AdRoll is a retargeting and multi-channel advertising platform, operated as a product of NextRoll, Inc. (formerly AdRoll, Inc.), a privately held company headquartered in San Francisco. Its business is interest-based advertising for e-commerce brands: a pixel and first- and third-party cookies placed on customer sites collect identifiers, IP addresses, browsing activity, and hashed email addresses, which feed a cross-device graph that links browsers and devices to one person or household for ad targeting across web, social, connected TV, and digital out-of-home. NextRoll's CCPA notice states it has shared and/or sold cookie-string data, hashed emails, and browsing information to advertising partners, and the company is a registered California data broker. It supplements its own collection with audience segments from Bombora, Experian, Eyeota, and Perion. Mitigations include published retention windows, EU consent-based processing under the IAB TCF, NAI and DAA membership, Global Privacy Control support, and annually published CCPA request metrics. No public regulator enforcement action against AdRoll or NextRoll was identified.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
NextRoll's own GDPR guidance acknowledges that the data types its advertising business relies on — cookies, mobile IDs, and location data — constitute personal data under the GDPR, and states the company built a cookie consent tool and joined the IAB EU industry framework to obtain transparency and consent for that collection in the EU.
NextRoll's Service Privacy Notice states that, absent opt-out or refused consent, AdRoll automatically collects device identifiers (including cookies, Apple IDFA and Android Advertising ID), IP address, browsing activity, and hashed email addresses, and additionally acquires audience segments about users from third-party Audience Partners named as Bombora, Experian, Eyeota, and Perion. The notice publishes retention windows, including deletion of advertising bid-request logs after 7 days and of browsing-history data linked to identifiers after 12 months.
NextRoll appears on the Network Advertising Initiative's public member list, which identifies it as a privately held company headquartered in San Francisco — meaning ownership and financials are not subject to public-company disclosure, though the corporate identity itself is plainly disclosed.
NextRoll's California data broker registry entry publicly discloses its legal entity name, contact email, website, and physical headquarters address, providing a verifiable corporate identity for the AdRoll business.
AdRoll is not an independent company: its Website Privacy Notice identifies the operating entity as NextRoll, Inc., formerly AdRoll, Inc., and describes AdRoll and AdRoll ABM as NextRoll services for direct-to-consumer and B2B marketing respectively.
NextRoll maintains a consolidated 'Your Privacy Choices' page offering opt-outs from sale/sharing and targeted advertising under the privacy laws of at least ten US states, including California, Colorado, Connecticut, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Utah, and Virginia — a mitigation that still places the burden of opting out on the user.
NextRoll, Inc. is listed in California's data broker registry (registration date recorded as 2/12/2020), and its registry disclosure describes the sale of consumers' business email addresses through its B2B marketing platform, with an emailed notice-and-opt-out mechanism for affected consumers.
NextRoll's California notice states in its own words that in the preceding twelve months it 'shared, and/or sold' personal information for cross-context behavioral advertising — specifically Category A identifiers (cookie string data and hashed emails) shared and/or sold to Advertising Partners, and Category F browsing information (page views, ads served or clicked) shared and/or sold to NextRoll customers.
NextRoll states it is a member of the Network Advertising Initiative and complies with the DAA's self-regulatory principles for online behavioral advertising, and that its systems automatically honor Global Privacy Control signals as valid opt-outs of sale/sharing. These are self-regulatory memberships and self-attested practices rather than independent audits; no public regulator enforcement action against AdRoll or NextRoll was identified in research for this dossier.
NextRoll self-publishes annual CCPA request metrics: for calendar year 2025 it reports receiving 7,147 opt-out requests and complying with all 7,147 (mean response 1 day), along with 36 deletion requests and 4 requests to know, all reported as complied with. These figures are self-reported by the company, not independently verified.
Ghostery's WhoTracks.Me dataset (May 2017–June 2026) ranks AdRoll 337 of 827 measured trackers, observes its tracker on 181 of the top 10,000 websites reaching about 0.1% of web traffic via cookies, and categorizes it as an advertising tracker.
NextRoll publishes a formal attestation of adherence to the IAB Transparency and Consent Framework and operates a consent management platform under it, committing to disclosure of data collection and user controls for its EU tracking — a self-attested rather than independently audited commitment.
AdRoll's tracking stack spans first- and third-party cookies (named __adroll, __ar_v4, _adroll_shared, and __adroll_fpc), tracking pixels, alternative identifiers, server-to-server data transmission, mobile advertising IDs, and CTV/DOOH identifiers. A proprietary cross-device asset connects multiple devices to one person or household — including via hashed email addresses — so ads can be targeted, capped, and sequenced across devices, and identifiers are synced with ad exchanges and other advertising partners.