Data Sovereignty in Ad Tech: CLOUD Act, Residency, EU Stack

Hosting in an EU region of a US-controlled cloud gives data residency, not data sovereignty. The US CLOUD Act reaches data a US provider controls wherever it sits. Sovereignty requires that hosting, operations, encryption keys, identity, bidding and support access all stay under EU jurisdiction. This page defines the terms, explains the mechanics and maps an EU-only ad tech stack.

This page is general information for compliance and engineering teams. It is not legal advice. Check the cited texts and your own counsel before relying on it.

The two terms are used interchangeably in vendor material. They are not the same thing. The table below separates the questions a buyer should ask.

Google Cloud stated the technical layer most plainly in its 2022 sovereignty announcement: control of encryption keys "is the strongest and most effective technical measure against extraterritorial requests for data" (Google Cloud, 11 October 2022). The legal layer is the one hyperscalers cannot change by building a data center, and it is the reason this page exists. The business and architecture side is covered across the data sovereignty hub.

The Clarifying Lawful Overseas Use of Data Act was enacted in March 2018 as an amendment to the Stored Communications Act. It added 18 U.S.C. § 2713, which requires a provider of electronic communication or remote computing services to preserve and disclose data in its "possession, custody, or control" regardless of whether the data is located inside or outside the United States (US DOJ, CLOUD Act resources; Congress.gov, H.R. 4943).

Three mechanics matter for an advertising stack.

1. The hook is the provider, not the server. An order is served on a company subject to US jurisdiction, usually a US parent or a subsidiary it controls. The location of the disk is not a defence.
2. The only statutory challenge is comity, and it is narrow. A provider may move to quash an order if the target is not a US person and compliance would create a material risk of violating the law of a "qualifying foreign government". Qualifying status requires an executive agreement. The US has such agreements with the UK (signed 3 October 2019) and Australia (15 December 2021). It has none with the EU or any EU member state (US DOJ).
3. EU law points the other way. GDPR Article 48 says a third-country court or authority decision requiring transfer "may only be recognised or enforceable" if based on an international agreement such as a mutual legal assistance treaty (Regulation (EU) 2016/679, Article 48). The EDPB and EDPS confirmed on 12 July 2019 that a CLOUD Act order alone does not satisfy Article 48 and that Article 49 derogations would apply only in narrow cases (EDPB-EDPS, 12 July 2019).

The result is a conflict of laws that lands on the provider. A US-controlled cloud that receives a valid US order for EU data must choose which law to break. Microsoft France's director of public and legal affairs told a French Senate committee in June 2025 that the company cannot guarantee that French citizens' data would never be handed to US authorities (reported by European Cloud, 24 July 2025; primary transcript not retrieved). The EU's own e-Evidence rules now give EU authorities a mirror-image power over platforms serving the EU (Clifford Chance, August 2026).

For ad tech, the data in question is bid logs, identity graphs, conversion events and segment membership. They are "remote computing service" records like any other.

Whether data may lawfully leave the EU (GDPR Chapter V) is a different question from whether a foreign authority can reach it where it sits (CLOUD Act). You can pass the first test and fail the second.

• Schrems II. On 16 July 2020 the CJEU invalidated the Privacy Shield and held that standard contractual clauses require a case-by-case check of third-country law and, where needed, supplementary measures (CJEU C-311/18, 16 July 2020). The EDPB's Recommendations 01/2020, final version of 18 June 2021, list encryption with keys held in the EU as the primary technical measure (EDPB, 18 June 2021).
• The Data Privacy Framework. The Commission adopted the EU-US DPF adequacy decision on 10 July 2023 (Implementing Decision (EU) 2023/1795). On 3 September 2025 the General Court dismissed the first annulment action, finding the Data Protection Review Court sufficiently independent and US bulk collection proportionate (Hunton, 3 September 2025). Philippe Latombe appealed on 31 October 2025 on four grounds, including that the DPRC is not a "tribunal previously established by law" (OJ C/2025/6610, 22 December 2025). As of 17 October 2026 the appeal is pending. Law firms advise keeping SCCs or BCRs as a fallback (Hogan Lovells, 3 September 2025).
• What a transfer win does not buy. The DPF governs data that leaves the EU. It says nothing about a US order served on a US-controlled provider for data that never left Frankfurt. The DPC's €1.2 billion Meta decision of 22 May 2023, which ordered transfers suspended within five months, is a Chapter V case; sovereignty is about control (DPC, 22 May 2023).

