What Can Leave the Room?

An output can leave a clean room and still be hard to use after the deal ends. What matters is what leaves, who receives it and what they may do next. This paper follows fourteen output routes across nine product boundaries — Snowflake, Databricks, AWS Clean Rooms, Google Ads Data Hub, BigQuery clean rooms, InfoSum, LiveRamp, Amazon Marketing Cloud and Meta Advanced Analytics — through public documentation as of 9 October 2026. Public sources describe how outputs are received and some limits on their use, including published policies. They do not settle each buyer’s rights after exit. This study read no private contract and tested no move to another environment. It does not rank vendors; it sets out the assets, terms and tests a buyer needs to check whether a task can continue.

Clean rooms promise that raw rows never move and that partners never see each other’s tables. That is the privacy story, and it is often true. The purchase turns on the other side of the boundary. A buyer wants something back: a report, an audience, a model or a list of matched records. It also needs to know what it can still do with that result when the contract ends.inference

Scheduled dates make the question practical. Snowflake stopped new legacy clean rooms in its web interface on 1 October 2026 and schedules the legacy interface to close and the creation of new rooms through the legacy API to stop on 1 February 2027, and access to existing legacy rooms to end on 1 June 2027 [1][2]. Databricks schedules an older MCP endpoint to sunset on 31 October 2026 [3]. Publicis agreed on 17 May 2026 to buy LiveRamp; at the cutoff the deal was pending [4][5].fact C003 C002 C123 C001 C105 C082 C060

This paper does not rank vendors. It follows fourteen output routes through public documentation as of 9 October 2026 and records what that documentation shows. Where it is silent, the paper says so and names where it looked. It read published policies where they were linked from the documentation, but no private contract, and it tested no live account, so it cannot say what any buyer’s own terms allow.inference

Each check needs its own evidence. If a report can leave but an audience must stay inside an ad system, they get separate rows. Where a source does not state a right, the answer stays open rather than being guessed.inference

Continuity means one named task in a named environment, not a copy of a supplier’s system. Reading a retained report, recomputing it, refreshing it with new data and scoring new records with an exported model are different tasks with different needs. The reviewed sources document output mechanisms, but this study did not establish, for each route, the assets, permissions and dependencies needed to continue a specified task elsewhere. AWS documents a model-artifact export; replaying that model would also need permitted scoring inputs, the same transforms, a compatible runtime, applicable terms and a declared tolerance, and was not assessed.inference C103

At the open end, an AWS Clean Rooms list analysis rule “outputs row-level lists of the overlap” between collaborators’ tables [10]. Snowflake’s clean-room agent supports a template that builds a list of overlapping records with their attributes and exports it to an approved account [7]; ordinary Snowflake analysis results are returned in the workspace [6]. InfoSum’s API carries a permission that lets operators activate export columns to authorised destinations [17][16].fact C024 C012 C109 C056 C055

At the closed end, Ads Data Hub audiences go only to linked Google Ads and Display & Video 360 accounts [14], and Google’s published Ads Data Hub Policies limit some uses of its data, such as building profiles or audiences beyond approved activation [21]. Google also documents joining the results of separate Ads Data Hub queries in BigQuery [22]. Amazon Marketing Cloud returns aggregate results to the advertiser’s S3 bucket, while its audiences go into Amazon Ads [19].fact C038 C049 C124 C125

“Only aggregates leave” does not describe every reviewed route: some permit approved row-level outputs or model artifacts. That does not imply permission to extract a partner’s unrestricted source table. The useful request is a named list of output objects, each with its recipient, its grant and its retention terms.inference

Outputs can end before their window

Databricks describes clean-room output tables as temporary and read-only, kept for 30 days unless copied to local storage [9]. “Deleting a clean room removes all output tables and historical data from the output catalog” [9]. By default only the collaborator who runs the notebook can read an output; sharing outputs with all collaborators is a Public Preview option [9].fact C016 C017 C107 C108

A model can leave; its inputs stay

AWS lets a collaboration assign one member the ability to receive trained model exports and, separately, inference output [11]. Since 30 November 2025 AWS has offered synthetic training data in Clean Rooms ML, and it says customers can export the trained model weights [12]. Amazon Marketing Cloud’s Custom Models, announced on 31 October 2025, let customers use their own algorithms to build audiences [26].fact C025 C026 C029 C030 C076

An exported model is a transfer mechanism, not a licence. Running it elsewhere needs permitted inputs, the same preprocessing, compatible software and a tolerance agreed in advance. Retraining it needs data the buyer may not be allowed to take.inference

Activation needs the recipient

A Snowflake collaboration declares where results may be sent [8]. Ordinary analysis results are returned in the workspace. For collaborator activation, “the receiving collaborator must call VIEW_ACTIVATIONS() and PROCESS_ACTIVATION() to import the results” [6]. A completed activation run is not proof that the recipient imported it.fact C010 C013 C109

