Retail media contracts need stronger legal safeguards as sector grows

This article was originally published by Celene Ignacio for Retailbiz (23 July 2026)

As retailers build out retail media networks to generate new revenue streams, they are taking on legal risks traditionally faced by media companies and digital advertising platforms, according to Bartier Perry partner Michael Cossetto.

Speaking to RetailBiz, Cossetto said retail media is no longer simply a marketing initiative but a data-driven commercial platform that requires stronger legal, governance and compliance frameworks as retailers monetise their customer data and advertising inventory.

“The most significant issue is privacy and customer data use,” he said.

“Retail media relies heavily on first-party customer data, loyalty programs and behavioural insights. As privacy regulators increasingly scrutinise tracking technologies and targeted advertising, retailers need to ensure they have appropriate consents, transparent disclosures and robust governance around data use.”

Cossetto said recent regulatory action around tracking technologies demonstrated that privacy regulators now view advertising technology as a core compliance issue rather than simply a marketing tool.

Competition law is also becoming a growing consideration as retail media expands.

“Retailers possess valuable data and customer access that may not be available to competing businesses,” he said.

He pointed to concerns around supplier pressure to buy retail media, pricing transparency and measurement methodologies, adding that competition risks increase where retail media is linked to shelf space, ranging decisions, promotional participation, access to data or broader supplier trading terms.

The comments follow the ACCC’s supermarkets inquiry, which highlighted concerns about the transparency of retail media programs, their return on investment and perceived pressure on suppliers to participate.

Contracts need clearer data and liability provisions

Cossetto said retailers should pay close attention to how agreements with brands, agencies and retail media technology providers allocate responsibilities for data, compliance and liability.

Key areas include defining data-sharing rights, ensuring appropriate customer consents are in place, documenting campaign measurement methodologies and assigning accountability across multiple technology vendors involved in retail media campaigns.

Although technology providers often handle advertising infrastructure and analytics, retailers remain responsible for how customer data is collected and used.

“Contracts should include privacy obligations, security requirements, audit rights, compliance warranties and indemnities,” Cossetto said.

He added that agreements should also include security standards, breach notification requirements and clear liability provisions that allocate responsibility to the party best able to manage each risk.

“Brands should stand behind product claims and supplied creative. Retailers should stand behind media delivery, platform operation and their own data practices. Technology providers should stand behind their tools, security and compliance commitments.”

Derived data often overlooked

According to Cossetto, one of the most common contractual oversights involves ownership and use of data generated during campaigns.

He said while agreements often address ownership of existing customer data, they frequently fail to deal with audience segments, campaign insights, predictive models and analytics created throughout the relationship.

“These datasets can ultimately be more valuable than the original data itself,” he said.

Another common issue is failing to specify how shared data cannot be used, potentially leading to disputes over customer profiling, product development or other commercial applications.

With privacy and digital advertising regulations continuing to evolve, Cossetto said agreements should also include mechanisms allowing parties to adjust their practices as legal requirements change.

Rather than focusing solely on ownership, he recommends agreements clearly define who controls each category of data, who can access it, how long it is retained, whether it can be combined with other datasets and when it must be deleted.

Avoid promising commercial outcomes

Cossetto also warned retailers against making broad claims about campaign performance that cannot be substantiated.

He said there is an important distinction between committing to deliver advertising outputs, such as impressions, clicks or placements, and guaranteeing commercial outcomes such as sales growth or return on advertising spend.

“If a retailer promises commercial outcomes without reasonable grounds, that can create misleading conduct risk under the ACL,” he said.

“Retailers should therefore avoid loose language such as ‘guaranteed sales growth’ or ‘guaranteed ROI’ unless the promise is carefully qualified and genuinely supportable.”

To minimise disputes, Cossetto said agreements should distinguish delivery obligations from performance aspirations, include disclaimers for factors outside a retailer’s control, require brands to approve campaign assets before launch and incorporate appropriate dispute resolution provisions.