See Data sovereignty defines the future of ad tech for the business argument.

Three common configurations give residency without sovereignty.

1. An EU region of a US cloud. The bytes are in the EU. The operator is a US company. The CLOUD Act hook is complete. Microsoft's EU Data Boundary, completed in February 2025, commits to storing and processing customer data, pseudonymised personal data and support data in the EU and EFTA for core services, and still carves out "limited security cases requiring a coordinated global response" (Microsoft, 26 February 2025). The boundary addresses residency. It does not change who the provider is.

2. An EU subsidiary with EU staff. AWS European Sovereign Cloud is operated "exclusively by EU residents", has "zero operational control outside of EU borders", and sits under a new parent company with three German GmbH subsidiaries and an advisory board of three Amazon employees and two independent members (Amazon, 15 January 2026). This is a real improvement on operational sovereignty. The press release does not mention the CLOUD Act, and the entities remain Amazon-owned. Whether "control" under § 2713 stops at a German GmbH with EU-only staff is untested in court. A buyer should treat it as residual legal risk, not as resolved.

3. Encryption with provider-managed keys. If the provider can decrypt, the provider can be compelled to decrypt. External key management, where keys live in an HSM the customer or an EU third party controls, is the measure the EDPB and Google both point to. It only helps for data at rest and in transit. A bidder has to decrypt to bid.

The honest framing: a sovereign-branded region from a US hyperscaler moves you from "no control" to "operational control with residual US legal exposure". An EU-controlled provider, or your own infrastructure, moves you to "EU legal exposure only".

All claims below are the providers' own unless marked. Dates are the latest we could verify.

Two benchmarks help score these. France's SecNumCloud qualification, run by ANSSI, is the standard Bleu and S3NS are designed against (Microsoft, 16 June 2025; Google Cloud). The Commission's Cloud Sovereignty Framework of 20 October 2025 scores providers on eight objectives (SOV-1 to SOV-8) and five levels, from SEAL-0 "no sovereignty" to SEAL-4 "full digital sovereignty" (Agenda Digitale, 16 March 2026). Ask each provider which SEAL level it claims and on what evidence.

An advertising stack has more layers than a database. Each one is a place where data can leave EU control. The table lists the layer, the usual leak, and the EU-only pattern.

Two layers are harder than the rest.

The bidstream. Programmatic advertising works by broadcasting a request about a user to many buyers. Under OpenRTB 2.6 that request can carry device.ip, device.ifa, user.id, user.buyeruid and user.eids (IAB Tech Lab, OpenRTB 2.6). If the buyer is a US DSP, those fields leave the EU on every auction. The CJEU held on 7 March 2024 that even the consent string itself is personal data when linked to an IP address (CJEU C-604/22, 7 March 2024). An EU-only stack therefore does one of three things: strips identifiers for non-EU buyers, limits EU supply to deals with EU-hosted buyers, or runs its own bidder so the decision happens inside the perimeter. The field-level rules are in GDPR, ePrivacy and the bidstream.

Measurement. The Norwegian DPA's Xandr decision of 2 October 2026 found that a platform acting as both SSP and DSP was a joint controller and could not rely on the app's consent, stating that "accountability cannot be outsourced" (EDPB, 16 October 2026). Measurement vendors that receive raw events sit in exactly that position.

Four regulatory directions matter. None is specific to advertising. All touch an advertising stack.

Data Act (in force). Regulation (EU) 2023/2854 applies from 12 September 2025. It requires cloud providers to support switching and multi-cloud, caps switching charges at direct cost until 12 January 2027 and bans them after that date (Article 29). Article 32 requires providers to take "all adequate technical, organizational and legal measures" to prevent third-country governmental access to non-personal data held in the EU where that access would conflict with EU or member state law (Regulation (EU) 2023/2854). Google responded with free intra-EU transfers for a customer's own workloads; Microsoft and AWS offered at-cost transfers on request (The Register, 10 September 2025). For an ad tech buyer this means an exit from a DSP or data platform is a contractual right, not a favor. See The real cost of cloud DSPs.

