Extract to table

The forthcoming omnibus privacy policy (an initial draft of which was circulated internally on September 12, 2025) will require specific disclosures regarding the Thornbridge relationship, and those disclosures must be supported by contractual provisions in the restructured DSA

(target deployment date December 15, 2025) is intended to close this gap on the Cascade side, but the Thornbridge DSA must be in place to operationalize GPC signal pass-through on the downstream side

Under these statutes, consumers have the right to opt out of the sale of personal information and/or targeted advertising, and businesses must honor opt-out signals, including GPC where applicable

The restructured DSA must address compliance obligations across all applicable jurisdictions, not only California

This carve-out would be subject to the following conditions: (i) The combined data may be used only to perform services directed by Cascade under the DSA and may not be used for the benefit of any other Thornbridge client, for the development of Thornbridge's proprietary data products, or for any purpose not expressly authorized by Cascade in writing; (ii) Thornbridge must maintain technical and organizational controls to segregate combined datasets from Thornbridge's general-purpose data assets; (iii) Combined datasets must be subject to the same use restrictions, opt-out obligations, and audit rights applicable to Cascade consumer PI under the DSA; and (iv) Thornbridge must provide annual written certification from its privacy officer confirming compliance with the combination restrictions

Under this provision, when a consumer has enabled GPC in their browser or device settings, Cascade will include a GPC flag in its data transmissions to Thornbridge, and Thornbridge must suppress the sale and/or sharing of that consumer's personal information immediately upon receipt of the GPC signal