Leaving is not the same as deletion

InfoSum documents two exits. An owner closes a collaboration; that is irreversible and stops new queries or exports, while previous activity can still be seen. A member that leaves can no longer see the collaboration’s details, including the event logs; an owner must close rather than leave [17].fact C057 C075

Published terms settle some of it

Some limits are public. Google’s Ads Data Hub Policies bar using Google’s data to build or augment profiles or audiences beyond the activation channels Ads Data Hub approves [21]. AWS’s Service Terms bar using Clean Rooms information to identify a person unless the data’s contributor permits it, and say deleting a collaboration ends access to the customer’s content or deletes it from intermediate tables; that does not recall a result already delivered [23]. The Amazon Marketing Cloud Agreement makes query results confidential and restricts sharing, with named exceptions for the relevant agency, the advertiser and service providers acting for the advertiser, all bound to confidentiality [24]. Snowflake’s public clean-room terms defer to the customer’s own agreement [25].fact C124 C126 C127 C128 C129

For Databricks, InfoSum, LiveRamp and Meta Advanced Analytics, no public product-specific terms on outputs, retention or post-termination use were found in a bounded search. None of the published terms reviewed states how long a buyer may keep an output after exit, so that answer stays not established.inference

Keep a record of each result you will need after exit: its owner, location, expiry rule and terms of use. Test the event that ends access, such as room deletion or leaving, as well as the normal expiry. A copy route does not by itself give the right to keep or reuse the copy.inference

AWS is explicit: query and job logs show a query’s status but “don’t report whether query output was delivered” [27]. Since 11 August 2026 a member granted a specific ability can export those logs, once every member approves the change [28]. Snowflake’s Snowsight collaboration view has an Activity tab that records analysis template runs [29]. Its agent observability redacts orchestrator-authored content from consumer records by default [30].fact C031 C028 C119 C004

Deletion records exist, with limits. AWS CloudTrail can record S3 object deletions as data events, which are off by default and charged [31]. In a versioning-enabled S3 bucket, a simple delete inserts a delete marker instead of removing the object [33]. BigQuery audit metadata records how a table was deleted [32].fact C110 C111 C112

Withdrawal has the same shape. Closing an InfoSum collaboration stops new exports [17]. When an AWS table’s data access budget reaches zero, it can no longer be used in queries, jobs or ML inputs [34]. Google’s Data Manager API can remove every member of an audience [35].fact C057 C032 C042

These controls stop new use; the cited pages do not establish deletion of a copy already delivered. So start with one output and one route. Link the run identifier to the output object, the transfer and the recipient’s response, then record what was kept and what was removed. The contract should name who supplies each record and for how long. A hash can show that two files match; it cannot show that the buyer may use either.inference

Three general surfaces carry a GA label: Cortex Agents and MCP servers in Snowflake Native Apps since 7 August 2026 [36], BigQuery’s MCP server since 20 April 2026 [37], and Databricks’ Genie One MCP server since 25 September 2026 [3]. Databricks schedules the former Genie endpoint, /api/2.0/mcp/genie, to sunset on 31 October 2026 [3].fact C006 C086 C099 C105

Snowflake’s clean-room agent is an open preview [7], and its AI Gateway for Advertising was announced in preview on 5 October 2026 [38]. Databricks lists Meta’s ads MCP server — Meta’s campaign tools, not Meta Advanced Analytics — in its Marketplace with no stage stated [39]. Amazon’s AMC SQL Generator entered closed beta on 30 September 2026; during the beta it is available in the United States, and Amazon says its agents serve North America, Europe and Far East marketplaces from US-hosted infrastructure [40]. AWS documents an aws-cleanrooms skill that troubleshoots permission errors and missing ML-job logs [41]; Clean Rooms analytics and export through agents were not evaluated here. LiveRamp said in March 2026 it was selectively enabling a limited number of builders to deploy agents [42].fact C011 C005 C020 C047 C096 C116 C106 C113

Amazon says the expert tools will reach general availability in early 2027, priced per use through AWS Marketplace, with broader geography before then [40]. That is Amazon’s plan.attributed C048 C117

MCP and A2A define how a call is authorised. AAMP is IAB Tech Lab’s umbrella framework rather than a transport; AAMP 3.0 introduced the OpenProposal draft, with public comment scheduled to end on 22 October 2026. None of them, by itself, grants advertising permission, records consent or makes an output exportable. Treat an agent route like any other route: name what it may read and write, the account it acts for, how it is revoked and what happens to queued work.inference C104 C070 C071 C088

WPP announced its acquisition of InfoSum on 3 April 2025 [45]. LiveRamp completed its acquisition of the clean-room company Habu on 31 January 2024 [44].fact C053 C064

Publicis agreed on 17 May 2026 to buy LiveRamp for $38.50 a share in cash, a total enterprise value of $2.167 billion [4][54]. LiveRamp’s stockholders adopted the agreement on 17 August 2026 [47]. The parties filed US premerger notifications on 11 June 2026, and closing also needs CFIUS approval [46]. The outside date is 16 May 2027, extended automatically to 16 August 2027 if only certain regulatory conditions remain [46]. On 16 September 2026 Publicis said the deal “remains subject to customary approvals” [5].fact C082 C078 C061 C090 C091 C092 C060

