For about four years, every data governance conversation in marketing ran on the same engine: third-party cookies are going away, so get your first-party data in order.
It was a useful fiction while it lasted. Deadlines are motivating, and that one had a date on it.
Then Google reversed the deprecation in April 2025 and kept third-party cookies in Chrome. In October 2025 it retired most of the Privacy Sandbox APIs, including Topics, Protected Audience, and Attribution Reporting, citing low adoption. The replacement architecture a generation of measurement roadmaps was built around mostly doesn’t exist.
If your governance program was justified on the cookie deadline, the justification evaporated. The work didn’t.
The Pressure Just Moved
Three things kept going while everyone watched Chrome.
State privacy law stopped being a coastal issue. Roughly twenty states have comprehensive laws in effect in 2026, with Indiana, Kentucky, and Rhode Island coming online January 1. The obligations aren’t uniform. Rhode Island skips universal opt-out mechanisms other states require. Oregon now requires recognition of universal opt-out signals and a full stop on geolocation data sales. You can’t write one policy and call it covered.
The point isn’t that every marketing or AI team becomes its own legal department. It’s that legal, privacy, security, marketing, analytics, product, and technology can’t each hold a partial view of the same data use and assume someone else has the whole picture.
Automated decision-making became a regulated category. California’s rules now require opt-outs when automated decision-making technology replaces or substantially replaces human judgment in significant consumer decisions, plus risk assessments and cybersecurity audits for high-risk processing. Whether a particular workflow triggers an obligation depends on jurisdiction, organization, data, decision, and implementation. The operational lesson is broader: once automation meaningfully shapes consequential outcomes, you need documented accountability and a way to challenge or stop the process.
A fifth of the browser market never waited. Safari has blocked third-party cookies since 2020. Firefox partitions by top-level site. Brave blocks by default.
None of that produces a deadline for a slide. All of it produces the same requirement: know what data you hold, why you hold it, who agreed to it, and whether you can remove it.
That’s governance in its useful form. The visible ownership, definitions, provenance, permissions, quality checks, and escalation paths that let a team use information in ways it can explain and defend. Compliance is one outcome. Better reporting, safer automation, and more dependable AI are others. You don’t need a complete enterprise program to begin. You need enough structure that a person facing a real decision can tell which data to use, what it means, who’s accountable, and what happens when the answer is uncertain.
AI Is What Makes the Gap Expensive
Ungoverned data used to produce bad reporting. Somebody pulled a number, the number was off, an analyst caught it, and the cost was a week of rework.
Ungoverned data now feeds systems that generate outputs at volume, with confidence, to people who won’t check. The failure mode moved from a wrong number in a deck to a wrong answer in a workflow, repeated a few thousand times before anyone notices.
Gartner’s February 2025 research predicted organizations would abandon 60% of AI projects unsupported by AI-ready data through 2026, drawing on a July 2024 survey of 1,203 data management leaders in which 63% either lacked appropriate data management practices for AI or weren’t sure. That window has closed and I haven’t seen a credible retrospective, so treat it as a well-grounded warning rather than a verified outcome.
What I can say from the work: when an AI initiative stalls, the cause is almost never the model. Nobody can say where a field came from, which definition of “customer” a table uses, or whether the records were collected under terms permitting this use.
That’s not a technology problem. That’s a foundation problem.
“AI-ready” doesn’t mean perfectly clean data or a finished architecture. It means the team can answer a short list:
- What purpose does this workflow serve, and who owns the outcome?
- Which sources and fields does it use, what does each mean, and where did it originate?
- Are the data and its intended use permitted under the relevant collection terms, contracts, and policies?
- Who can review, correct, pause, or stop it?
- How will anyone know when the output is wrong or causing harm?
If those answers are missing, the model doesn’t need better prompting. The workflow isn’t governable yet.
Not Every Workflow Needs the Same Controls
Governance should be proportional to risk. Not every spreadsheet needs a review board, and not every AI experiment needs the controls appropriate for a workflow affecting employment, credit, health, housing, pricing, or eligibility.
Raise the level of review when the data is more sensitive, the decision carries more consequence for a person, an external vendor receives the information, an action is hard to reverse, or an error would be hard to detect before it reaches people.
