third-party-data-sharing-risk-assessment.docx

1038-00010 · Cascade Retail Holdings · Assessment & Gap Analysis

third-party-data-sharing-risk-assessment.docx DOCUMENT Finance & Banking

7 / 38 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP MEMORANDUM

FROM: Alan Burke, Senior Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP

TO: Kevin Ostrowski, Partner, Privacy & Data Security Practice Group, Calderwood & Harkness LLP

DATE: August 4, 2025

RE: Third-Party Data-Sharing Risk Assessment — Cascade Retail Holdings Inc. (Matter No. 1038-00010)

CC: Rachel Bernstein, Partner, Calderwood & Harkness LLP; Sara Hendricks, Associate, Calderwood & Harkness LLP

Right-click to update Table of Contents

I. Executive Summary

This memorandum presents the results of our assessment of the compliance posture of Cascade Retail Holdings Inc. ("Cascade" or the "Company") with respect to its data-sharing relationships with the forty-seven (47) third-party advertising and analytics partners identified in the data-mapping report delivered by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Data-Mapping Report"). The purpose of this assessment is to identify, classify, and prioritize the legal risks associated with these data-sharing arrangements under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the eighteen (18) other state privacy statutes applicable to Cascade's operations (collectively, the nineteen (19) "Applicable State Statutes").

Our core findings are as follows:

• Twenty-three (23) of the forty-seven (47) partners lack an executed data-processing agreement ("DPA") of any kind. In the absence of a compliant written contract, each of these partners defaults to "third-party" status under the CCPA/CPRA, and data transfers to these partners likely constitute a "sale" or "sharing" of personal information ("PI") for which consumers must be afforded opt-out rights that Cascade is not currently providing.

• An additional twelve (12) partners have some form of contractual arrangement (e.g., media insertion orders, platform terms of service) that does not include the CCPA/CPRA-mandated service-provider or contractor restrictions. Data transfers to these partners also likely constitute "sale" or "sharing."

• In total, thirty-five (35) of the forty-seven (47) data-sharing relationships likely constitute "sale" or "sharing" under the CCPA/CPRA and equivalent concepts (e.g., targeted advertising, sale of personal data) under many of the other Applicable State Statutes.

• The highest-priority relationship is with Thornbridge Media Corp. ("Thornbridge"). Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner, with FY2024 spend of approximately $18.4 million. The Thornbridge relationship involves the exchange of large volumes of consumer behavioral data, including precise geolocation data classified as sensitive personal information under the CCPA/CPRA. There is no executed DPA, consumer opt-out-of-sale/sharing requests are not currently communicated to Thornbridge, and Thornbridge commingles Cascade consumer data with data from its other advertising clients.

Based on these findings, we recommend:

1. Classification of each partner under each Applicable State Statute as a service provider/processor, contractor, or third party, and identification of each data transfer that constitutes a "sale," "sharing," or "targeted advertising" requiring consumer opt-out rights;

2. Prioritized DPA rollout to all thirty-five (35) partners lacking compliant agreements, using standardized service-provider and contractor DPA templates with partner-specific schedules, on the timeline set forth in Section VIII below;

3. Immediate restructuring of the Thornbridge arrangement, including negotiation of a bespoke data-sharing agreement with appropriate CCPA/CPRA compliance provisions, with a target execution date of October 31, 2025; and

4. Implementation of opt-out-of-sale/sharing mechanisms, including real-time honoring of Global Privacy Control ("GPC") signals and propagation of opt-out signals to all forty-seven (47) partners, in coordination with the OnPoint Data Solutions Inc. ("OnPoint") consent-management platform ("CMP") deployment targeted for December 15, 2025.

This memorandum should be read in conjunction with the Comprehensive Gap-Analysis Report dated August 15, 2025 (forthcoming), and the Data-Mapping Review Memorandum dated July 14, 2025, both prepared by this firm in connection with the broader privacy-compliance program.

II. Background

A. Cascade's Data-Sharing Ecosystem

Cascade Retail Holdings Inc. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol "CSRD," with its principal executive offices located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is an omnichannel retailer with FY2024 revenues of approximately $3.87 billion. The Company operates one hundred eighty-six (186) brick-and-mortar retail locations across thirty-one (31) U.S. states and fulfills e-commerce orders to consumers in all fifty (50) states and the District of Columbia. These operations generate an extensive footprint of consumer data collection and processing, the scope and complexity of which are central to the risks addressed in this memorandum.

Cascade's data-sharing ecosystem is supported by three key subsidiaries, each of which plays a distinct role in the collection, processing, and dissemination of consumer personal information:

Peakview Analytics Inc. Peakview Analytics Inc. ("Peakview") is a Delaware corporation (EIN 87-2250194) and Cascade's in-house advertising technology and customer analytics unit. Peakview processes approximately 2.1 billion consumer-event data records per month. These records encompass a broad range of consumer interactions—including online browsing sessions, purchase transactions, mobile-app engagement events, and loyalty-program activity—and are used for purposes including ad targeting, audience segmentation, personalization, and attribution analytics. Peakview is the primary engine through which consumer data is compiled, enriched, and transmitted to third-party advertising and analytics partners. The scale of Peakview's processing operations is a significant factor in the risk analysis set forth in this memorandum: errors or gaps in data-governance controls at Peakview have a multiplicative effect on the volume of personal information exposed to non-compliant data-sharing arrangements.

Cascade Digital Marketplace LLC. Cascade Digital Marketplace LLC ("CDM") is a Delaware limited liability company (EIN 85-4107638) that operates the third-party seller marketplace accessible at cascade.com/marketplace. CDM hosts approximately 3,800 third-party sellers and processes transaction, product listing, and seller-account data. As discussed in Section II.B below, a critical finding of the Fieldhaven Data-Mapping Report is that CDM seller data is commingled with first-party customer data in a single data lake, raising the risk that data feeds transmitted to advertising partners contain marketplace-seller personal information in addition to consumer personal information.

Cascade Rewards Corp. Cascade Rewards Corp. is a Delaware corporation (EIN 86-3381729) that operates the Cascade Rewards loyalty program. The loyalty program has approximately 41.2 million registered members, making it one of the Company's most significant repositories of identifiable consumer data. Loyalty-program data—including member identifiers, purchase history, reward redemption activity, and preference information—is integrated with Peakview's analytics platform and is among the categories of personal information shared with third-party advertising partners.

The Company's digital properties deploy twelve (12) categories of cookies and tracking technologies on its primary website, cascade.com, and its mobile applications. These technologies include first-party analytics cookies, third-party advertising pixels and tags, session-management cookies, geolocation services, and device-fingerprinting scripts, among others. The breadth and range of tracking technologies deployed is directly relevant to the data-sharing risk assessment because many of the forty-seven (47) identified partner relationships originate from or are facilitated by pixel/tag integrations that automatically transmit consumer data to third-party servers upon page load or user interaction.

In FY2024, Cascade processed approximately 94 million online transactions. The Company received approximately 38,400 data-subject requests ("DSRs") during the same period, comprising approximately 12,800 access requests, approximately 19,100 deletion requests, and approximately 6,500 requests to opt out of the sale or sharing of personal information. The volume and composition of these DSRs are relevant to the partner-compliance analysis because, as discussed in Sections V and IX below, Cascade does not currently have mechanisms in place to forward opt-out-of-sale/sharing, deletion, or access requests to the majority of its third-party advertising and analytics partners.

B. Fieldhaven Data-Mapping Findings

Fieldhaven Consulting Group LLC is a Delaware limited liability company with offices at 350 Sansome Street, Suite 400, San Francisco, California 94104. Fieldhaven was engaged by Cascade, under the direction of this firm, to conduct a comprehensive data-mapping exercise covering the Company's consumer-data processing activities. The engagement was led by Marcus Ellerby, a principal at Fieldhaven with extensive experience in privacy-program data mapping for large retailers.

Fieldhaven delivered its Data-Mapping Report on May 19, 2025. The report identified forty-seven (47) third-party advertising and analytics partners receiving consumer personal information from Cascade. This total encompasses partners that receive data through any channel, including pixel/tag integrations on cascade.com and the Cascade mobile app, server-to-server batch transfers from Peakview Analytics, audience-segment uploads to demand-side platforms ("DSPs"), and real-time bidding ("RTB") integrations.

The categories of personal information shared with these partners, as documented in the Fieldhaven report, include:

• Identifiers: Consumer name, email address, mailing address, phone number, hashed identifiers (e.g., hashed email addresses used for audience matching), and internal account identifiers.

• Commercial Information: Purchase history (including product categories, transaction amounts, and purchase frequency), browsing behavior (products viewed, categories browsed, time on page), shopping-cart data, and wishlist/save-for-later data.

• Internet and Network Activity Information: Click-stream data, session identifiers, referring URLs, search queries, device fingerprints, browser type and version, operating system, IP addresses, and cookie identifiers.

• Precise Geolocation Data: Location data collected from the Cascade mobile application with granularity sufficient to identify a consumer's location within a radius of 1,850 feet or less—constituting "precise geolocation" under CCPA/CPRA § 1798.140(ae) and meeting the sensitivity threshold for sensitive personal information under § 1798.140(ae) and § 1798.121.

• Inferences: Purchase-propensity scores, predicted product-category affinities, churn-risk scores, audience segments (e.g., "high-value home décor shopper," "frequent electronics buyer"), and lookalike modeling outputs, all generated by Peakview Analytics.

The Fieldhaven report documented four primary channels through which these data flows occur:

(a) Pixel/Tag Firing: JavaScript pixels and tracking tags deployed on cascade.com and the Cascade mobile app transmit consumer interaction data directly to third-party partner servers at the time of page load or user interaction. This is the most common mechanism and accounts for data sharing with the majority of the forty-seven partners.

(b) Server-to-Server Batch Transfers: Peakview Analytics transmits bulk data files to partner servers on a scheduled basis (typically daily or weekly), containing aggregated consumer-event data, audience segments, and enriched analytics outputs.

(c) Audience-Segment Uploads: Peakview compiles audience segments based on consumer behavioral and transactional data and uploads these segments to DSPs and advertising platforms for use in programmatic ad targeting.

(d) Real-Time Bidding Integrations: Cascade participates in RTB ecosystems in which consumer data (including device identifiers, behavioral signals, and audience-segment memberships) is transmitted to ad exchanges and bidding platforms in real time as part of the ad-auction process.

A critical finding of the Fieldhaven report—one with significant implications for the risk assessment in this memorandum—is that third-party marketplace seller data originating from CDM is commingled with first-party customer data in a single data lake hosted by Cascade's cloud infrastructure. This data lake is the primary source from which Peakview Analytics draws consumer data for processing and transmission to partners. The absence of role-based access controls or logical segregation between customer data and seller data means that partner data feeds may contain seller personal information in addition to consumer personal information. Seller personal information has a different processing basis and different consent profiles from consumer personal information, and its inadvertent inclusion in advertising-partner data feeds creates additional compliance exposure. This issue is discussed further in Section IX.D below.

C. Regulatory History Relevant to Data Sharing

Cascade has been the subject of regulatory attention relevant to its data-sharing practices, and this regulatory history informs both the urgency and the specific focus areas of the risk assessment.

