PubMatic is a sell-side ad exchange/SSP; PubMatic, Inc. is a public company (NASDAQ: PUBM), Delaware-incorporated and headquartered in Redwood City, California (SEC EDGAR CIK 0001422930). Its Advertiser Platform Privacy Policy states it collects unique online and device identifiers, mobile advertising identifiers, IP addresses, browser/device information and ad-impression browsing history directly, and separately receives demographic and geolocation data, hashed emails and other identifiers from partners; it describes ID syncing, cookies and similar technologies (pixels, web beacons, device fingerprinting, local storage) used to recognize and track browsing behavior, and states some of its ad-targeting and data-linking activities may constitute a 'sale' or 'sharing' of personal information under state privacy laws, offering an opt-out via Global Privacy Control. In January 2026, a federal judge in the Northern District of California ruled that a putative class action alleging PubMatic tracked users via cookies/device identifiers, traded data with brokers, and built detailed ad-targeting profiles could proceed on wiretap and intrusion-upon-seclusion claims, denying PubMatic's motion to dismiss those counts (an unresolved but judicially-vetted allegation, not a judgment). No FTC action or data breach was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
5 ON FILE
COLLECTION
PubMatic's Advertiser Platform Privacy Policy states it collects pseudonymous User Information directly, including unique online and device identifiers, mobile device advertising identifiers, IP addresses, browser and device information, and web browsing history from advertising impressions, and separately receives demographic data and Geolocation Information (derived from IP address) and obfuscated identifiers such as hashed email addresses from Publishers and other partners.
SEC EDGAR's company-filings listing confirms PubMatic, Inc. (formerly Komli Inc.) is a public filer, CIK 0001422930, incorporated in Delaware and headquartered at 601 Marshall Street, Redwood City, CA, with a filing history including annual 10-K reports.
PubMatic's privacy policy states that some of its ad-personalization and data-combination activities 'may be considered "sales" or "sharing" of your personal information' or use of information for 'targeted advertising' under certain state privacy laws, and offers an opt-out via recognized opt-out preference signals such as Global Privacy Control; it separately states PubMatic does not knowingly sell or share personal information about consumers under 18.
MediaPost reported that on January 30, 2026, U.S. District Judge Susan Illston (N.D. Cal.) ruled that web users could proceed with wiretap and intrusion-upon-seclusion claims against PubMatic, in a putative class action alleging PubMatic used cookies and device identifiers to collect browsing data, traded that data with other data brokers, and built ad-targeting profiles that categorized plaintiffs by attributes such as 'credit risk,' 'yearly household income' and 'affluence level'; the court found plaintiffs had adequately pled a 'highly offensive' intrusion of privacy, denying PubMatic's motion to dismiss those claims (though granting dismissal of an unjust-enrichment claim per subsequent reporting not independently verified here).
PubMatic's privacy policy defines ID syncing as 'the matching of two or more unique identifiers linked to the same individual,' and states it and its partners use cookies, online identifiers, pixels, web beacons, device fingerprinting technologies, local storage and eTags to recognize and track browsing behavior, and that Publishers, Media Buyers and Clients may use shared information to establish connections among a user's related devices (phone, tablet, computer) for targeted advertising.