PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT. This email and any attachments are protected by the attorney-client privilege and/or work-product doctrine. Do not forward or disclose without prior authorization from Calderwood & Harkness LLP.
Diana and Kevin,
I am writing to update you on the status of negotiations with Thornbridge Media Corp. regarding the restructured data-sharing agreement. On Friday, October 10, 2025, we received the marked-up counterproposal from Kellner Park & Associates LLP (Victor Sandoval) reflecting Thornbridge's positions. I have attached the redline (Thornbridge_DSA_Redline_v3_KPA_Comments_10.10.2025.docx) separately via secure file transfer for your review.
The counterproposal follows the negotiation call held on October 7, 2025, between myself, Sara Hendricks, Victor Sandoval, and Leah Voss (Thornbridge General Counsel). While the parties made progress on a number of provisions during that call, the counterproposal surfaces several significant open issues that will require further discussion before the agreement can be finalized. I want to flag at the outset that the target execution date of October 31, 2025 is tight given the number and substance of the issues that remain. Matter reference: 1038-00010.
**Brief Background**
As you know, the Thornbridge relationship is Cascade's primary programmatic-advertising and audience-targeting partnership, representing FY2024 spend of approximately $18.4 million. The restructured agreement is necessary to address the classification of the data-sharing arrangement under CCPA/CPRA and the other applicable state privacy statutes currently in scope (19 state statutes at present). The Third-Party Data-Sharing Risk Assessment flagged this relationship as highest-priority given the volume of behavioral data exchanged and the programmatic-advertising use case. Importantly, 23 of Cascade's 47 advertising and analytics partners currently lack executed DPAs — the Thornbridge agreement is intended to serve as the benchmark for the broader rollout, so the positions we establish here will have downstream implications.
**Summary of Key Open Issues from the Thornbridge/KP&A Counterproposal**
I have organized the major open issues below with our analysis and recommendations.
**1. Combined-Data Rights (Section 4.2)**
Thornbridge's counterproposal seeks to retain the right to combine Cascade consumer data with data Thornbridge receives from other clients and sources for purposes of modeling, lookalike-audience creation, and cross-platform analytics. Our draft requires Thornbridge to process Cascade data solely for the specified business purposes enumerated in Exhibit A and prohibits combination with third-party data.
This is the most consequential issue in the negotiation. Combined use of Cascade consumer data with data from Thornbridge's other clients would very likely constitute a "sale" or "sharing" under CCPA/CPRA and analogous state laws, which would defeat the fundamental purpose of the restructured agreement. Specifically, it would be incompatible with CCPA service-provider or contractor classification and would undermine Cascade's ability to represent to consumers that it does not "sell" or "share" their personal information — or to honor opt-out requests in a meaningful way.
*Recommendation:* Hold firm on this point. We recommend offering a narrowly tailored exception for aggregated, de-identified statistical analysis that meets the CCPA de-identification standard under Cal. Civ. Code § 1798.140(m), coupled with contractual safeguards against re-identification (including technical and organizational measures). This may address Thornbridge's stated interest in cross-platform benchmarking without compromising the privacy-law framework. However, before we propose this carve-out, we would benefit from marketing's input on whether it would address Thornbridge's practical needs (see next steps below).
**2. Global Privacy Control (GPC) Signal Pass-Through (Section 6.1)**
Thornbridge resists Cascade's requirement for real-time pass-through of GPC and universal opt-out signals to Thornbridge's systems. Instead, Thornbridge proposes a batch-file opt-out list updated on a weekly basis.
This is problematic. California's CCPA regulations (11 CCR § 7025) require that businesses treat GPC signals as valid opt-out-of-sale/sharing requests. A weekly batch process creates a gap of up to seven days during which consumer data may continue to be shared in violation of the consumer's expressed preference. Colorado, Connecticut, Texas, Montana, and other states have similar or forthcoming universal-opt-out requirements, compounding the risk.
*Recommendation:* Insist on real-time or near-real-time signal honoring. As a reasonable technical compromise, we would propose a 24-hour maximum processing window. Fieldhaven's CMP deployment (target: December 15, 2025) with OnPoint Data Solutions' consent-management platform is being designed to emit opt-out signals via API, and Thornbridge should be able to integrate via API on its end. We recommend scheduling a technical working session between Cascade's team (Gregory Farris and Priya Nandakumar), Fieldhaven (Marcus Ellerby), and Thornbridge's technical team to explore implementation specifics and remove any claimed technical barriers.
**3. Audit Rights (Section 9.3)**
Thornbridge proposes limiting Cascade's audit right to no more than once per calendar year, with 60 days' advance written notice and Thornbridge's right to use a third-party auditor of its own choosing.