Publicis expects the deal to close before the end of 2026 [5]. LiveRamp told employees it is committed to “an independence charter focused on open access, privacy and pricing controls” [54].attributed C093 C079

No closing filing or notice was found in the sources searched through 9 October 2026, so this paper treats LiveRamp as pending. A pending owner is a reason to write access, pricing and data-use terms into the contract. It is not proof that they will change.inference C094

Snowflake has already removed legacy web-interface connectors in two rounds. On 20 August 2026 it removed the LiveRamp, Acxiom, Merkury and PAIR identity connectors [49]. On 10 September 2026 it removed further identity connectors, including Experian, Acxiom Real ID and The Trade Desk UID 2.0, and activation connectors including Display & Video 360 and LiveRamp; existing configurations were not deleted [50].fact C008 C083 C118 C084

PPC Land reported on 2 June 2026 that Amazon made first-party paid-feature signals in AMC free to query through 31 December 2026, while third-party signals such as Experian’s still need a subscription [51]. Amazon’s own page could not be read [53].reported C052

The restrictions are deliberate, and they depend on configuration. Ads Data Hub’s thresholds keep results from describing small groups [13]. BigQuery clean-room contributors can stop subscribers copying or exporting results, and Google warns that analysis rules “might not fully prevent sophisticated queries from extracting unauthorized data”, pointing to approved query templates [15]. Google’s PAIR design returns match rates, not user-level matches [55].fact C036 C035 C114 C044

The strongest counter-argument to this paper is that useful learning can survive without a full export. A permitted report, a tested estimate, a frozen model or a written method may be enough for the next decision. Continued governed access can also be a dependency a buyer accepts on purpose, if its terms and price are clear. A closed model can be a sound purchase; an exported one can be a poor exit asset if its inputs, licence or runtime cannot travel.inference

So test the trade-off directly. Can the buyer still make the next decision? Can it check how the result was reached? Can it refresh the work when needed, and at what cost? A full export is worth having only if it helps answer yes on terms the buyer may use.inference

The output record

Procurement, data engineering and the business owner complete one record per output: the business task and the result it needs; product, route and version; input and output schema; data owner; the account the work runs as; the authorised recipient; destination owner and region; permitted purpose; retention start and end; exit events; copy and deletion terms; code and runtime dependencies; acceptance evidence; and who signs off. Mark which assets the buyer supplied, which a partner supplied and which are joint or derived: one output can depend on several parties’ permissions.inference

The minimum useful exit package

Classify each dependency as transferable, replaceable, available only through continued access, prohibited from transfer, or unresolved. That gives the buyer a transition plan instead of a single portability colour.inference

The cost and continuity worksheet

Ask bidders to quote the same task and the same exit scenario: setup, compute, storage, transfer, licences, labour, running two systems in parallel, revalidation and downtime, with who pays each and whether it is a quote or an estimate. Compare the cost of the exit package with the cost and risk of continued access. Do not build a cross-vendor total from incompatible price units.inference

Thirteen tests

Use test data and accounts cleared for that use, and record the expected result before running. Synthetic data tests controls and transport; it does not show production match quality, privacy loss or campaign effect.inference

The task-level test that would change the rebuild column: a documented, permitted transfer that lets another environment perform the same named task within an agreed tolerance. If a buyer can show that, the finding for that route changes, with the source and date recorded.inference

Where we looked

No Fluff Advisory owns the guides checked here. The starting dossier, produced with an AI deep-research tool, was checked against the guides’ source code and the cited pages. Of its 171 audit rows, 156 matched what the guides say, 7 were recommendations with no guide claim behind them and 8 attributed statements the guides do not make. The guide corrections were merged to the site on 9 October 2026.[60][61]inference

A critical review of the first draft then found that it had treated evidence of export and storage as evidence of rights after exit, compared different assets within one figure row, used rebuild in three senses and described some unknown release stages as not available. An earlier edition was published on 9 October 2026 and withdrawn the same day; a second review then asked for the figure to apply its own definitions, for task continuity to be reported as not assessed, and for published use policies to be read. Those changes, and two earlier corrections that this ledger had overstated, are listed below.inference

This study reads public sources, including published use policies linked from the documentation, up to 9 October 2026. It began from a research package produced with an AI deep-research tool — 171 audit rows on this site’s guides, 82 claims and 91 sources — which was checked against the guides’ source code and the cited pages, and then revised after a critical review of the first draft. The ledger shows which claims rest on a source and which are the author’s findings. Each sourced claim has a passage, a locator where needed, a link and a check date; each author finding states its premises, reasoning and, for a not-found result, where it searched. A not-found result does not mean the route cannot exist. Release labels state what a vendor says is ready; they do not show what a buyer’s account can do, and a launch post shows that a claim was made on a date, not that it is true. Validation and review added 23 sources and 46 claims. No live account was tested and no private contract was read.