California Attorney General Informal Inquiry (February 2024). On February 6, 2024, the California Attorney General's office sent an informal inquiry letter to Cascade's General Counsel raising specific concerns about deficiencies in (i) the placement, functionality, and labeling of the "Do Not Sell or Share My Personal Information" link on cascade.com, and (ii) the adequacy of Cascade's service-provider agreements with advertising and analytics partners. Cascade provided a written response on March 8, 2024, describing planned remediation steps. No formal enforcement action has been initiated as of the date of this memorandum. However, the deficiencies identified in the inquiry letter remain substantially unresolved—the "Do Not Sell" link has not been redesigned, the identified service-provider agreement gaps have not been addressed, and no DPAs have been executed with the partners flagged in the inquiry. The Thornbridge relationship, as Cascade's largest advertising-partner arrangement, is directly implicated by the AG's concerns regarding service-provider agreements.

FTC Civil Investigative Demand (September 2023). On September 14, 2023, the Federal Trade Commission issued a Civil Investigative Demand ("CID") to Cascade under File No. 232-0147, regarding allegations of dark patterns in the mobile-app unsubscribe flow. The CID sought documents and information relating to the design and implementation of the app's notification and data-collection opt-out interfaces. The matter was closed on April 3, 2024, with no enforcement action taken. Although the CID did not directly address third-party data sharing, it underscores the heightened regulatory scrutiny directed at Cascade's consumer-facing data practices and the need for the Company to demonstrate proactive compliance across its data-governance program.

Privacy Policy Deficiencies. Cascade's current online privacy policy was last updated in March 2022. This privacy policy does not accurately describe the Company's data-sharing arrangements with third-party advertising and analytics partners. Specifically, the policy does not disclose the categories of personal information sold or shared, does not identify the categories of third parties to whom personal information is sold or shared, and does not describe the consumer's right to opt out of sale or sharing in a manner consistent with the CCPA/CPRA or other Applicable State Statutes. Furthermore, the privacy policy does not address fourteen (14) of the nineteen (19) Applicable State Statutes, including the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and others. The privacy-policy update is being addressed as a separate workstream and is targeted for completion by September 12, 2025. See Section IX.A below.

III. Legal Framework: "Sale," "Sharing," and Partner Classification

This section sets forth the legal framework for classifying Cascade's data-sharing relationships under the CCPA/CPRA and the other Applicable State Statutes. The classification of each partner—as a service provider, contractor, or third party—determines the legal obligations that attach to the data transfer, including whether the transfer constitutes a "sale" or "sharing" requiring consumer opt-out rights.

A. CCPA/CPRA Definitions

The CCPA/CPRA establishes a definitional framework that is critical to the classification analysis:

"Sale." Under California Civil Code § 1798.140(ad), a "sale" is defined as "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration." This definition is notably broad: it encompasses not only traditional monetary transactions but any transfer of personal information in exchange for "other valuable consideration," which has been interpreted by the California Attorney General and the California Privacy Protection Agency ("CPPA") to include the receipt of services, data enrichment, reduced rates, or other non-monetary benefits. A business that "sells" personal information must provide consumers with the right to opt out of such sale under § 1798.120.

"Sharing." Under California Civil Code § 1798.140(ah), "sharing" is defined as "sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged." The concept of "sharing" was introduced by the CPRA to close a perceived gap in the original CCPA's "sale" definition: even where a business does not receive any consideration in exchange for making personal information available to an advertising partner, the transfer constitutes "sharing" if the data is used for cross-context behavioral advertising. The right to opt out of "sharing" under § 1798.120 is coextensive with the right to opt out of "sale."

"Service Provider." Under California Civil Code § 1798.140(ag), a "service provider" is defined as a legal entity that processes personal information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the service provider from (i) selling or sharing the personal information, (ii) retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, (iii) retaining, using, or disclosing the personal information outside of the direct business relationship between the service provider and the business, and (iv) combining the personal information received from the business with personal information received from another source or collected from the service provider's own interactions with the consumer, except as permitted by the statute. Critically, service-provider status requires both the written contract and operational compliance with the contract's restrictions. Data transfers to a qualified service provider do not constitute a "sale" or "sharing" of personal information.

"Contractor." Under California Civil Code § 1798.140(j), a "contractor" is a legal entity to which the business makes a consumer's personal information available and that processes such personal information on behalf of the business pursuant to a written contract that includes heightened restrictions. The contractor framework was introduced by the CPRA and imposes additional requirements beyond those applicable to service providers, including a prohibition on combining the personal information received from the business with personal information from other sources (subject to limited exceptions), and a requirement that the contractor certify that it understands and will comply with the contract's restrictions. Data transfers to a qualified contractor do not constitute a "sale" or "sharing."

"Third Party." Under California Civil Code § 1798.140(ai), a "third party" is defined as a person or entity that is not (i) the business with which the consumer intentionally interacts, (ii) a service provider, or (iii) a contractor. This is a residual category: any entity receiving personal information from Cascade that does not qualify as a service provider or contractor is, by default, a third party. Transfers of personal information to a third party constitute a "sale" (if for monetary or other valuable consideration) or "sharing" (if for cross-context behavioral advertising), unless a specific statutory exception applies.

The consequence of these definitions for Cascade's partner relationships is straightforward but significant: in the absence of a compliant written contract containing the required service-provider or contractor restrictions, a data-sharing partner cannot qualify as a service provider or contractor and defaults to third-party status. All transfers of personal information to such a partner will constitute a "sale" or "sharing" from which consumers have the right to opt out.

B. Multi-State Equivalents

In addition to the CCPA/CPRA, Cascade's data-sharing practices are subject to eighteen (18) other state privacy statutes that have been enacted and are in effect or will take effect during the relevant compliance period. These statutes collectively apply to Cascade because the Company's e-commerce operations serve consumers in all fifty states, and several of the statutes have applicability thresholds (based on data volume and/or revenue) that Cascade exceeds. The following summarizes the key classifications and concepts under each Applicable State Statute:

Most of these statutes employ a controller/processor framework that is conceptually similar to, though not identical with, the CCPA/CPRA's business/service-provider/contractor model. Under the controller/processor model, a "controller" is the entity that determines the purposes and means of processing personal data (analogous to a CCPA "business"), and a "processor" is an entity that processes personal data on behalf of a controller pursuant to a contract (analogous to a CCPA "service provider"). All of these statutes require that controller-processor relationships be governed by written data-processing agreements specifying the processor's obligations, including instructions for processing, confidentiality, sub-processor management, data deletion or return, and audit rights.

The definition of "sale" varies among the Applicable State Statutes. Some statutes, such as the VCDPA (Virginia), define "sale" narrowly to require monetary consideration, while others, such as the CPA (Colorado), CTDPA (Connecticut), and OCPA (Oregon), define "sale" more broadly to include the exchange of personal data for monetary or "other valuable consideration," aligning more closely with the CCPA/CPRA approach.

The concept of "targeted advertising" appears across most Applicable State Statutes and is functionally equivalent to the CCPA/CPRA concept of "sharing" for cross-context behavioral advertising. States requiring a consumer opt-out of targeted advertising include Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Kentucky, and others. The requirement to provide a targeted-advertising opt-out means that even where a data transfer does not technically constitute a "sale" under a particular state's narrower definition, it may still require an opt-out mechanism if the data is used for targeted advertising.

Several Applicable State Statutes require controllers to honor universal opt-out mechanisms, including GPC signals. California's CPRA regulations (11 CCR § 7025) mandate that businesses treat a GPC signal as a valid request to opt out of the sale and sharing of personal information. Colorado, Connecticut, Texas, Montana, and other states have adopted or are implementing similar requirements. As discussed throughout this memorandum, Cascade does not currently honor GPC signals, which constitutes a compliance gap affecting all forty-seven partner relationships.

The following table summarizes the key definitions and requirements under each of the nineteen Applicable State Statutes:

The multi-state landscape reinforces the urgency of the DPA rollout and opt-out implementation. A partner that qualifies as a service provider under the CCPA/CPRA will generally also qualify as a processor under the other Applicable State Statutes, which simplifies the contracting approach: the DPA templates being developed by this firm (target finalization: September 30, 2025) are designed to satisfy the requirements of all nineteen statutes simultaneously.

C. Key Analytical Principles

Drawing together the statutory definitions and regulatory guidance, the following principles have guided our classification analysis of Cascade's forty-seven partner relationships:

First, the receipt of any valuable consideration by Cascade—whether monetary or non-monetary—in exchange for making consumer personal information available to a partner triggers the "sale" classification under the CCPA/CPRA and under those state statutes that include "other valuable consideration" in their sale definitions. Valuable consideration includes, but is not limited to, free analytics services, reduced-rate advertising, enriched audience data returned to Cascade, performance reporting, and attribution analytics. Many of Cascade's advertising-partner arrangements involve a reciprocal exchange of value: Cascade provides consumer data, and the partner provides analytics, audience enrichment, or discounted media placement in return. These arrangements satisfy the "other valuable consideration" element.

Second, the use of Cascade consumer data for cross-context behavioral advertising by a partner constitutes "sharing" under CCPA/CPRA regardless of whether monetary or other valuable consideration is exchanged. The concept of "cross-context behavioral advertising" encompasses the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded websites, applications, or services other than the business with which the consumer intentionally interacted. This is the core function of programmatic advertising and audience targeting, and it describes the fundamental purpose of Cascade's relationships with the majority of its advertising partners.

Third, the absence of a compliant written contract containing the mandatory service-provider or contractor restrictions means that the partner cannot qualify as a service provider or contractor under the CCPA/CPRA, and cannot qualify as a processor under the other Applicable State Statutes. The partner defaults to third-party status, and all data transfers to the partner are subject to the sale/sharing opt-out requirements. This principle is particularly significant for the twenty-three (23) partners that lack any executed data-processing agreement.

Fourth, the commingling of Cascade data with a partner's own data or with data received from other businesses is inconsistent with service-provider or contractor status. The CCPA/CPRA's service-provider restrictions expressly prohibit combining personal information received from one business with personal information received from another source (except as permitted by statute). Where a partner commingles Cascade data with data from other clients—as is the case with Thornbridge and several other advertising partners—the partner cannot satisfy the contractual and operational requirements of service-provider or contractor status, even if a written contract were in place.

IV. Partner Classification Analysis

A. Methodology

Each of the forty-seven (47) partners identified in the Fieldhaven Data-Mapping Report was evaluated against the following criteria:

(a) Nature of Data Received: The categories of personal information transmitted to the partner, classified according to the CCPA/CPRA's enumerated categories (identifiers, commercial information, internet/network activity, geolocation, inferences, and sensitive personal information).

(b) Purpose of Data Use: The business purpose or commercial purpose for which the partner processes the data, including whether the processing involves cross-context behavioral advertising, audience targeting, retargeting, analytics, fraud detection, email delivery, or other functions.

(c) Consideration: Whether Cascade receives any monetary or other valuable consideration in connection with the data transfer, including reduced advertising rates, enriched audience data, performance analytics, or other non-monetary benefits.

(d) Data Commingling: Whether the partner combines Cascade consumer data with data from other sources—including data from the partner's other clients, data collected through the partner's own consumer-facing services, or data acquired from data brokers or other third parties.

(e) Contractual Status: Whether a written agreement exists between Cascade and the partner, and if so, whether the agreement includes the CCPA/CPRA-mandated service-provider or contractor restrictions, processor obligations under other Applicable State Statutes, data minimization provisions, opt-out compliance obligations, audit rights, and other required terms.