Digital Markets Act (in force). Article 5(2) prohibits a gatekeeper from processing end users' personal data for advertising using third-party services, combining it across its own services or signing users into other services to combine data, "unless the end user has been presented with the specific choice and has given consent". Articles 5(9) and 5(10) require daily, free disclosure of ad prices and publisher remuneration to advertisers and publishers. Article 6(8) requires free access to performance-measuring tools and the underlying "aggregated and non-aggregated data" (Regulation (EU) 2022/1925). The Commission fined Meta €200 million on 23 April 2025 over its "consent or pay" model (European Commission, 23 April 2025). For sovereignty, the practical effect is that log-level data from gatekeepers is a right you can exercise and store on EU infrastructure.

Cloud and AI Development Act (proposed). The Commission tabled the CADA on 3 June 2026. For public bodies it sets four assurance levels; Level 1 is a provider self-assessment, Levels 2 to 4 require independent audit and check whether staff are in the EU, whether provider data can train AI models and whether the service holds a "substantial" or higher EU cybersecurity certificate. As a default rule public bodies may use only EU-established providers, with exceptions for non-EU providers at Level 3 or above that are controlled from a jurisdiction the Commission approves. Private entities in high-criticality NIS2 sectors such as banking and energy "may apply similar criteria" (Wilson Sonsini, 5 June 2026). The proposal is at an early stage and has no adoption date. Advertising teams inside banks, telcos and public broadcasters should expect these tiers to appear in their own procurement rules.

EUCS (stalled). The EU cloud certification scheme under the Cybersecurity Act has been negotiated since 2020. The March 2024 draft removed the sovereignty requirements France had pushed for the highest level (IAPP, 25 April 2024). As of March 2026 its entry into force was unknown and the scheme remains voluntary (Agenda Digitale, 16 March 2026). Do not wait for it. Use SecNumCloud, C5 and the Commission's SEAL levels as proxies.

The pattern: regulators are now looking inside the bidstream, not only at the consent banner. Where the data goes, and who controls the system it goes to, is part of the case.

Use this for RFPs and vendor reviews. Each item maps to a layer in the table above.

1. Corporate control. Name the ultimate parent of every provider in the stack and its country of incorporation. Flag any entity subject to US jurisdiction.
2. Region and partition. For hyperscaler offerings, require the sovereign partition (not a standard EU region) and get the partition name in the contract.
3. Key custody. Require customer-held or EU-third-party-held keys for data at rest, with key access justification logs you can read.
4. Staff residency. Require that privileged access is limited to EU-resident staff employed by an EU entity, with named exceptions and a break-glass procedure you approve.
5. Support path. Ask where tickets escalate at level 3 and whether non-EU engineers can see customer data. Get it in writing.
6. Bid request routing. For SSPs and exchanges, require a per-buyer rule that strips device.ip, device.ifa, user.id, user.buyeruid and user.eids for buyers outside the EU unless consent and an approved transfer mechanism are documented.
7. Log location and retention. Specify where bid logs, win logs and event logs are stored, for how long, and who can query them.
8. Identity operator model. For email-based IDs, require a private operator inside your environment; for telco IDs, confirm the consent flow and signal lifetime.
9. Clean room topology. Require that matching computation runs on infrastructure you or an EU provider control, and that partners receive aggregates only.
10. Measurement endpoints. No third-party pixels that post raw events to non-EU endpoints; server-side collection into your warehouse.
11. Gatekeeper data rights. Exercise DMA Articles 5(9), 5(10) and 6(8) and route the data to EU storage.
12. Transfer mechanism register. For every residual transfer, record the mechanism (DPF certification, SCCs, BCRs) and the fallback if the DPF falls in C-703/25 P.
13. Exit. Reference Data Act Article 29; require export in open formats and a tested exit plan; from 12 January 2027 refuse any switching charge.
14. Certification evidence. Ask for SecNumCloud or C5 scope documents, the claimed SEAL level under the Commission framework, and the gap list. Public-sector and NIS2-sector buyers should add the CADA assurance levels once the text stabilises.

What is the difference between data residency and data sovereignty? Residency is where data is stored and processed. Sovereignty is which jurisdiction can compel access to it, which depends on who controls the provider, who holds the keys and who has privileged access. An EU region of a US cloud gives residency. The CLOUD Act, enacted in March 2018, lets US authorities reach data a US-controlled provider holds anywhere (US DOJ), so residency alone does not give sovereignty.

