10 Ways to Draft Marketing and Advertising Data Provisions in AI Deals: Practice Points

Map the data flow before you look at the AI. Avi reminded us that machine learning has powered digital advertising for well over a decade, so the AI layer rarely replaces the core analysis. Start with the use case, the type of data, where it flows, and who receives it. Then work out which privacy laws apply and what the AI actually changes about that picture. Kim called an unclear data flow the biggest mistake she sees, and you can't control data you can't trace.

Spell out each party's role in the contract. Many state privacy laws require specific contract terms before a vendor counts as a service provider or processor. Kim wanted the agreement to say clearly what role the provider plays and what it will do with the data. Avi warned that the required terms alone don't settle the question. As he put it, it's not abracadabra and you're a service provider. The provider's actual use of the data has to match the label.

Start from the assumption that nobody wants you using their data. Kim offered providers this framing as the most useful place to begin. Every customer's first instinct is "don't use my data," even though the provider has to use it to deliver the service. Draft around how you use the data to perform the service rather than how you take it. Customers agree faster to rights they can see are tied to their own campaigns.

Look closely at training and improvement rights. Provider terms often let the vendor use customer data, or the outputs built from it, to improve its services or train models. Avi asked the key question, which was improvement for whom. Broad rights like these can reach beyond what your consumer-facing privacy policy discloses and draw FTC attention. Limit use to providing the services to you, and say whether any improvement can benefit other customers.

Protect the value of your data along with your compliance. Avi reviews provider terms with two interests in mind. The first is the legal question of what could put the company in breach. The second, which matters as much or more to many clients, is how the provider's use might dilute the value of the company's proprietary data. Limit combination with other clients' data or data broker data to what the services need, and prohibit cross-customer uses you haven't approved.

Write sensitive data definitions that cover every law you face. A definition tied to a single state law misses other states' definitions, health data laws, and the Video Privacy Protection Act. Avi suggested covering sensitive personal information, sensitive data, or consumer health data as defined under any applicable privacy law. Kim preferred listing the specific sensitive categories in an exhibit based on the states in play. Either way, track how the defined term works throughout the agreement and not just where it first appears.

Treat inferences from customer data as sensitive data too. AI tools are very good at inferring health conditions, religion, or sexual orientation from purchase and browsing data. That sensitive information was never in the customer data. It shows up in the outputs, which often fall outside the definition of customer data. Some state rules treat those inferences as sensitive data, so the agreement should say whether derived sensitive data carries the same restrictions.

Use defined statutory terms for sale, sharing, and personal information. A clause that bars only the sale of data still lets a provider share it for cross-context behavioral advertising. An undefined term like customer personal information invites the argument that hashed emails, mobile advertising IDs, or cookie identifiers fall outside it. California generally treats those identifiers as personal information. Use the statutory definitions and leave no room for weasel language.

Plan for consent that changes after signing. A customer's representation that it obtained all necessary consents speaks to one moment in time. Kim pointed out that consumers withdraw consent, opt out, and ask for deletion long after the contract is signed. The agreement should say how opt-outs and deletion requests reach the provider, how the provider applies them, and how they flow to downstream recipients. Be realistic about when deletion can actually happen inside an AI system.

Confirm whose AI is actually doing the work. Avi said most companies calling themselves AI companies aren't. Many are white labeling someone else's model and marketing it as their own. When that happens, your data isn't just moving between you and the vendor. Ask which model provider sits behind the service and make sure your data can't be used to train it.