That isn’t an argument for slowing everything down. It’s how a team moves fast on low-risk work without pretending every use of data is equally safe.
Four Things, in Order
The version of this article I wrote two years ago had seven steps. Seven steps is a way of avoiding the harder work of saying which comes first.
1. Map what you have and where it came from.
Not a full catalog. A working inventory of the systems feeding anything customer-facing, decision-shaping, or connected to an AI workflow. For each critical source, record what it contains, what the important fields mean, where the data originated, the collection or permission basis, who can access it, where it flows next, how long it’s retained, and who is accountable for it.
You’re hunting for three things: places where nobody can answer the provenance question, places where two systems use the same word differently, and datasets that have spread farther than anyone can trace.
The middle one does the most damage. “Customer” may mean a closed-won deal in the CRM, an active subscriber in billing, a user with product activity in the last 30 days, or anyone who ever submitted a form. An AI assistant won’t resolve that disagreement. It’ll reproduce whichever definition was easiest to connect.
If the estate is large, automated governance and auditing tools can inventory tags, collection, access patterns, and implementation drift at a scale that isn’t manual-feasible. Choose based on the systems you operate and the evidence you need, not because a category label promises AI readiness.
2. Name an owner for every consequential decision.
Most governance frameworks fail here. They document policies and leave decision rights implicit, so a real question routes to whoever is available rather than whoever is accountable.
At minimum, document who owns five decisions: approving a new data source, approving a new use of existing data, changing a consequential definition, granting or changing access, and pausing or retiring a workflow producing unreliable output.
Ownership isn’t a mailing list. It means a named person or role has the authority, context, and obligation to decide or to escalate through a known path. Include the authority to say no. A reviewer who can’t stop something is decoration.
3. Make deletion work before you need it.
Deletion requests are the cheapest test of whether governance is real, because the request either gets fulfilled across every system or it doesn’t. Run one against yourself. Pick a record and follow it through the warehouse, the CDP, the email platform, exports, reverse-ETL destinations, analytics tables, audience lists, vendor systems, manual spreadsheets, backups, and any AI or automation workflow that received it or a derivative.
The point isn’t a perfect audit in one afternoon. It’s revealing where your understanding of data flow stops.
Record the result. For every location you can’t reach, note the system owner, the reason, the remediation path, and the next review date. A discovered gap becomes governance work only when someone owns closing it.
4. Write the plan for when it fails.
Governance documents describe the intended state. What’s usually missing is the response when the intended state fails.
Write down what happens when a workflow produces an inaccurate answer, uses the wrong source, exposes information it shouldn’t, applies an outdated definition, or can’t explain how it reached an output. Name who can pause it, who gets told, how fast action is expected, what evidence is preserved, and who communicates with affected teams or customers.
This doesn’t need to be long. It needs to work when people are under pressure and the person who built the workflow is unavailable.
For any AI workflow reaching customers, employees, decisions, or operational systems, add a one-page map before scaling: purpose, owner, input data, source systems, output users, connected vendors, expected action, evaluation method, human decision rights, escalation path, and the conditions requiring a pause. That’s the minimum needed to answer a basic question afterward. What did the system use, what did it produce, who relied on it, and who was watching?
Start Small
If you need a place to begin this month, don’t launch a governance program. Pick one data domain or workflow that already causes rework, disagreement, or uncertainty.
Resolve one definition dispute. Trace one consequential field to its source. Name the person who can approve or halt its use. Test whether one record can be deleted across its known destinations.
The first useful governance artifact is a map, not another tool.
The Argument That Holds Up Now
The cookie deadline was a good forcing function and a bad reason. It made governance a project with an end date, which is the wrong shape for an operating capability.
The reason that holds up is simpler. You’re about to connect systems that generate output at a scale no human reviews line by line. What comes out is bounded by what you can vouch for going in. And the ability to vouch for it is something you either built beforehand or explained the absence of afterward.
Nobody’s imposing a deadline on that one. That’s what makes it easy to defer and expensive to defer.
Start With One Field
You don’t need a governance program to begin. You need one consequential field traced to its source, one owner named, and one deletion tested.
A Working Session is 90 minutes on where to start, with the person closest to the data. You leave with a named constraint and a first step with an owner. The fee is credited against a Diagnostic if you book one within 30 days.