Does the CLOUD Act apply to data stored in the EU? Yes, if the provider is subject to US jurisdiction. 18 U.S.C. § 2713 covers data in a provider's "possession, custody, or control" regardless of location. The provider can only move to quash on comity grounds if a "qualifying foreign government" is involved, and the only such agreements are with the UK (3 October 2019) and Australia (15 December 2021) (US DOJ). EU regulators said on 12 July 2019 that such an order is not a lawful transfer basis under GDPR Article 48 (EDPB-EDPS).

Is the AWS European Sovereign Cloud immune to the CLOUD Act? AWS has not claimed that. Its 15 January 2026 announcement describes EU-resident operations, German GmbH entities, an EU advisory board and "zero operational control outside of EU borders", and does not mention the CLOUD Act (Amazon, 15 January 2026). The entities are Amazon-owned. Whether that structure defeats a US order is untested. Treat it as reduced, not eliminated, legal exposure.

Is the EU-US Data Privacy Framework still valid in 2026? Yes. The General Court upheld it on 3 September 2025 in Latombe v Commission (T-553/23). An appeal to the Court of Justice (C-703/25 P) was lodged on 31 October 2025 and is pending (OJ C/2025/6610, 22 December 2025). Companies that rely on DPF certification should keep SCCs or BCRs ready as a fallback.

Can an EU company legally send bid requests to a US DSP? It can, with a lawful basis for each data element, a transfer mechanism for the recipient and data minimization. Since 7 March 2024 the TC String itself counts as personal data when linked to an IP address (CJEU C-604/22), and the Norwegian DPA's October 2026 Xandr decision shows that platforms in the chain are joint controllers (EDPB, 16 October 2026). The sovereignty question is separate: once the request is in the DSP's logs, US law reaches it. Stripping identifiers for non-EU buyers or routing EU supply to EU-hosted buyers avoids both problems.

