantial Relief Against Google (16 September 2026) justice.gov
• AdExchanger, The Court Just Unsealed Judge Brinkema’s Remedies Decision In The Google Ad Tech Antitrust Case adexchanger.com
• PPC Land, Google faces six-year worldwide ad tech decree instead of AdX sale ppc.land
• Tech Policy Law, Judge Unseals Full Google Ad Tech Remedies techpolicylaw.org
• IAB Europe, IAB Europe Wins Appeal Against APD Decision on TCF Corrective Measures (January 2026) iabeurope.eu
• Information Commissioner’s Office, Update report into adtech and real time bidding (June 2019)
• Belgian Data Protection Authority, decision on IAB Europe and the TCF (2 February 2022)