(f) Data Volume and Sensitivity: The approximate volume of personal information transmitted to the partner per month, and whether the data includes sensitive categories such as precise geolocation, financial account information, or data pertaining to minors.

The input sources for this analysis were:

• The Fieldhaven Data-Mapping Report dated May 19, 2025, which provided the technical mapping of data flows, data categories, and transmission mechanisms for each partner.

• Cascade procurement records provided by Diana Polk, Associate General Counsel and Interim Chief Privacy Officer, including executed contracts, insertion orders, statements of work, and vendor-management documentation.

• Peakview Analytics system architecture documentation provided by Priya Nandakumar, Vice President of Data & Analytics, including data-pipeline specifications, API documentation, and audience-segment export configurations.

• The marketing-partner roster provided by Jason Leclaire, Vice President of Marketing & Customer Engagement, including spend data, partner descriptions, and business-relationship summaries for each advertising and analytics vendor.

B. Classification Results Summary

The classification analysis yielded the following results:

Service Providers (Current): 12 partners. Twelve of the forty-seven partners currently have executed agreements that include some service-provider-type restrictions. These agreements vary in their completeness: some include data-use limitations and confidentiality obligations, while others include only partial restrictions that do not satisfy all CCPA/CPRA or multi-state requirements. These twelve partners primarily provide analytics, fraud-detection, or email-delivery services on Cascade's behalf, and their processing activities are generally consistent with a service-provider role. However, most of these agreements predate the CPRA's amendments (effective January 1, 2023) and will require updates to conform to current requirements, including the addition of CPRA-specific contractor certifications (where applicable), sub-processor restrictions, and multi-state compliance provisions. These twelve partners are classified as Tier 3 in the DPA rollout plan, as their existing agreements provide a baseline of protection.

Contractors (Current): 0 partners. No existing agreements use the contractor framework introduced by the CPRA. The contractor classification requires a written contract with heightened restrictions, including a prohibition on combining personal information from multiple sources and a certification by the contractor that it understands and will comply with the restrictions. No Cascade partner agreement includes these provisions. For certain partners whose processing activities may be better suited to the contractor model (e.g., partners that receive personal information for use in developing analytics products that are returned exclusively to Cascade), we recommend that the contractor template be used in lieu of the service-provider template.

Third Parties (Default — No Agreement): 23 partners. Twenty-three of the forty-seven partners have no executed data-processing agreement of any kind. In some cases, the data-sharing relationship was established informally through the deployment of a tracking pixel or tag on cascade.com without a corresponding written agreement. In other cases, the relationship was established through a verbal arrangement between Cascade's marketing team and the partner's account representative. Regardless of the circumstances, the absence of any written contract means that these partners cannot qualify as service providers or contractors under the CCPA/CPRA, and cannot qualify as processors under the other Applicable State Statutes. All data transfers to these twenty-three partners default to third-party transfers and likely constitute "sale" or "sharing" of personal information.

Third Parties (With Agreement but Inadequate Terms): 12 partners. Twelve of the forty-seven partners have some form of written agreement with Cascade, but the agreement does not include the CCPA/CPRA-mandated service-provider or contractor restrictions. These agreements consist of media insertion orders, platform terms of service, master services agreements with generic data-use terms, or advertising-platform clickthrough agreements. While these agreements may include general confidentiality obligations and data-use limitations, they do not include the specific restrictions required by the CCPA/CPRA (e.g., prohibition on selling or sharing the personal information, prohibition on use for purposes other than those specified in the contract, prohibition on data commingling) or the processor obligations required by other Applicable State Statutes. Accordingly, these twelve partners also cannot qualify as service providers or contractors, and data transfers to them likely constitute "sale" or "sharing."

Total partners classified as receiving data in a manner constituting "sale" or "sharing": 35 of 47. This total comprises the twenty-three partners with no DPA and the twelve partners with inadequate agreements. This represents approximately 74.5% of Cascade's third-party advertising and analytics partner base. The compliance exposure arising from these thirty-five relationships is substantial and pervasive.

C. Detailed Classification Table

The complete partner classification table is attached as Appendix A. The table includes the following fields for each of the forty-seven partners: Partner Number, Partner Name (coded), Data Categories Received, Purpose of Processing, Current Contractual Status, Recommended CCPA Classification, DPA Priority Tier (1 = High, 2 = Medium, 3 = Low), and Multi-State Risk Notes.

For purposes of this memorandum, the partners have been organized into three priority tiers based on the volume and sensitivity of data received, the degree to which the arrangement constitutes a "sale" or "sharing," the regulatory-risk profile, and the complexity of the anticipated DPA negotiation:

Tier 1 — High Priority (8 partners): These are the partners receiving the highest volume and most sensitive categories of personal information, and/or where the data-sharing arrangement most clearly and unambiguously constitutes a "sale" or "sharing" of personal information. Thornbridge Media Corp. is the single highest-priority partner within this tier and is addressed separately in Section V below. The remaining seven Tier 1 partners include programmatic-advertising platforms, retargeting networks, and audience-data exchanges that receive behavioral data, precise geolocation, and Peakview-generated inferences. None of the eight Tier 1 partners have executed DPAs. The target for DPA execution with all Tier 1 partners is the end of October 2025.

Tier 2 — Medium Priority (15 partners): These are partners with moderate data flows, including analytics providers, secondary ad-tech vendors, and marketing-attribution platforms. Some of these partners receive data that could be restructured as service-provider processing (e.g., by eliminating data commingling and restricting the partner's use to Cascade-directed purposes), while others receive data for purposes that more clearly constitute "sharing" or "targeted advertising." Eight of these fifteen partners lack any DPA; the remaining seven have agreements with inadequate terms. The target for DPA execution with all Tier 2 partners is the end of November 2025.

Tier 3 — Lower Priority (24 partners): These are partners with limited data categories (e.g., aggregated analytics, email-delivery services, A/B testing tools) or where existing agreements provide a baseline of protection. Twelve of these twenty-four partners have existing service-provider-type agreements requiring updates; twelve have no DPA but the data flows are limited in volume and sensitivity. Some Tier 3 relationships may be restructured to eliminate the sharing of personal information entirely (e.g., by switching to aggregated or de-identified data feeds). The target for DPA execution or amendment with all Tier 3 partners is the end of December 2025.

The complete table in Appendix A provides the granular detail necessary for the DPA rollout and for the forthcoming Comprehensive Gap-Analysis Report.

V. Thornbridge Media Corp. — Detailed Risk Assessment

A. Relationship Overview

Thornbridge Media Corp. ("Thornbridge") is a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. The company is led by Chief Executive Officer Robert Shin, and its General Counsel is Leah Voss. Thornbridge's outside counsel for privacy and data-governance matters is the firm of Kellner Park & Associates LLP, a California limited liability partnership, with lead attorney Victor Sandoval located at 555 Mission Street, 32nd Floor, San Francisco, California 94105.

Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. In FY2024, Cascade's total spend with Thornbridge was approximately $18.4 million, making Thornbridge the single largest advertising-technology vendor in Cascade's partner ecosystem. The relationship encompasses programmatic media buying, audience segmentation and targeting, real-time bidding, retargeting, and attribution analytics.

Thornbridge receives a broad range of consumer behavioral data from Cascade, including browsing history (page views, product views, search queries on cascade.com), purchase history (transaction records, product categories, purchase amounts, purchase frequency), device identifiers (device fingerprints, advertising IDs, cookie identifiers), precise geolocation data (latitude/longitude coordinates from the Cascade mobile application), and Peakview-generated audience segments and propensity scores (e.g., purchase likelihood scores, category-affinity scores, churn-risk assessments).

The data flows between Cascade and Thornbridge are bidirectional. In the outbound direction, Cascade (via Peakview Analytics) transmits consumer personal information to Thornbridge for the purpose of audience matching, lookalike modeling, and real-time ad targeting. Peakview uploads audience segments to Thornbridge's platform on a daily basis and integrates with Thornbridge's real-time bidding infrastructure for programmatic ad placement. In the inbound direction, Thornbridge returns performance analytics (impressions, clicks, conversions, cost-per-acquisition data), attribution data, and enriched audience segments to Cascade. These enriched audience segments incorporate Thornbridge's own proprietary data and data from Thornbridge's other clients, meaning that Cascade receives data-enrichment benefits that constitute valuable consideration for purposes of the CCPA/CPRA "sale" analysis.

A data-flow diagram illustrating the Cascade-Thornbridge data-sharing arrangement is attached as Appendix C.

B. Sale/Sharing Analysis

Based on our analysis, the Cascade-Thornbridge arrangement constitutes both a "sale" and a "sharing" of personal information under the CCPA/CPRA:

"Sale." Cascade receives valuable consideration from Thornbridge in exchange for making consumer personal information available. This consideration takes several forms: (i) reduced media rates (Thornbridge offers Cascade preferred pricing that reflects the value of the consumer data Cascade provides); (ii) enriched audience data (Thornbridge returns audience segments that incorporate Thornbridge's own data and data from other sources, providing Cascade with analytics capabilities it would otherwise need to develop or purchase separately); and (iii) attribution analytics and performance reporting (Thornbridge provides Cascade with detailed campaign-performance data that Cascade uses for marketing optimization and budget allocation). Each of these forms of value constitutes "other valuable consideration" within the meaning of California Civil Code § 1798.140(ad).

"Sharing." Thornbridge uses Cascade consumer data for cross-context behavioral advertising—this is the core purpose and raison d'être of the relationship. Thornbridge's platform matches Cascade consumer data with behavioral signals from other websites, applications, and services to target advertisements to Cascade consumers across the internet. This activity falls squarely within the definition of "sharing" under California Civil Code § 1798.140(ah), regardless of whether monetary or other consideration is exchanged. The fact that Thornbridge also receives monetary consideration does not alter the sharing analysis; the two classifications are independent and additive.

Under the VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), and other Applicable State Statutes, the Thornbridge arrangement constitutes "targeted advertising" from which consumers must be able to opt out. The targeted-advertising opt-out requirements in these states are functionally equivalent to the CCPA/CPRA's "sharing" opt-out requirement and apply to the same category of advertising-partner data sharing.

Contractual Deficiencies. There is no current agreement between Cascade and Thornbridge that contains any CCPA service-provider or contractor restrictions. The existing commercial arrangement is governed by a master media-buying agreement that includes generic data-use terms but does not include: a prohibition on selling or sharing the personal information; a restriction on using the personal information for purposes beyond those specified in the contract; a prohibition on combining Cascade personal information with data from other sources; obligations to honor consumer opt-out-of-sale/sharing signals; obligations to process consumer deletion or access requests; audit rights for Cascade; breach-notification obligations; sub-processor restrictions; or data-minimization provisions.

Data Commingling. Thornbridge commingles Cascade consumer data with data from its other advertising clients as a core part of its business model. Thornbridge's platform aggregates consumer data from multiple client sources to build comprehensive consumer profiles used for audience targeting across its network. This commingling is fundamentally incompatible with service-provider or contractor status under the CCPA/CPRA, even if the contractual deficiencies were remedied.

C. Specific Risk Factors

The Thornbridge relationship presents the following specific risk factors that elevate it to the highest priority:

Volume. Peakview Analytics transmits consumer-event records to Thornbridge at a rate of hundreds of millions of events per month. While the precise figure varies by month and campaign cycle, the Fieldhaven Data-Mapping Report documented an average of approximately 340 million consumer-event records transmitted to Thornbridge per month during the Q1 2025 measurement period. This represents approximately 16% of the total 2.1 billion consumer-event records processed by Peakview monthly. The sheer volume of data flowing to Thornbridge amplifies the compliance exposure and the potential harm to consumers in the event of misuse or breach.

