Digital ad companies are racing to keep up with shifting rules and expectations around consumer privacy rights, as regulators start to frown on once-customary business practices.

Regulators also are expanding the definition of what it means to share data and broadening the the meaning of sensitive data to include "inferences," or the conclusions advertisers draw about consumers from their nonsensitive data.