The Associated Press has overhauled its data protocols, creating a distinct split between B2B privacy protections and consumer tracking as 20 U.S. states implement comprehensive new privacy laws.
The Associated Press has implemented a significant structural shift in its data management protocols, creating a distinct policy divide between its professional business-to-business (B2B) operations and its consumer-facing news platforms. Documents show that on March 3, 2026, the organization materially updated its corporate privacy policy to cover B2B sites like workflow.ap.org, explicitly separating these practices from AP News. This update narrows the use of cookies on professional sites to basic analytics and functionality, a move that signals a more conservative approach to data handling for corporate clients than for the general public.
Under the new 2026 B2B policy, the organization states it does not sell or share personal information as defined by the California Consumer Privacy Act (CCPA) for its business properties. However, the organization continues to utilize sophisticated tracking technologies, including Google Analytics with IP anonymization and ZoomInfo. The AP has adopted a consent-management platform to log opt-out choices, treating certain business-intelligence uses as potential sales or sharing under California law to ensure compliance with evolving definitions of data commercialization. This bifurcation allows the AP to maintain high-trust relationships with corporate partners while managing the legal risks associated with modern business-intelligence tools.
This administrative pivot comes as the AP voluntarily extends CCPA-style rights to residents of 20 U.S. states. These rights, which include the ability to access, delete, correct, and opt out of profiling or targeted advertising, are now available to residents in states that recently brought comprehensive privacy statutes online, including Kentucky, Maryland, Nebraska, New Hampshire, New Jersey, and Texas. This expansion reflects the growing pressure on national organizations to standardize their privacy interfaces as the U.S. Congress remains deadlocked on a singular federal data protection standard, leaving a patchwork of state-level mandates in its wake.
In contrast to the tightened B2B environment, the AP News consumer privacy policy remains anchored in a 2024 revision that permits extensive data sharing with third-party ad-tech vendors. The organization utilizes a wide array of cross-site tracking technologies, including pixels, SDKs, device IDs, and session replay heatmaps. These tools are used in conjunction with third-party analytics providers like Comscore and Parse.ly to build detailed audience segments and personalize content. The AP acknowledges that this collection and disclosure of information to partners like Google, Meta, and Taboola may be considered selling or sharing for targeted advertising under applicable state laws.
The implementation of these privacy controls has drawn scrutiny from transparency advocates. The AP’s current system requires users to manage preferences through a “Manage Your Privacy Choices” section rather than a universal global opt-out. Furthermore, the policy stipulates that these choices are specific to the browser and device used at the time of selection. If a user clears their cookies, they must renew their opt-out selections, a design feature that critics argue creates unnecessary friction for individuals attempting to exercise their statutory rights. This friction is particularly notable as the organization emphasizes its role as an independent global news organization dedicated to factual reporting.
As the advertising industry rolls out new standardized frameworks like the IAB’s Multi-State Privacy Agreement and GPP National v2, the AP’s dual-track policy highlights the unresolved tension between media revenue models and the increasing demand for data sovereignty. While the B2B side of the house moves toward a functional-only cookie model, the consumer side continues to lean on a complex infrastructure of programmatic partners and data brokers. This policy split serves as a primary case study for how major media institutions are attempting to satisfy a patchwork of state regulations while maintaining the data-driven advertising revenue essential to the modern news business. For the public, the reality remains that while the AP is the essential provider of technology for the news business, that technology includes a robust mechanism for tracking and disclosing user preferences to third-party marketing entities.