Sensitivity. The data transmitted to Thornbridge includes precise geolocation data collected from the Cascade mobile application. Under CCPA/CPRA § 1798.140(ae) and § 1798.121, precise geolocation data (defined as location information sufficient to identify a consumer's location within a radius of 1,850 feet) constitutes sensitive personal information for which businesses must provide consumers with the right to limit the use and disclosure of such information. Several other Applicable State Statutes—including the CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), and OCPA (Oregon)—similarly classify precise geolocation as a sensitive data category subject to heightened requirements. Cascade does not currently obtain separate opt-in consent before transmitting precise geolocation data to Thornbridge, and Thornbridge does not limit its use of geolocation data to purposes directed by Cascade.

Failure to Honor GPC. Cascade does not currently honor GPC signals or transmit any form of universal opt-out signals to Thornbridge. Under CCPA/CPRA regulations (11 CCR § 7025), a business must treat an opt-out preference signal (including GPC) as a valid request to opt out of the sale and sharing of personal information. Cascade's failure to honor GPC signals means that consumers who have activated GPC in their browsers are not receiving the statutory protection to which they are entitled with respect to the Thornbridge data sharing.

California AG Inquiry. As discussed in Section II.C above, the California Attorney General's February 2024 informal inquiry letter specifically highlighted deficiencies in Cascade's service-provider agreements and "Do Not Sell" mechanisms. The Thornbridge relationship—as Cascade's largest advertising-partner arrangement involving the highest data volumes and no DPA—is a primary driver of the deficiencies flagged by the AG. The continued absence of a compliant agreement with Thornbridge exposes Cascade to elevated enforcement risk in the event the AG revisits the matter.

Failure to Forward Consumer Rights Requests. Cascade received approximately 6,500 opt-out-of-sale/sharing requests in FY2024. None of these requests were communicated to Thornbridge, meaning that consumers who exercised their opt-out rights continued to have their personal information transmitted to Thornbridge for sale and sharing purposes without interruption. Similarly, Cascade received approximately 19,100 deletion requests in FY2024, none of which were forwarded to Thornbridge for downstream deletion of the consumer's data from Thornbridge's systems. These failures represent ongoing, affirmative non-compliance with the CCPA/CPRA's consumer-rights provisions.

Regulatory and Litigation Exposure. The combination of (i) the volume of data involved, (ii) the inclusion of sensitive personal information, (iii) the absence of any contractual protections, (iv) the failure to honor opt-out requests, and (v) the AG's prior inquiry creates a risk profile that is materially elevated relative to other partner relationships. In the event of a regulatory enforcement action—whether by the California AG, the CPPA, or an AG in another state with an applicable statute—the Thornbridge relationship is likely to be a focal point of the investigation. Additionally, the CCPA provides a private right of action for data breaches resulting from a business's failure to implement and maintain reasonable security procedures and practices (§ 1798.150). While the private right of action is limited to data breaches and does not directly apply to non-compliance with opt-out requirements, the absence of contractual controls governing Thornbridge's security practices increases the risk that a security incident affecting the shared data could give rise to class-action litigation.

D. Recommended Actions for Thornbridge

Based on the foregoing analysis, we recommend the following actions specific to the Thornbridge relationship:

1. Immediately initiate negotiation of a restructured data-sharing agreement with Thornbridge. Alan Burke and Sara Hendricks (Calderwood & Harkness) should contact Victor Sandoval at Kellner Park & Associates LLP and Leah Voss at Thornbridge to schedule an initial meeting and transmit a term sheet for the proposed restructured arrangement. Given the nature and scale of the relationship, the Thornbridge agreement should be a bespoke data-sharing agreement rather than a deployment of the standardized DPA template.

2. Target execution date: October 31, 2025. This target reflects both the urgency of the compliance exposure and the anticipated complexity of the negotiation. Thornbridge has significant commercial leverage as Cascade's largest advertising partner, and we anticipate that certain provisions—particularly the restrictions on data commingling and the requirement to honor opt-out signals in real time—will be subject to extended negotiation.

3. Key terms to negotiate:

(a) Sale/Sharing Acknowledgment: The agreement should include an express acknowledgment that the data sharing constitutes a "sale" and "sharing" of personal information under the CCPA/CPRA, triggering the corresponding consumer opt-out rights.

(b) Opt-Out signal compliance: Thornbridge must agree to honor consumer opt-out-of-sale/sharing signals, including GPC, in real time. This requires Thornbridge to implement a technical mechanism for receiving and acting on opt-out signals transmitted by Cascade or by the CMP.

(c) Consumer Rights Request Processing: Thornbridge must agree to process consumer deletion and access requests forwarded by Cascade within contractually specified timeframes.

(d) Data-Use Restrictions: The agreement should prohibit Thornbridge from combining Cascade consumer data with data from other sources for purposes beyond the Cascade advertising relationship. This provision will be among the most difficult to negotiate, as data commingling is integral to Thornbridge's business model.

(e) Data Minimization and Purpose Limitation: Thornbridge's use of Cascade consumer data must be limited to the specific purposes set forth in the agreement, and data collected or received should be limited to what is reasonably necessary for those purposes.

(f) Audit Rights: Cascade must have the right to audit Thornbridge's data-processing activities, including the right to conduct or commission periodic assessments of Thornbridge's compliance with the agreement's restrictions.

(g) Breach Notification: Thornbridge must provide Cascade with notice of any data breach affecting Cascade consumer data within a specified timeframe (we recommend seventy-two (72) hours of discovery).

(h) Indemnification: Thornbridge should indemnify Cascade for regulatory fines, penalties, and enforcement costs arising from Thornbridge's non-compliance with the agreement's terms or with applicable privacy law.

(i) Sub-Processor Restrictions: Thornbridge must obtain Cascade's prior written approval before engaging sub-processors to process Cascade consumer data, and must ensure that sub-processors are bound by obligations no less restrictive than those in the agreement.

4. Privacy Policy and Opt-Out Updates. In parallel with the Thornbridge negotiation, Cascade should update its privacy policy and consumer-facing opt-out mechanisms to disclose the Thornbridge sharing arrangement and provide effective opt-out functionality. The target date for these updates is December 31, 2025, though we recommend completing them as soon as the CMP deployment permits.

5. Immediate Cessation of Geolocation Sharing. We recommend that Cascade immediately cease transmitting precise geolocation data to Thornbridge until a separate opt-in consent mechanism is implemented. This recommendation is consistent with the sensitive-PI workstream addressed in the memorandum dated July 28, 2025.

VI. Risk Assessment of Remaining Partners

A. Tier 1 Partners (High Priority — Excluding Thornbridge)

In addition to Thornbridge, seven (7) other partners have been classified as Tier 1 (High Priority). These seven partners are identified by coded reference in the complete classification table (Appendix A) and share the following common characteristics:

Each of the seven Tier 1 partners receives consumer behavioral data from Cascade for purposes of retargeting, audience extension, lookalike modeling, or programmatic ad placement. The data categories transmitted include, at a minimum, identifiers (hashed email addresses, device identifiers, cookie identifiers), commercial information (purchase history, browsing behavior), and internet/network activity (click-stream data, session data). Several of these partners also receive precise geolocation data from the Cascade mobile application, raising the same sensitive-personal-information concerns identified in the Thornbridge analysis above.

None of the seven Tier 1 partners have executed DPAs with Cascade. The existing commercial arrangements with these partners are governed exclusively by media insertion orders or platform terms of service that do not include any CCPA/CPRA-required service-provider, contractor, or processor restrictions. In several cases, there is no written agreement of any kind—the data-sharing relationship was established through the deployment of a tracking pixel on cascade.com pursuant to a verbal arrangement with the partner's account representative.

The specific risk factors for each Tier 1 partner are summarized as follows:

• Partner T1-02 (programmatic ad platform): Receives approximately 120 million consumer-event records per month from Peakview; commingles Cascade data with data from other advertising clients; receives precise geolocation data; no DPA; no DSR forwarding mechanism.

• Partner T1-03 (retargeting network): Receives browsing-behavior data and purchase-history data via pixel integration; uses data to retarget Cascade consumers across its publisher network; Cascade receives reciprocal retargeting analytics constituting valuable consideration; no DPA.

• Partner T1-04 (audience-data exchange): Receives Peakview-generated audience segments and propensity scores; combines with proprietary data to create enriched audience segments sold to other advertisers; Cascade receives enriched segments in return; data transfer constitutes "sale" under both monetary and other-valuable-consideration definitions; no DPA.

• Partner T1-05 (demand-side platform): Receives real-time bidding data including device identifiers and behavioral signals; no Cascade-specific contractual terms; data transmitted through RTB protocol is accessible to downstream ad exchanges and supply-side platforms; no DPA.

• Partner T1-06 (social-media advertising platform): Receives hashed email addresses and customer-list data for custom-audience matching and lookalike modeling; platform terms of service provide for platform's right to use uploaded data for its own product improvement; no CCPA-compliant restrictions; no DPA beyond platform's standard clickthrough terms.

• Partner T1-07 (cross-device identity-resolution provider): Receives device identifiers, IP addresses, and cookie identifiers; links consumer identities across devices and returns cross-device graphs to Cascade; commingles Cascade data with data from other clients; provides valuable consideration in the form of identity-resolution services; no DPA.

• Partner T1-08 (connected-TV advertising platform): Receives purchase-history data and audience segments for targeting Cascade advertisements on connected-TV inventory; receives precise geolocation data; no DPA; no opt-out mechanism.

Risk Rating: High. Data transfers to these seven partners constitute sale and/or sharing of personal information, and no contractual protections are in place. The absence of DPAs, combined with the volume and sensitivity of data involved, creates material compliance exposure. Each of these partners should receive a DPA or a bespoke data-sharing agreement by the end of October 2025.

B. Tier 2 Partners (Medium Priority)

Fifteen (15) partners have been classified as Tier 2 (Medium Priority). These partners receive moderate data flows from Cascade and represent a mix of analytics providers and secondary ad-tech vendors. The data categories and volumes are generally lower than those for Tier 1 partners, and several of these relationships may be restructurable as service-provider or processor arrangements with appropriate contractual terms and operational controls.

Of the fifteen Tier 2 partners, eight (8) lack any DPA, and the remaining seven (7) have agreements with inadequate terms. The agreements in place with the seven partners are typically master services agreements or platform terms of service that include general data-use and confidentiality provisions but do not include the CCPA/CPRA-specific restrictions necessary for service-provider or contractor qualification.

For those Tier 2 partners whose processing activities are consistent with a service-provider role—e.g., analytics providers that process data exclusively at Cascade's direction and do not combine Cascade data with data from other sources—restructuring is feasible. The key operational changes required include: (i) elimination of data commingling (requiring the partner to maintain Cascade data in a segregated environment or logical partition); (ii) restriction of data use to purposes specified in the DPA; and (iii) implementation of DSR-forwarding capabilities. These operational changes should be negotiated as part of the DPA deployment.