1. US Department of Justice, "CLOUD Act Resources" (March 2018 enactment; UK agreement 3 October 2019; Australia agreement 15 December 2021). https://www.justice.gov/dag/cloudact
2. Congress.gov, H.R. 4943, Clarifying Lawful Overseas Use of Data Act (115th Congress). https://www.congress.gov/bill/115th-congress/house-bill/4943
3. EDPB and EDPS, "Joint response to the LIBE Committee on the impact of the US CLOUD Act on the European data protection framework" (12 July 2019). https://www.edpb.europa.eu/our-work-tools/our-documents/letters/edpb-edps-joint-response-libe-committee-impact-us-cloud-act_en
4. Regulation (EU) 2016/679 (GDPR), Articles 44 to 49. https://eur-lex.europa.eu/eli/reg/2016/679/oj
5. CJEU, Case C-311/18, Data Protection Commissioner v Facebook Ireland and Schrems (16 July 2020). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311
6. EDPB, "Recommendations 01/2020 on measures that supplement transfer tools", final version (18 June 2021). https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en
7. Commission Implementing Decision (EU) 2023/1795, EU-US Data Privacy Framework (10 July 2023). https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj
8. IAPP, "European General Court dismisses Latombe challenge, upholds EU-US Data Privacy Framework" (3 September 2025). https://iapp.org/news/a/european-general-court-dismisses-latombe-challenge-upholds-eu-us-data-privacy-framework
9. Hunton, "EU's General Court Confirms Adequacy of EU-U.S. Data Privacy Framework" (3 September 2025). https://www.hunton.com/privacy-and-information-security-law/eus-general-court-confirms-adequacy-of-eu-u-s-data-privacy-framework
10. Hogan Lovells, "Transatlantic data transfers: EU General Court upholds Data Privacy Framework" (3 September 2025). https://www.hlc.com/en/publications/transatlantic-data-transfers-eu-general-court-upholds-dat-privacy-framework
11. Official Journal of the EU, C/2025/6610, Case C-703/25 P, Latombe v Commission, appeal brought 31 October 2025 (22 December 2025). https://eur-lex.europa.eu/eli/C/2025/6610/oj
12. Amazon, "AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe" (15 January 2026). https://press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe
13. Microsoft, "Microsoft completes landmark EU Data Boundary" (26 February 2025). https://blogs.microsoft.com/eupolicy/2025/02/26/microsoft-completes-landmark-eu-data-boundary/
14. Microsoft News Center Spain, "Microsoft presenta nuevas soluciones de Nube Soberana para las organizaciones europeas" (16 June 2025). https://news.microsoft.com/es-es/2025/06/16/microsoft-presenta-nuevas-soluciones-de-nube-soberana-para-las-organizaciones-europeas/
15. European Cloud, "Microsoft cannot guarantee data sovereignty" (24 July 2025, updated 2 December 2025; secondary report of French Senate testimony). https://european.cloud/2025/07/microsoft-cannot-guarantee-data-sovereignty/
16. Google Cloud, "Advancing digital sovereignty on Europe's terms" (11 October 2022). https://cloud.google.com/blog/products/identity-security/advancing-digital-sovereignty-on-europes-terms
17. Google Cloud documentation, "Sovereign Controls by Partners overview" (undated, retrieved 17 October 2026). https://docs.cloud.google.com/sovereign-controls-by-partners/docs/overview
18. Google Cloud, "Sovereign Cloud" (undated). https://cloud.google.com/sovereign-cloud
19. OVHcloud, "SecNumCloud" (Managed VMware vSphere qualified December 2020; SNC Cloud Platform September 2026). https://www.ovhcloud.com/en/enterprise/certification-conformity/secnumcloud/
20. STACKIT, homepage (undated). https://stackit.com/en/
21. Scaleway, homepage (undated). https://www.scaleway.com/en/
22. Regulation (EU) 2023/2854 (Data Act), Articles 29, 32 and 50. https://eur-lex.europa.eu/eli/reg/2023/2854/oj
23. The Register, "Big clouds scramble as EU Data Act brings new data transfer rules" (10 September 2025). https://www.theregister.com/2025/09/10/big_clouds_scramble_over_eu/
24. Regulation (EU) 2022/1925 (Digital Markets Act), Articles 5(2), 5(9), 5(10), 6(8). https://eur-lex.europa.eu/eli/reg/2022/1925/oj
25. European Commission, "Commission finds Apple and Meta in breach of the Digital Markets Act", IP/25/1085 (23 April 2025). https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085
26. Wilson Sonsini, "European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI" (5 June 2026). https://www.wsgrdataadvisor.com/2026/06/european-commission-publishes-proposal-for-act-to-reduce-reliance-on-foreign-cloud-and-ai/
27. IAPP, "A view from Brussels: To be sovereign or not to be" (25 April 2024). https://iapp.org/news/a/a-view-from-brussels-to-be-sovereign-or-not-to-be
28. Agenda Digitale, "ENISA e certificazione cloud: costruire uno standard di sicurezza europeo" (16 March 2026; EUCS status and Commission Cloud Sovereignty Framework of 20 October 2025). https://agendadigitale.eu/sicurezza/enisa-e-certificazione-cloud-costruire-uno-standard-di-sicurezza-europeo
29. Irish Data Protection Commission, "Data Protection Commission announces conclusion of inquiry into Meta Ireland" (22 May 2023). https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland
30. CNIL, "Sanctions issued by the CNIL" (list; Criteo 15 June 2023). https://www.cnil.fr/en/sanctions-issued-cnil
31. Privacy Laws & Business, "CNIL fines Google €325 million and Shein €150 million" (4 September 2025). https://www.privacylaws.com/news/cnil-fines-google-325-million-and-shein-150-million/
32. EDPB, "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data" (16 October 2026; decision 2 October 2026). https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
33. CJEU, Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit (7 March 2024). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604
34. IAB Tech Lab, OpenRTB 2.6 specification (GitHub). https://raw.githubusercontent.com/InteractiveAdvertisingBureau/openrtb2.x/main/2.6.md
35. IAB Europe, "Transparency & Consent Framework" (TCF v2.3; adoption deadline 28 February 2026). https://iabeurope.eu/transparency-consent-framework/
36. EUID documentation, "Public and Private Operators" (retrieved 17 October 2026). https://euid.eu/docs/ref-info/ref-operators-public-private
37. PPC Land, "The Trade Desk integrates Utiq's telco identity signals across EMEA" (1 June 2026; Utiq figures as of 15 November 2025). https://ppc.land/the-trade-desk-integrates-utiqs-telco-identity-signals-across-emea/
38. Clifford Chance, "EU e-Evidence Regulation and Directive: What it means for e-commerce platforms" (August 2026). https://www.cliffordchance.com/insights/resources/blogs/regulatory-investigations-financial-crime-insights/2026/08/eu-e-evidence-regulation-and-directive-what-it-means-for-e-commerce-platforms.html

• 18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.

• 17 October 2026. First edition. Next review 15 January 2027.