While annual audits may be reasonable for routine compliance verification, Cascade needs the contractual right to conduct additional audits (a) upon reasonable suspicion of a breach or non-compliance and (b) in response to a regulatory inquiry or investigation. The CCPA and several other state statutes contemplate that businesses must be able to verify service-provider and contractor compliance, and a rigid once-per-year limitation could leave Cascade unable to meet those obligations in a time-sensitive situation.
*Recommendation:* Accept the once-per-year baseline for routine audits, but add carve-outs for cause-based audits (no frequency cap, with reasonable notice of 15 business days) and regulatory-driven audits (no notice-period limitation). We should also push back on Thornbridge's unilateral right to select the third-party auditor. We recommend proposing either mutual agreement on auditor selection or, alternatively, Cascade's right to select an auditor from a pre-approved list agreed upon by both parties.
**4. Indemnification for Regulatory Fines and Penalties (Section 12.1)**
Thornbridge's counterproposal caps indemnification for regulatory fines and penalties at the lesser of (a) fees paid by Cascade to Thornbridge in the 12 months preceding the claim or (b) $5 million. Thornbridge also carves out any fines attributable to Cascade's own acts or omissions.
Given FY2024 spend of $18.4 million, the 12-month-fee cap is not unreasonable as an outer bound for general indemnification. However, the flat $5 million cap may be inadequate. A regulatory enforcement action under CCPA (up to $7,500 per intentional violation) or a state attorney general action targeting data-sharing practices at scale could generate exposure well in excess of $5 million — Cascade processes approximately 2.1 billion consumer-event records per month through Peakview, and a meaningful subset of that data flows to Thornbridge.
*Recommendation:* Propose removing the $5 million flat cap in favor of the 12-month-fee cap alone (approximately $18.4 million based on current spend levels), which provides a commercially reasonable limitation without creating a gap in coverage for large-scale regulatory actions. The carve-out for Cascade's own acts or omissions is reasonable, and we recommend accepting it. We should also request mutual indemnification — Cascade indemnifies Thornbridge for Cascade's own non-compliance, and Thornbridge indemnifies Cascade for Thornbridge's non-compliance with the agreement's data-handling obligations.
**Additional Minor Issues**
A few lower-priority points from the counterproposal are worth noting briefly:
(a) *Breach Notification Window:* Thornbridge requests extending the breach-notification window from 48 hours to 72 hours. We are willing to accept 72 hours, which is aligned with most state-law notification requirements.
(b) *Post-Termination Deletion Timeline:* Thornbridge proposes 90 days for data deletion post-termination versus the 30 days in Cascade's draft. We recommend compromising at 45 days, which provides Thornbridge reasonable operational runway while keeping the timeline within an acceptable range.
(c) *Governing Law:* Thornbridge proposes Nevada; Cascade's draft specifies Washington. We recommend holding on Washington given Cascade's headquarters location and the fact that the majority of its consumer base falls within the Pacific Northwest region.
**Recommended Next Steps**
1. We recommend scheduling a follow-up negotiation call with Victor Sandoval and Leah Voss for the week of October 20, 2025, to address the four major open issues outlined above.
2. Sara and I will prepare a revised redline reflecting Calderwood & Harkness's recommended positions for your review, Diana, by end of day Friday, October 17, 2025.
3. Diana, could you coordinate internally with Jason Leclaire (VP, Marketing & Customer Engagement) to confirm Cascade's business-side flexibility, if any, on the combined-data-rights issue? Specifically, it would be helpful to understand whether the aggregated/de-identified carve-out described above would address Thornbridge's stated needs from marketing's perspective, or whether Thornbridge's ask is fundamentally about identified-level data combination.
4. Diana, we would also ask that you loop in Gregory Farris and Priya Nandakumar regarding the technical feasibility of the real-time GPC signal pass-through so that we can speak to implementation specifics with confidence on the next call.
5. Finally, I want to flag that if the major issues are not substantially resolved during or shortly after the week of October 20, the October 31, 2025 execution target is at risk. In that event, we recommend that the parties consider executing a binding term sheet or interim data-handling protocol by October 31 to maintain compliance momentum, with a definitive agreement to follow on an expedited timeline. We can prepare either document quickly if needed.
Please let me know if you would like to discuss any of the above by phone — I am available at your convenience, and Sara is as well. We are happy to walk through any of the issues in more detail.
Best regards,
Alan Burke Senior Associate, Privacy & Data Security Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022 Tel: (212) 554-3180 Email: aburke@calderwoodharkness.com
Matter: Cascade Retail Holdings Inc. — US State Privacy Compliance Program (Matter No. 1038-00010)