For those Tier 2 partners whose processing activities are inherently cross-context (e.g., secondary ad-tech vendors that use Cascade data for targeted advertising across their networks), service-provider classification may not be achiev

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work-product doctrine. It has been prepared by counsel at Calderwood & Harkness LLP in connection with the provision of legal advice to Cascade Retail Holdings Inc. and its subsidiaries. This memorandum and its contents should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Cascade Retail Holdings Inc. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
CALDERWOOD & HARKNESS LLP MEMORANDUM
FROM: Alan Burke, Senior Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP
TO: Kevin Ostrowski, Partner, Privacy & Data Security Practice Group, Calderwood & Harkness LLP
DATE: August 4, 2025
RE: Third-Party Data-Sharing Risk Assessment — Cascade Retail Holdings Inc. (Matter No. 1038-00010)
CC: Rachel Bernstein, Partner, Calderwood & Harkness LLP; Sara Hendricks, Associate, Calderwood & Harkness LLP
Right-click to update Table of Contents
I. Executive Summary
This memorandum presents the results of our assessment of the compliance posture of Cascade Retail Holdings Inc. ("Cascade" or the "Company") with respect to its data-sharing relationships with the forty-seven (47) third-party advertising and analytics partners identified in the data-mapping report delivered by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Data-Mapping Report"). The purpose of this assessment is to identify, classify, and prioritize the legal risks associated with these data-sharing arrangements under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the eighteen (18) other state privacy statutes applicable to Cascade's operations (collectively, the nineteen (19) "Applicable State Statutes").
Our core findings are as follows:
• Twenty-three (23) of the forty-seven (47) partners lack an executed data-processing agreement ("DPA") of any kind. In the absence of a compliant written contract, each of these partners defaults to "third-party" status under the CCPA/CPRA, and data transfers to these partners likely constitute a "sale" or "sharing" of personal information ("PI") for which consumers must be afforded opt-out rights that Cascade is not currently providing.
• An additional twelve (12) partners have some form of contractual arrangement (e.g., media insertion orders, platform terms of service) that does not include the CCPA/CPRA-mandated service-provider or contractor restrictions. Data transfers to these partners also likely constitute "sale" or "sharing."
• In total, thirty-five (35) of the forty-seven (47) data-sharing relationships likely constitute "sale" or "sharing" under the CCPA/CPRA and equivalent concepts (e.g., targeted advertising, sale of personal data) under many of the other Applicable State Statutes.
• The highest-priority relationship is with Thornbridge Media Corp. ("Thornbridge"). Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner, with FY2024 spend of approximately $18.4 million. The Thornbridge relationship involves the exchange of large volumes of consumer behavioral data, including precise geolocation data classified as sensitive personal information under the CCPA/CPRA. There is no executed DPA, consumer opt-out-of-sale/sharing requests are not currently communicated to Thornbridge, and Thornbridge commingles Cascade consumer data with data from its other advertising clients.
Based on these findings, we recommend:
1. Classification of each partner under each Applicable State Statute as a service provider/processor, contractor, or third party, and identification of each data transfer that constitutes a "sale," "sharing," or "targeted advertising" requiring consumer opt-out rights;
2. Prioritized DPA rollout to all thirty-five (35) partners lacking compliant agreements, using standardized service-provider and contractor DPA templates with partner-specific schedules, on the timeline set forth in Section VIII below;
3. Immediate restructuring of the Thornbridge arrangement, including negotiation of a bespoke data-sharing agreement with appropriate CCPA/CPRA compliance provisions, with a target execution date of October 31, 2025; and
4. Implementation of opt-out-of-sale/sharing mechanisms, including real-time honoring of Global Privacy Control ("GPC") signals and propagation of opt-out signals to all forty-seven (47) partners, in coordination with the OnPoint Data Solutions Inc. ("OnPoint") consent-management platform ("CMP") deployment targeted for December 15, 2025.
This memorandum should be read in conjunction with the Comprehensive Gap-Analysis Report dated August 15, 2025 (forthcoming), and the Data-Mapping Review Memorandum dated July 14, 2025, both prepared by this firm in connection with the broader privacy-compliance program.
II. Background
A. Cascade's Data-Sharing Ecosystem
Cascade Retail Holdings Inc. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol "CSRD," with its principal executive offices located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is an omnichannel retailer with FY2024 revenues of approximately $3.87 billion. The Company operates one hundred eighty-six (186) brick-and-mortar retail locations across thirty-one (31) U.S. states and fulfills e-commerce orders to consumers in all fifty (50) states and the District of Columbia. These operations generate an extensive footprint of consumer data collection and processing, the scope and complexity of which are central to the risks addressed in this memorandum.
Cascade's data-sharing ecosystem is supported by three key subsidiaries, each of which plays a distinct role in the collection, processing, and dissemination of consumer personal information:
Peakview Analytics Inc. Peakview Analytics Inc. ("Peakview") is a Delaware corporation (EIN 87-2250194) and Cascade's in-house advertising technology and customer analytics unit. Peakview processes approximately 2.1 billion consumer-event data records per month. These records encompass a broad range of consumer interactions—including online browsing sessions, purchase transactions, mobile-app engagement events, and loyalty-program activity—and are used for purposes including ad targeting, audience segmentation, personalization, and attribution analytics. Peakview is the primary engine through which consumer data is compiled, enriched, and transmitted to third-party advertising and analytics partners. The scale of Peakview's processing operations is a significant factor in the risk analysis set forth in this memorandum: errors or gaps in data-governance controls at Peakview have a multiplicative effect on the volume of personal information exposed to non-compliant data-sharing arrangements.
Cascade Digital Marketplace LLC. Cascade Digital Marketplace LLC ("CDM") is a Delaware limited liability company (EIN 85-4107638) that operates the third-party seller marketplace accessible at cascade.com/marketplace. CDM hosts approximately 3,800 third-party sellers and processes transaction, product listing, and seller-account data. As discussed in Section II.B below, a critical finding of the Fieldhaven Data-Mapping Report is that CDM seller data is commingled with first-party customer data in a single data lake, raising the risk that data feeds transmitted to advertising partners contain marketplace-seller personal information in addition to consumer personal information.
Cascade Rewards Corp. Cascade Rewards Corp. is a Delaware corporation (EIN 86-3381729) that operates the Cascade Rewards loyalty program. The loyalty program has approximately 41.2 million registered members, making it one of the Company's most significant repositories of identifiable consumer data. Loyalty-program data—including member identifiers, purchase history, reward redemption activity, and preference information—is integrated with Peakview's analytics platform and is among the categories of personal information shared with third-party advertising partners.
The Company's digital properties deploy twelve (12) categories of cookies and tracking technologies on its primary website, cascade.com, and its mobile applications. These technologies include first-party analytics cookies, third-party advertising pixels and tags, session-management cookies, geolocation services, and device-fingerprinting scripts, among others. The breadth and range of tracking technologies deployed is directly relevant to the data-sharing risk assessment because many of the forty-seven (47) identified partner relationships originate from or are facilitated by pixel/tag integrations that automatically transmit consumer data to third-party servers upon page load or user interaction.
In FY2024, Cascade processed approximately 94 million online transactions. The Company received approximately 38,400 data-subject requests ("DSRs") during the same period, comprising approximately 12,800 access requests, approximately 19,100 deletion requests, and approximately 6,500 requests to opt out of the sale or sharing of personal information. The volume and composition of these DSRs are relevant to the partner-compliance analysis because, as discussed in Sections V and IX below, Cascade does not currently have mechanisms in place to forward opt-out-of-sale/sharing, deletion, or access requests to the majority of its third-party advertising and analytics partners.
B. Fieldhaven Data-Mapping Findings
Fieldhaven Consulting Group LLC is a Delaware limited liability company with offices at 350 Sansome Street, Suite 400, San Francisco, California 94104. Fieldhaven was engaged by Cascade, under the direction of this firm, to conduct a comprehensive data-mapping exercise covering the Company's consumer-data processing activities. The engagement was led by Marcus Ellerby, a principal at Fieldhaven with extensive experience in privacy-program data mapping for large retailers.
Fieldhaven delivered its Data-Mapping Report on May 19, 2025. The report identified forty-seven (47) third-party advertising and analytics partners receiving consumer personal information from Cascade. This total encompasses partners that receive data through any channel, including pixel/tag integrations on cascade.com and the Cascade mobile app, server-to-server batch transfers from Peakview Analytics, audience-segment uploads to demand-side platforms ("DSPs"), and real-time bidding ("RTB") integrations.
The categories of personal information shared with these partners, as documented in the Fieldhaven report, include:
• Identifiers: Consumer name, email address, mailing address, phone number, hashed identifiers (e.g., hashed email addresses used for audience matching), and internal account identifiers.
• Commercial Information: Purchase history (including product categories, transaction amounts, and purchase frequency), browsing behavior (products viewed, categories browsed, time on page), shopping-cart data, and wishlist/save-for-later data.
• Internet and Network Activity Information: Click-stream data, session identifiers, referring URLs, search queries, device fingerprints, browser type and version, operating system, IP addresses, and cookie identifiers.
• Precise Geolocation Data: Location data collected from the Cascade mobile application with granularity sufficient to identify a consumer's location within a radius of 1,850 feet or less—constituting "precise geolocation" under CCPA/CPRA § 1798.140(ae) and meeting the sensitivity threshold for sensitive personal information under § 1798.140(ae) and § 1798.121.
• Inferences: Purchase-propensity scores, predicted product-category affinities, churn-risk scores, audience segments (e.g., "high-value home décor shopper," "frequent electronics buyer"), and lookalike modeling outputs, all generated by Peakview Analytics.
The Fieldhaven report documented four primary channels through which these data flows occur:
(a) Pixel/Tag Firing: JavaScript pixels and tracking tags deployed on cascade.com and the Cascade mobile app transmit consumer interaction data directly to third-party partner servers at the time of page load or user interaction. This is the most common mechanism and accounts for data sharing with the majority of the forty-seven partners.
(b) Server-to-Server Batch Transfers: Peakview Analytics transmits bulk data files to partner servers on a scheduled basis (typically daily or weekly), containing aggregated consumer-event data, audience segments, and enriched analytics outputs.
(c) Audience-Segment Uploads: Peakview compiles audience segments based on consumer behavioral and transactional data and uploads these segments to DSPs and advertising platforms for use in programmatic ad targeting.
(d) Real-Time Bidding Integrations: Cascade participates in RTB ecosystems in which consumer data (including device identifiers, behavioral signals, and audience-segment memberships) is transmitted to ad exchanges and bidding platforms in real time as part of the ad-auction process.
A critical finding of the Fieldhaven report—one with significant implications for the risk assessment in this memorandum—is that third-party marketplace seller data originating from CDM is commingled with first-party customer data in a single data lake hosted by Cascade's cloud infrastructure. This data lake is the primary source from which Peakview Analytics draws consumer data for processing and transmission to partners. The absence of role-based access controls or logical segregation between customer data and seller data means that partner data feeds may contain seller personal information in addition to consumer personal information. Seller personal information has a different processing basis and different consent profiles from consumer personal information, and its inadvertent inclusion in advertising-partner data feeds creates additional compliance exposure. This issue is discussed further in Section IX.D below.
C. Regulatory History Relevant to Data Sharing
Cascade has been the subject of regulatory attention relevant to its data-sharing practices, and this regulatory history informs both the urgency and the specific focus areas of the risk assessment.
California Attorney General Informal Inquiry (February 2024). On February 6, 2024, the California Attorney General's office sent an informal inquiry letter to Cascade's General Counsel raising specific concerns about deficiencies in (i) the placement, functionality, and labeling of the "Do Not Sell or Share My Personal Information" link on cascade.com, and (ii) the adequacy of Cascade's service-provider agreements with advertising and analytics partners. Cascade provided a written response on March 8, 2024, describing planned remediation steps. No formal enforcement action has been initiated as of the date of this memorandum. However, the deficiencies identified in the inquiry letter remain substantially unresolved—the "Do Not Sell" link has not been redesigned, the identified service-provider agreement gaps have not been addressed, and no DPAs have been executed with the partners flagged in the inquiry. The Thornbridge relationship, as Cascade's largest advertising-partner arrangement, is directly implicated by the AG's concerns regarding service-provider agreements.
FTC Civil Investigative Demand (September 2023). On September 14, 2023, the Federal Trade Commission issued a Civil Investigative Demand ("CID") to Cascade under File No. 232-0147, regarding allegations of dark patterns in the mobile-app unsubscribe flow. The CID sought documents and information relating to the design and implementation of the app's notification and data-collection opt-out interfaces. The matter was closed on April 3, 2024, with no enforcement action taken. Although the CID did not directly address third-party data sharing, it underscores the heightened regulatory scrutiny directed at Cascade's consumer-facing data practices and the need for the Company to demonstrate proactive compliance across its data-governance program.
Privacy Policy Deficiencies. Cascade's current online privacy policy was last updated in March 2022. This privacy policy does not accurately describe the Company's data-sharing arrangements with third-party advertising and analytics partners. Specifically, the policy does not disclose the categories of personal information sold or shared, does not identify the categories of third parties to whom personal information is sold or shared, and does not describe the consumer's right to opt out of sale or sharing in a manner consistent with the CCPA/CPRA or other Applicable State Statutes. Furthermore, the privacy policy does not address fourteen (14) of the nineteen (19) Applicable State Statutes, including the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and others. The privacy-policy update is being addressed as a separate workstream and is targeted for completion by September 12, 2025. See Section IX.A below.
III. Legal Framework: "Sale," "Sharing," and Partner Classification
This section sets forth the legal framework for classifying Cascade's data-sharing relationships under the CCPA/CPRA and the other Applicable State Statutes. The classification of each partner—as a service provider, contractor, or third party—determines the legal obligations that attach to the data transfer, including whether the transfer constitutes a "sale" or "sharing" requiring consumer opt-out rights.
A. CCPA/CPRA Definitions
The CCPA/CPRA establishes a definitional framework that is critical to the classification analysis:
"Sale." Under California Civil Code § 1798.140(ad), a "sale" is defined as "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration." This definition is notably broad: it encompasses not only traditional monetary transactions but any transfer of personal information in exchange for "other valuable consideration," which has been interpreted by the California Attorney General and the California Privacy Protection Agency ("CPPA") to include the receipt of services, data enrichment, reduced rates, or other non-monetary benefits. A business that "sells" personal information must provide consumers with the right to opt out of such sale under § 1798.120.
"Sharing." Under California Civil Code § 1798.140(ah), "sharing" is defined as "sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged." The concept of "sharing" was introduced by the CPRA to close a perceived gap in the original CCPA's "sale" definition: even where a business does not receive any consideration in exchange for making personal information available to an advertising partner, the transfer constitutes "sharing" if the data is used for cross-context behavioral advertising. The right to opt out of "sharing" under § 1798.120 is coextensive with the right to opt out of "sale."
"Service Provider." Under California Civil Code § 1798.140(ag), a "service provider" is defined as a legal entity that processes personal information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the service provider from (i) selling or sharing the personal information, (ii) retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, (iii) retaining, using, or disclosing the personal information outside of the direct business relationship between the service provider and the business, and (iv) combining the personal information received from the business with personal information received from another source or collected from the service provider's own interactions with the consumer, except as permitted by the statute. Critically, service-provider status requires both the written contract and operational compliance with the contract's restrictions. Data transfers to a qualified service provider do not constitute a "sale" or "sharing" of personal information.
"Contractor." Under California Civil Code § 1798.140(j), a "contractor" is a legal entity to which the business makes a consumer's personal information available and that processes such personal information on behalf of the business pursuant to a written contract that includes heightened restrictions. The contractor framework was introduced by the CPRA and imposes additional requirements beyond those applicable to service providers, including a prohibition on combining the personal information received from the business with personal information from other sources (subject to limited exceptions), and a requirement that the contractor certify that it understands and will comply with the contract's restrictions. Data transfers to a qualified contractor do not constitute a "sale" or "sharing."
"Third Party." Under California Civil Code § 1798.140(ai), a "third party" is defined as a person or entity that is not (i) the business with which the consumer intentionally interacts, (ii) a service provider, or (iii) a contractor. This is a residual category: any entity receiving personal information from Cascade that does not qualify as a service provider or contractor is, by default, a third party. Transfers of personal information to a third party constitute a "sale" (if for monetary or other valuable consideration) or "sharing" (if for cross-context behavioral advertising), unless a specific statutory exception applies.
The consequence of these definitions for Cascade's partner relationships is straightforward but significant: in the absence of a compliant written contract containing the required service-provider or contractor restrictions, a data-sharing partner cannot qualify as a service provider or contractor and defaults to third-party status. All transfers of personal information to such a partner will constitute a "sale" or "sharing" from which consumers have the right to opt out.
B. Multi-State Equivalents
In addition to the CCPA/CPRA, Cascade's data-sharing practices are subject to eighteen (18) other state privacy statutes that have been enacted and are in effect or will take effect during the relevant compliance period. These statutes collectively apply to Cascade because the Company's e-commerce operations serve consumers in all fifty states, and several of the statutes have applicability thresholds (based on data volume and/or revenue) that Cascade exceeds. The following summarizes the key classifications and concepts under each Applicable State Statute:
Most of these statutes employ a controller/processor framework that is conceptually similar to, though not identical with, the CCPA/CPRA's business/service-provider/contractor model. Under the controller/processor model, a "controller" is the entity that determines the purposes and means of processing personal data (analogous to a CCPA "business"), and a "processor" is an entity that processes personal data on behalf of a controller pursuant to a contract (analogous to a CCPA "service provider"). All of these statutes require that controller-processor relationships be governed by written data-processing agreements specifying the processor's obligations, including instructions for processing, confidentiality, sub-processor management, data deletion or return, and audit rights.
The definition of "sale" varies among the Applicable State Statutes. Some statutes, such as the VCDPA (Virginia), define "sale" narrowly to require monetary consideration, while others, such as the CPA (Colorado), CTDPA (Connecticut), and OCPA (Oregon), define "sale" more broadly to include the exchange of personal data for monetary or "other valuable consideration," aligning more closely with the CCPA/CPRA approach.
The concept of "targeted advertising" appears across most Applicable State Statutes and is functionally equivalent to the CCPA/CPRA concept of "sharing" for cross-context behavioral advertising. States requiring a consumer opt-out of targeted advertising include Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Kentucky, and others. The requirement to provide a targeted-advertising opt-out means that even where a data transfer does not technically constitute a "sale" under a particular state's narrower definition, it may still require an opt-out mechanism if the data is used for targeted advertising.
Several Applicable State Statutes require controllers to honor universal opt-out mechanisms, including GPC signals. California's CPRA regulations (11 CCR § 7025) mandate that businesses treat a GPC signal as a valid request to opt out of the sale and sharing of personal information. Colorado, Connecticut, Texas, Montana, and other states have adopted or are implementing similar requirements. As discussed throughout this memorandum, Cascade does not currently honor GPC signals, which constitutes a compliance gap affecting all forty-seven partner relationships.
The following table summarizes the key definitions and requirements under each of the nineteen Applicable State Statutes:
The multi-state landscape reinforces the urgency of the DPA rollout and opt-out implementation. A partner that qualifies as a service provider under the CCPA/CPRA will generally also qualify as a processor under the other Applicable State Statutes, which simplifies the contracting approach: the DPA templates being developed by this firm (target finalization: September 30, 2025) are designed to satisfy the requirements of all nineteen statutes simultaneously.
C. Key Analytical Principles
Drawing together the statutory definitions and regulatory guidance, the following principles have guided our classification analysis of Cascade's forty-seven partner relationships:
First, the receipt of any valuable consideration by Cascade—whether monetary or non-monetary—in exchange for making consumer personal information available to a partner triggers the "sale" classification under the CCPA/CPRA and under those state statutes that include "other valuable consideration" in their sale definitions. Valuable consideration includes, but is not limited to, free analytics services, reduced-rate advertising, enriched audience data returned to Cascade, performance reporting, and attribution analytics. Many of Cascade's advertising-partner arrangements involve a reciprocal exchange of value: Cascade provides consumer data, and the partner provides analytics, audience enrichment, or discounted media placement in return. These arrangements satisfy the "other valuable consideration" element.
Second, the use of Cascade consumer data for cross-context behavioral advertising by a partner constitutes "sharing" under CCPA/CPRA regardless of whether monetary or other valuable consideration is exchanged. The concept of "cross-context behavioral advertising" encompasses the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded websites, applications, or services other than the business with which the consumer intentionally interacted. This is the core function of programmatic advertising and audience targeting, and it describes the fundamental purpose of Cascade's relationships with the majority of its advertising partners.
Third, the absence of a compliant written contract containing the mandatory service-provider or contractor restrictions means that the partner cannot qualify as a service provider or contractor under the CCPA/CPRA, and cannot qualify as a processor under the other Applicable State Statutes. The partner defaults to third-party status, and all data transfers to the partner are subject to the sale/sharing opt-out requirements. This principle is particularly significant for the twenty-three (23) partners that lack any executed data-processing agreement.
Fourth, the commingling of Cascade data with a partner's own data or with data received from other businesses is inconsistent with service-provider or contractor status. The CCPA/CPRA's service-provider restrictions expressly prohibit combining personal information received from one business with personal information received from another source (except as permitted by statute). Where a partner commingles Cascade data with data from other clients—as is the case with Thornbridge and several other advertising partners—the partner cannot satisfy the contractual and operational requirements of service-provider or contractor status, even if a written contract were in place.
IV. Partner Classification Analysis
A. Methodology
Each of the forty-seven (47) partners identified in the Fieldhaven Data-Mapping Report was evaluated against the following criteria:
(a) Nature of Data Received: The categories of personal information transmitted to the partner, classified according to the CCPA/CPRA's enumerated categories (identifiers, commercial information, internet/network activity, geolocation, inferences, and sensitive personal information).
(b) Purpose of Data Use: The business purpose or commercial purpose for which the partner processes the data, including whether the processing involves cross-context behavioral advertising, audience targeting, retargeting, analytics, fraud detection, email delivery, or other functions.
(c) Consideration: Whether Cascade receives any monetary or other valuable consideration in connection with the data transfer, including reduced advertising rates, enriched audience data, performance analytics, or other non-monetary benefits.
(d) Data Commingling: Whether the partner combines Cascade consumer data with data from other sources—including data from the partner's other clients, data collected through the partner's own consumer-facing services, or data acquired from data brokers or other third parties.
(e) Contractual Status: Whether a written agreement exists between Cascade and the partner, and if so, whether the agreement includes the CCPA/CPRA-mandated service-provider or contractor restrictions, processor obligations under other Applicable State Statutes, data minimization provisions, opt-out compliance obligations, audit rights, and other required terms.
(f) Data Volume and Sensitivity: The approximate volume of personal information transmitted to the partner per month, and whether the data includes sensitive categories such as precise geolocation, financial account information, or data pertaining to minors.
The input sources for this analysis were:
• The Fieldhaven Data-Mapping Report dated May 19, 2025, which provided the technical mapping of data flows, data categories, and transmission mechanisms for each partner.
• Cascade procurement records provided by Diana Polk, Associate General Counsel and Interim Chief Privacy Officer, including executed contracts, insertion orders, statements of work, and vendor-management documentation.
• Peakview Analytics system architecture documentation provided by Priya Nandakumar, Vice President of Data & Analytics, including data-pipeline specifications, API documentation, and audience-segment export configurations.
• The marketing-partner roster provided by Jason Leclaire, Vice President of Marketing & Customer Engagement, including spend data, partner descriptions, and business-relationship summaries for each advertising and analytics vendor.
B. Classification Results Summary
The classification analysis yielded the following results:
Service Providers (Current): 12 partners. Twelve of the forty-seven partners currently have executed agreements that include some service-provider-type restrictions. These agreements vary in their completeness: some include data-use limitations and confidentiality obligations, while others include only partial restrictions that do not satisfy all CCPA/CPRA or multi-state requirements. These twelve partners primarily provide analytics, fraud-detection, or email-delivery services on Cascade's behalf, and their processing activities are generally consistent with a service-provider role. However, most of these agreements predate the CPRA's amendments (effective January 1, 2023) and will require updates to conform to current requirements, including the addition of CPRA-specific contractor certifications (where applicable), sub-processor restrictions, and multi-state compliance provisions. These twelve partners are classified as Tier 3 in the DPA rollout plan, as their existing agreements provide a baseline of protection.
Contractors (Current): 0 partners. No existing agreements use the contractor framework introduced by the CPRA. The contractor classification requires a written contract with heightened restrictions, including a prohibition on combining personal information from multiple sources and a certification by the contractor that it understands and will comply with the restrictions. No Cascade partner agreement includes these provisions. For certain partners whose processing activities may be better suited to the contractor model (e.g., partners that receive personal information for use in developing analytics products that are returned exclusively to Cascade), we recommend that the contractor template be used in lieu of the service-provider template.
Third Parties (Default — No Agreement): 23 partners. Twenty-three of the forty-seven partners have no executed data-processing agreement of any kind. In some cases, the data-sharing relationship was established informally through the deployment of a tracking pixel or tag on cascade.com without a corresponding written agreement. In other cases, the relationship was established through a verbal arrangement between Cascade's marketing team and the partner's account representative. Regardless of the circumstances, the absence of any written contract means that these partners cannot qualify as service providers or contractors under the CCPA/CPRA, and cannot qualify as processors under the other Applicable State Statutes. All data transfers to these twenty-three partners default to third-party transfers and likely constitute "sale" or "sharing" of personal information.
Third Parties (With Agreement but Inadequate Terms): 12 partners. Twelve of the forty-seven partners have some form of written agreement with Cascade, but the agreement does not include the CCPA/CPRA-mandated service-provider or contractor restrictions. These agreements consist of media insertion orders, platform terms of service, master services agreements with generic data-use terms, or advertising-platform clickthrough agreements. While these agreements may include general confidentiality obligations and data-use limitations, they do not include the specific restrictions required by the CCPA/CPRA (e.g., prohibition on selling or sharing the personal information, prohibition on use for purposes other than those specified in the contract, prohibition on data commingling) or the processor obligations required by other Applicable State Statutes. Accordingly, these twelve partners also cannot qualify as service providers or contractors, and data transfers to them likely constitute "sale" or "sharing."
Total partners classified as receiving data in a manner constituting "sale" or "sharing": 35 of 47. This total comprises the twenty-three partners with no DPA and the twelve partners with inadequate agreements. This represents approximately 74.5% of Cascade's third-party advertising and analytics partner base. The compliance exposure arising from these thirty-five relationships is substantial and pervasive.
C. Detailed Classification Table
The complete partner classification table is attached as Appendix A. The table includes the following fields for each of the forty-seven partners: Partner Number, Partner Name (coded), Data Categories Received, Purpose of Processing, Current Contractual Status, Recommended CCPA Classification, DPA Priority Tier (1 = High, 2 = Medium, 3 = Low), and Multi-State Risk Notes.
For purposes of this memorandum, the partners have been organized into three priority tiers based on the volume and sensitivity of data received, the degree to which the arrangement constitutes a "sale" or "sharing," the regulatory-risk profile, and the complexity of the anticipated DPA negotiation:
Tier 1 — High Priority (8 partners): These are the partners receiving the highest volume and most sensitive categories of personal information, and/or where the data-sharing arrangement most clearly and unambiguously constitutes a "sale" or "sharing" of personal information. Thornbridge Media Corp. is the single highest-priority partner within this tier and is addressed separately in Section V below. The remaining seven Tier 1 partners include programmatic-advertising platforms, retargeting networks, and audience-data exchanges that receive behavioral data, precise geolocation, and Peakview-generated inferences. None of the eight Tier 1 partners have executed DPAs. The target for DPA execution with all Tier 1 partners is the end of October 2025.
Tier 2 — Medium Priority (15 partners): These are partners with moderate data flows, including analytics providers, secondary ad-tech vendors, and marketing-attribution platforms. Some of these partners receive data that could be restructured as service-provider processing (e.g., by eliminating data commingling and restricting the partner's use to Cascade-directed purposes), while others receive data for purposes that more clearly constitute "sharing" or "targeted advertising." Eight of these fifteen partners lack any DPA; the remaining seven have agreements with inadequate terms. The target for DPA execution with all Tier 2 partners is the end of November 2025.
Tier 3 — Lower Priority (24 partners): These are partners with limited data categories (e.g., aggregated analytics, email-delivery services, A/B testing tools) or where existing agreements provide a baseline of protection. Twelve of these twenty-four partners have existing service-provider-type agreements requiring updates; twelve have no DPA but the data flows are limited in volume and sensitivity. Some Tier 3 relationships may be restructured to eliminate the sharing of personal information entirely (e.g., by switching to aggregated or de-identified data feeds). The target for DPA execution or amendment with all Tier 3 partners is the end of December 2025.
The complete table in Appendix A provides the granular detail necessary for the DPA rollout and for the forthcoming Comprehensive Gap-Analysis Report.
V. Thornbridge Media Corp. — Detailed Risk Assessment
A. Relationship Overview
Thornbridge Media Corp. ("Thornbridge") is a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. The company is led by Chief Executive Officer Robert Shin, and its General Counsel is Leah Voss. Thornbridge's outside counsel for privacy and data-governance matters is the firm of Kellner Park & Associates LLP, a California limited liability partnership, with lead attorney Victor Sandoval located at 555 Mission Street, 32nd Floor, San Francisco, California 94105.
Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. In FY2024, Cascade's total spend with Thornbridge was approximately $18.4 million, making Thornbridge the single largest advertising-technology vendor in Cascade's partner ecosystem. The relationship encompasses programmatic media buying, audience segmentation and targeting, real-time bidding, retargeting, and attribution analytics.
Thornbridge receives a broad range of consumer behavioral data from Cascade, including browsing history (page views, product views, search queries on cascade.com), purchase history (transaction records, product categories, purchase amounts, purchase frequency), device identifiers (device fingerprints, advertising IDs, cookie identifiers), precise geolocation data (latitude/longitude coordinates from the Cascade mobile application), and Peakview-generated audience segments and propensity scores (e.g., purchase likelihood scores, category-affinity scores, churn-risk assessments).
The data flows between Cascade and Thornbridge are bidirectional. In the outbound direction, Cascade (via Peakview Analytics) transmits consumer personal information to Thornbridge for the purpose of audience matching, lookalike modeling, and real-time ad targeting. Peakview uploads audience segments to Thornbridge's platform on a daily basis and integrates with Thornbridge's real-time bidding infrastructure for programmatic ad placement. In the inbound direction, Thornbridge returns performance analytics (impressions, clicks, conversions, cost-per-acquisition data), attribution data, and enriched audience segments to Cascade. These enriched audience segments incorporate Thornbridge's own proprietary data and data from Thornbridge's other clients, meaning that Cascade receives data-enrichment benefits that constitute valuable consideration for purposes of the CCPA/CPRA "sale" analysis.
A data-flow diagram illustrating the Cascade-Thornbridge data-sharing arrangement is attached as Appendix C.
B. Sale/Sharing Analysis
Based on our analysis, the Cascade-Thornbridge arrangement constitutes both a "sale" and a "sharing" of personal information under the CCPA/CPRA:
"Sale." Cascade receives valuable consideration from Thornbridge in exchange for making consumer personal information available. This consideration takes several forms: (i) reduced media rates (Thornbridge offers Cascade preferred pricing that reflects the value of the consumer data Cascade provides); (ii) enriched audience data (Thornbridge returns audience segments that incorporate Thornbridge's own data and data from other sources, providing Cascade with analytics capabilities it would otherwise need to develop or purchase separately); and (iii) attribution analytics and performance reporting (Thornbridge provides Cascade with detailed campaign-performance data that Cascade uses for marketing optimization and budget allocation). Each of these forms of value constitutes "other valuable consideration" within the meaning of California Civil Code § 1798.140(ad).
"Sharing." Thornbridge uses Cascade consumer data for cross-context behavioral advertising—this is the core purpose and raison d'être of the relationship. Thornbridge's platform matches Cascade consumer data with behavioral signals from other websites, applications, and services to target advertisements to Cascade consumers across the internet. This activity falls squarely within the definition of "sharing" under California Civil Code § 1798.140(ah), regardless of whether monetary or other consideration is exchanged. The fact that Thornbridge also receives monetary consideration does not alter the sharing analysis; the two classifications are independent and additive.
Under the VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), and other Applicable State Statutes, the Thornbridge arrangement constitutes "targeted advertising" from which consumers must be able to opt out. The targeted-advertising opt-out requirements in these states are functionally equivalent to the CCPA/CPRA's "sharing" opt-out requirement and apply to the same category of advertising-partner data sharing.
Contractual Deficiencies. There is no current agreement between Cascade and Thornbridge that contains any CCPA service-provider or contractor restrictions. The existing commercial arrangement is governed by a master media-buying agreement that includes generic data-use terms but does not include: a prohibition on selling or sharing the personal information; a restriction on using the personal information for purposes beyond those specified in the contract; a prohibition on combining Cascade personal information with data from other sources; obligations to honor consumer opt-out-of-sale/sharing signals; obligations to process consumer deletion or access requests; audit rights for Cascade; breach-notification obligations; sub-processor restrictions; or data-minimization provisions.
Data Commingling. Thornbridge commingles Cascade consumer data with data from its other advertising clients as a core part of its business model. Thornbridge's platform aggregates consumer data from multiple client sources to build comprehensive consumer profiles used for audience targeting across its network. This commingling is fundamentally incompatible with service-provider or contractor status under the CCPA/CPRA, even if the contractual deficiencies were remedied.
C. Specific Risk Factors
The Thornbridge relationship presents the following specific risk factors that elevate it to the highest priority:
Volume. Peakview Analytics transmits consumer-event records to Thornbridge at a rate of hundreds of millions of events per month. While the precise figure varies by month and campaign cycle, the Fieldhaven Data-Mapping Report documented an average of approximately 340 million consumer-event records transmitted to Thornbridge per month during the Q1 2025 measurement period. This represents approximately 16% of the total 2.1 billion consumer-event records processed by Peakview monthly. The sheer volume of data flowing to Thornbridge amplifies the compliance exposure and the potential harm to consumers in the event of misuse or breach.
Sensitivity. The data transmitted to Thornbridge includes precise geolocation data collected from the Cascade mobile application. Under CCPA/CPRA § 1798.140(ae) and § 1798.121, precise geolocation data (defined as location information sufficient to identify a consumer's location within a radius of 1,850 feet) constitutes sensitive personal information for which businesses must provide consumers with the right to limit the use and disclosure of such information. Several other Applicable State Statutes—including the CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), and OCPA (Oregon)—similarly classify precise geolocation as a sensitive data category subject to heightened requirements. Cascade does not currently obtain separate opt-in consent before transmitting precise geolocation data to Thornbridge, and Thornbridge does not limit its use of geolocation data to purposes directed by Cascade.
Failure to Honor GPC. Cascade does not currently honor GPC signals or transmit any form of universal opt-out signals to Thornbridge. Under CCPA/CPRA regulations (11 CCR § 7025), a business must treat an opt-out preference signal (including GPC) as a valid request to opt out of the sale and sharing of personal information. Cascade's failure to honor GPC signals means that consumers who have activated GPC in their browsers are not receiving the statutory protection to which they are entitled with respect to the Thornbridge data sharing.
California AG Inquiry. As discussed in Section II.C above, the California Attorney General's February 2024 informal inquiry letter specifically highlighted deficiencies in Cascade's service-provider agreements and "Do Not Sell" mechanisms. The Thornbridge relationship—as Cascade's largest advertising-partner arrangement involving the highest data volumes and no DPA—is a primary driver of the deficiencies flagged by the AG. The continued absence of a compliant agreement with Thornbridge exposes Cascade to elevated enforcement risk in the event the AG revisits the matter.
Failure to Forward Consumer Rights Requests. Cascade received approximately 6,500 opt-out-of-sale/sharing requests in FY2024. None of these requests were communicated to Thornbridge, meaning that consumers who exercised their opt-out rights continued to have their personal information transmitted to Thornbridge for sale and sharing purposes without interruption. Similarly, Cascade received approximately 19,100 deletion requests in FY2024, none of which were forwarded to Thornbridge for downstream deletion of the consumer's data from Thornbridge's systems. These failures represent ongoing, affirmative non-compliance with the CCPA/CPRA's consumer-rights provisions.
Regulatory and Litigation Exposure. The combination of (i) the volume of data involved, (ii) the inclusion of sensitive personal information, (iii) the absence of any contractual protections, (iv) the failure to honor opt-out requests, and (v) the AG's prior inquiry creates a risk profile that is materially elevated relative to other partner relationships. In the event of a regulatory enforcement action—whether by the California AG, the CPPA, or an AG in another state with an applicable statute—the Thornbridge relationship is likely to be a focal point of the investigation. Additionally, the CCPA provides a private right of action for data breaches resulting from a business's failure to implement and maintain reasonable security procedures and practices (§ 1798.150). While the private right of action is limited to data breaches and does not directly apply to non-compliance with opt-out requirements, the absence of contractual controls governing Thornbridge's security practices increases the risk that a security incident affecting the shared data could give rise to class-action litigation.
D. Recommended Actions for Thornbridge
Based on the foregoing analysis, we recommend the following actions specific to the Thornbridge relationship:
1. Immediately initiate negotiation of a restructured data-sharing agreement with Thornbridge. Alan Burke and Sara Hendricks (Calderwood & Harkness) should contact Victor Sandoval at Kellner Park & Associates LLP and Leah Voss at Thornbridge to schedule an initial meeting and transmit a term sheet for the proposed restructured arrangement. Given the nature and scale of the relationship, the Thornbridge agreement should be a bespoke data-sharing agreement rather than a deployment of the standardized DPA template.
2. Target execution date: October 31, 2025. This target reflects both the urgency of the compliance exposure and the anticipated complexity of the negotiation. Thornbridge has significant commercial leverage as Cascade's largest advertising partner, and we anticipate that certain provisions—particularly the restrictions on data commingling and the requirement to honor opt-out signals in real time—will be subject to extended negotiation.
3. Key terms to negotiate:
(a) Sale/Sharing Acknowledgment: The agreement should include an express acknowledgment that the data sharing constitutes a "sale" and "sharing" of personal information under the CCPA/CPRA, triggering the corresponding consumer opt-out rights.
(b) Opt-Out signal compliance: Thornbridge must agree to honor consumer opt-out-of-sale/sharing signals, including GPC, in real time. This requires Thornbridge to implement a technical mechanism for receiving and acting on opt-out signals transmitted by Cascade or by the CMP.
(c) Consumer Rights Request Processing: Thornbridge must agree to process consumer deletion and access requests forwarded by Cascade within contractually specified timeframes.
(d) Data-Use Restrictions: The agreement should prohibit Thornbridge from combining Cascade consumer data with data from other sources for purposes beyond the Cascade advertising relationship. This provision will be among the most difficult to negotiate, as data commingling is integral to Thornbridge's business model.
(e) Data Minimization and Purpose Limitation: Thornbridge's use of Cascade consumer data must be limited to the specific purposes set forth in the agreement, and data collected or received should be limited to what is reasonably necessary for those purposes.
(f) Audit Rights: Cascade must have the right to audit Thornbridge's data-processing activities, including the right to conduct or commission periodic assessments of Thornbridge's compliance with the agreement's restrictions.
(g) Breach Notification: Thornbridge must provide Cascade with notice of any data breach affecting Cascade consumer data within a specified timeframe (we recommend seventy-two (72) hours of discovery).
(h) Indemnification: Thornbridge should indemnify Cascade for regulatory fines, penalties, and enforcement costs arising from Thornbridge's non-compliance with the agreement's terms or with applicable privacy law.
(i) Sub-Processor Restrictions: Thornbridge must obtain Cascade's prior written approval before engaging sub-processors to process Cascade consumer data, and must ensure that sub-processors are bound by obligations no less restrictive than those in the agreement.
4. Privacy Policy and Opt-Out Updates. In parallel with the Thornbridge negotiation, Cascade should update its privacy policy and consumer-facing opt-out mechanisms to disclose the Thornbridge sharing arrangement and provide effective opt-out functionality. The target date for these updates is December 31, 2025, though we recommend completing them as soon as the CMP deployment permits.
5. Immediate Cessation of Geolocation Sharing. We recommend that Cascade immediately cease transmitting precise geolocation data to Thornbridge until a separate opt-in consent mechanism is implemented. This recommendation is consistent with the sensitive-PI workstream addressed in the memorandum dated July 28, 2025.
VI. Risk Assessment of Remaining Partners
A. Tier 1 Partners (High Priority — Excluding Thornbridge)
In addition to Thornbridge, seven (7) other partners have been classified as Tier 1 (High Priority). These seven partners are identified by coded reference in the complete classification table (Appendix A) and share the following common characteristics:
Each of the seven Tier 1 partners receives consumer behavioral data from Cascade for purposes of retargeting, audience extension, lookalike modeling, or programmatic ad placement. The data categories transmitted include, at a minimum, identifiers (hashed email addresses, device identifiers, cookie identifiers), commercial information (purchase history, browsing behavior), and internet/network activity (click-stream data, session data). Several of these partners also receive precise geolocation data from the Cascade mobile application, raising the same sensitive-personal-information concerns identified in the Thornbridge analysis above.
None of the seven Tier 1 partners have executed DPAs with Cascade. The existing commercial arrangements with these partners are governed exclusively by media insertion orders or platform terms of service that do not include any CCPA/CPRA-required service-provider, contractor, or processor restrictions. In several cases, there is no written agreement of any kind—the data-sharing relationship was established through the deployment of a tracking pixel on cascade.com pursuant to a verbal arrangement with the partner's account representative.
The specific risk factors for each Tier 1 partner are summarized as follows:
• Partner T1-02 (programmatic ad platform): Receives approximately 120 million consumer-event records per month from Peakview; commingles Cascade data with data from other advertising clients; receives precise geolocation data; no DPA; no DSR forwarding mechanism.
• Partner T1-03 (retargeting network): Receives browsing-behavior data and purchase-history data via pixel integration; uses data to retarget Cascade consumers across its publisher network; Cascade receives reciprocal retargeting analytics constituting valuable consideration; no DPA.
• Partner T1-04 (audience-data exchange): Receives Peakview-generated audience segments and propensity scores; combines with proprietary data to create enriched audience segments sold to other advertisers; Cascade receives enriched segments in return; data transfer constitutes "sale" under both monetary and other-valuable-consideration definitions; no DPA.
• Partner T1-05 (demand-side platform): Receives real-time bidding data including device identifiers and behavioral signals; no Cascade-specific contractual terms; data transmitted through RTB protocol is accessible to downstream ad exchanges and supply-side platforms; no DPA.
• Partner T1-06 (social-media advertising platform): Receives hashed email addresses and customer-list data for custom-audience matching and lookalike modeling; platform terms of service provide for platform's right to use uploaded data for its own product improvement; no CCPA-compliant restrictions; no DPA beyond platform's standard clickthrough terms.
• Partner T1-07 (cross-device identity-resolution provider): Receives device identifiers, IP addresses, and cookie identifiers; links consumer identities across devices and returns cross-device graphs to Cascade; commingles Cascade data with data from other clients; provides valuable consideration in the form of identity-resolution services; no DPA.
• Partner T1-08 (connected-TV advertising platform): Receives purchase-history data and audience segments for targeting Cascade advertisements on connected-TV inventory; receives precise geolocation data; no DPA; no opt-out mechanism.
Risk Rating: High. Data transfers to these seven partners constitute sale and/or sharing of personal information, and no contractual protections are in place. The absence of DPAs, combined with the volume and sensitivity of data involved, creates material compliance exposure. Each of these partners should receive a DPA or a bespoke data-sharing agreement by the end of October 2025.
B. Tier 2 Partners (Medium Priority)
Fifteen (15) partners have been classified as Tier 2 (Medium Priority). These partners receive moderate data flows from Cascade and represent a mix of analytics providers and secondary ad-tech vendors. The data categories and volumes are generally lower than those for Tier 1 partners, and several of these relationships may be restructurable as service-provider or processor arrangements with appropriate contractual terms and operational controls.
Of the fifteen Tier 2 partners, eight (8) lack any DPA, and the remaining seven (7) have agreements with inadequate terms. The agreements in place with the seven partners are typically master services agreements or platform terms of service that include general data-use and confidentiality provisions but do not include the CCPA/CPRA-specific restrictions necessary for service-provider or contractor qualification.
For those Tier 2 partners whose processing activities are consistent with a service-provider role—e.g., analytics providers that process data exclusively at Cascade's direction and do not combine Cascade data with data from other sources—restructuring is feasible. The key operational changes required include: (i) elimination of data commingling (requiring the partner to maintain Cascade data in a segregated environment or logical partition); (ii) restriction of data use to purposes specified in the DPA; and (iii) implementation of DSR-forwarding capabilities. These operational changes should be negotiated as part of the DPA deployment.
For those Tier 2 partners whose processing activities are inherently cross-context (e.g., secondary ad-tech vendors that use Cascade data for targeted advertising across their networks), service-provider classification may not be achiev

CALDERWOOD & HARKNESS LLP MEMORANDUM

Record

Parties

Dates

Amounts